WEBVTT

1
00:00.000 --> 00:01.027 align:middle line:84%


2
00:01.027 --> 00:03.110 align:middle line:90%
One of the challenges I'd
like to address with you

3
00:03.110 --> 00:05.750 align:middle line:90%
in this video is that if
everybody in the world

4
00:05.750 --> 00:07.670 align:middle line:90%
can just point to
the DNS servers

5
00:07.670 --> 00:09.860 align:middle line:90%
in Umbrella Cloud for
free and use them and get

6
00:09.860 --> 00:11.570 align:middle line:90%
those basic security
services, how

7
00:11.570 --> 00:14.430 align:middle line:90%
do we differentiate our requests
if we're a paying customer,

8
00:14.430 --> 00:17.340 align:middle line:90%
and we have a license,
and we have policies?

9
00:17.340 --> 00:21.060 align:middle line:90%
How does the Umbrella Cloud
DNS servers know that it's us?

10
00:21.060 --> 00:22.760 align:middle line:90%
And the answer is
we are going to have

11
00:22.760 --> 00:26.030 align:middle line:90%
to identify in our
configuration for Umbrella Cloud

12
00:26.030 --> 00:28.970 align:middle line:90%
our source IP addresses,
and who it should expect.

13
00:28.970 --> 00:32.030 align:middle line:90%
And that way when the Umbrella
Cloud gets the DNS requests
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.970 --> 00:32.030 align:middle line:90%
And that way when the Umbrella
Cloud gets the DNS requests

14
00:32.030 --> 00:33.920 align:middle line:90%
from us, or from
your organization,

15
00:33.920 --> 00:35.390 align:middle line:90%
or from another
organization, they

16
00:35.390 --> 00:38.780 align:middle line:90%
know, oh, this is coming
from organization XYZ.

17
00:38.780 --> 00:41.240 align:middle line:90%
And as a result, I'm going
to apply the policies

18
00:41.240 --> 00:42.780 align:middle line:84%
for that organization.

19
00:42.780 --> 00:44.540 align:middle line:90%
So let me show you
how that's set up

20
00:44.540 --> 00:47.390 align:middle line:90%
through the use of
identities here in Umbrella.

21
00:47.390 --> 00:49.260 align:middle line:84%
So I have logged into Umbrella.

22
00:49.260 --> 00:51.860 align:middle line:90%
And if we go to Policies,
here's the policy

23
00:51.860 --> 00:53.660 align:middle line:90%
that we created in
the previous video.

24
00:53.660 --> 00:56.300 align:middle line:90%
There's our custom policy
with all the policy

25
00:56.300 --> 00:57.680 align:middle line:84%
components that are tucked in.

26
00:57.680 --> 01:01.310 align:middle line:90%
And if we want to specify who
this policy should apply to,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:57.680 --> 01:01.310 align:middle line:90%
And if we want to specify who
this policy should apply to,

27
01:01.310 --> 01:03.920 align:middle line:90%
that's related to the identities
of where those requests are

28
01:03.920 --> 01:06.170 align:middle line:90%
coming from, where those DNS
requests are coming from.

29
01:06.170 --> 01:08.690 align:middle line:90%
And to set that up, we're
going to go under Deployments.

30
01:08.690 --> 01:11.420 align:middle line:90%
And under Deployments we have a
section called Core Identities.

31
01:11.420 --> 01:14.190 align:middle line:90%
And there's several options
here, including Networks.

32
01:14.190 --> 01:16.340 align:middle line:90%
And here we can identify
the source IP address

33
01:16.340 --> 01:19.010 align:middle line:90%
or addresses that those
requests would be coming from.

34
01:19.010 --> 01:22.460 align:middle line:90%
If our entire organization is
hidden behind one IP address,

35
01:22.460 --> 01:24.410 align:middle line:90%
it would look
something like this.

36
01:24.410 --> 01:26.987 align:middle line:90%
That currently is my NATed
address out to the internet.

37
01:26.987 --> 01:28.820 align:middle line:90%
But if we wanted to add
additional networks,

38
01:28.820 --> 01:30.620 align:middle line:84%
we click on Add right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.820 --> 01:30.620 align:middle line:84%
we click on Add right here.

39
01:30.620 --> 01:32.810 align:middle line:90%
We could also specify
network devices.

40
01:32.810 --> 01:34.310 align:middle line:90%
An example of a
network device would

41
01:34.310 --> 01:35.852 align:middle line:90%
be something in our
environment where

42
01:35.852 --> 01:38.390 align:middle line:90%
like Bob sends his DNS
request to this device.

43
01:38.390 --> 01:40.160 align:middle line:90%
And then this
device forwards that

44
01:40.160 --> 01:41.720 align:middle line:90%
request up to the
Umbrella Cloud.

45
01:41.720 --> 01:43.370 align:middle line:90%
And that way if DNS
requests do come

46
01:43.370 --> 01:45.020 align:middle line:90%
from the devices
we've identified,

47
01:45.020 --> 01:47.222 align:middle line:90%
it can say, oh, this is
part of that organization.

48
01:47.222 --> 01:48.680 align:middle line:90%
Or if we have
roaming computers, we

49
01:48.680 --> 01:51.523 align:middle line:90%
can download the roaming client,
install it on a computer,

50
01:51.523 --> 01:53.690 align:middle line:90%
and then based on that
roaming client software being

51
01:53.690 --> 01:57.050 align:middle line:90%
installed, as it checks in,
the Umbrella Cloud servers

52
01:57.050 --> 01:59.510 align:middle line:90%
can also be aware that,
oh, that's Bob's machine.

53
01:59.510 --> 02:00.870 align:middle line:84%
He's part of our organization.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.510 --> 02:00.870 align:middle line:84%
He's part of our organization.

54
02:00.870 --> 02:03.530 align:middle line:90%
So to make a client a roaming
computer what we would do is we

55
02:03.530 --> 02:05.160 align:middle line:90%
could go right
here onto this page

56
02:05.160 --> 02:06.650 align:middle line:84%
where says Roaming Computers.

57
02:06.650 --> 02:09.389 align:middle line:90%
Click on Roaming
Client, so download.

58
02:09.389 --> 02:12.150 align:middle line:90%
We then download our appropriate
client, Windows or Mac.

59
02:12.150 --> 02:14.570 align:middle line:90%
And then once we download
it, we can install it.

60
02:14.570 --> 02:17.060 align:middle line:90%
And then that client
software would check in

61
02:17.060 --> 02:18.420 align:middle line:84%
with Umbrella Cloud.

62
02:18.420 --> 02:21.373 align:middle line:90%
And then when DNS requests
come from that client,

63
02:21.373 --> 02:22.790 align:middle line:90%
the Umbrella Cloud
knows is coming

64
02:22.790 --> 02:24.815 align:middle line:90%
from a device in
our organization.

65
02:24.815 --> 02:26.690 align:middle line:90%
So earlier I took the
liberty of installing--

66
02:26.690 --> 02:27.648 align:middle line:84%
this is Bob's computer.

67
02:27.648 --> 02:30.140 align:middle line:90%
I took the liberty of
installing the remote client
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:27.648 --> 02:30.140 align:middle line:90%
I took the liberty of
installing the remote client

68
02:30.140 --> 02:31.070 align:middle line:84%
on Bob's computer.

69
02:31.070 --> 02:32.270 align:middle line:84%
It checked in.

70
02:32.270 --> 02:34.430 align:middle line:90%
And so these are the
details currently regarding

71
02:34.430 --> 02:35.670 align:middle line:84%
Bob's computer.

72
02:35.670 --> 02:38.690 align:middle line:90%
There's also apps and services
to bring in mobile devices,

73
02:38.690 --> 02:40.370 align:middle line:90%
as well as Chromebook
users as well.

74
02:40.370 --> 02:43.610 align:middle line:90%
The goal is we want the Umbrella
Cloud to be able to correctly

75
02:43.610 --> 02:45.350 align:middle line:90%
identify us, whether
we're coming in

76
02:45.350 --> 02:48.870 align:middle line:90%
from a certain network, or based
on roaming using the client,

77
02:48.870 --> 02:51.290 align:middle line:90%
so it can properly
apply the policy to us.

78
02:51.290 --> 02:53.180 align:middle line:90%
And now that leads me
to the next problem

79
02:53.180 --> 02:55.910 align:middle line:90%
here is what policies
should be applied to whom.

80
02:55.910 --> 02:58.640 align:middle line:90%
And to decide that, we
would go down to Policies.

81
02:58.640 --> 03:00.650 align:middle line:84%
And let's click on All Policies.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:58.640 --> 03:00.650 align:middle line:84%
And let's click on All Policies.

82
03:00.650 --> 03:03.780 align:middle line:90%
And here's the custom policy
we made in a previous video.

83
03:03.780 --> 03:05.360 align:middle line:90%
So if we click on
our custom policy,

84
03:05.360 --> 03:08.810 align:middle line:90%
notice right here it says,
applied to 0 identities,

85
03:08.810 --> 03:11.240 align:middle line:90%
meaning this policy doesn't
apply to anybody yet.

86
03:11.240 --> 03:12.950 align:middle line:90%
And it won't apply
to anything until we

87
03:12.950 --> 03:15.830 align:middle line:90%
specify that it should apply
to one or more identities.

88
03:15.830 --> 03:17.690 align:middle line:90%
So if we click on
Our Custom Policy,

89
03:17.690 --> 03:20.270 align:middle line:90%
this will give us a nice
ability to see where we could

90
03:20.270 --> 03:21.920 align:middle line:84%
apply this specific policy.

91
03:21.920 --> 03:24.213 align:middle line:84%
So under identities affected, 0.

92
03:24.213 --> 03:25.130 align:middle line:84%
That's how we left it.

93
03:25.130 --> 03:26.930 align:middle line:90%
Previously, if we
click on Enable,

94
03:26.930 --> 03:28.782 align:middle line:90%
now it's going to
ask us, OK, great.

95
03:28.782 --> 03:30.740 align:middle line:90%
Do you want to apply this
to certain AD groups,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:28.782 --> 03:30.740 align:middle line:90%
Do you want to apply this
to certain AD groups,

96
03:30.740 --> 03:33.420 align:middle line:90%
or AD users, or AD
computers, or networks?

97
03:33.420 --> 03:35.210 align:middle line:90%
So if you click on
Networks, for example,

98
03:35.210 --> 03:37.310 align:middle line:90%
it then will give you a
list of all the networks.

99
03:37.310 --> 03:39.180 align:middle line:90%
So on my identity for
networks, I only have one.

100
03:39.180 --> 03:40.920 align:middle line:90%
And that's why we have
just one showing up here.

101
03:40.920 --> 03:43.410 align:middle line:90%
If we go back to All Identities,
under Roaming Computers,

102
03:43.410 --> 03:45.410 align:middle line:90%
I have exactly one, because
I installed a client

103
03:45.410 --> 03:46.350 align:middle line:84%
on Bob's computer.

104
03:46.350 --> 03:48.500 align:middle line:90%
So we click on
Roaming Computers.

105
03:48.500 --> 03:50.605 align:middle line:90%
It will give us a list
of all the computers

106
03:50.605 --> 03:52.730 align:middle line:90%
that have checked in,
because they have the client.

107
03:52.730 --> 03:54.397 align:middle line:90%
And then we could
select them from here.

108
03:54.397 --> 03:56.120 align:middle line:90%
Or we could go back
to All Identities,

109
03:56.120 --> 03:58.850 align:middle line:90%
and just check the box here
for all roaming computers.

110
03:58.850 --> 04:00.840 align:middle line:90%
And that adds it to
the list over here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:58.850 --> 04:00.840 align:middle line:90%
And that adds it to
the list over here.

111
04:00.840 --> 04:04.280 align:middle line:90%
So this is the moment of linking
an identity, like a roaming

112
04:04.280 --> 04:06.290 align:middle line:90%
computer, or a
subnet, or a network,

113
04:06.290 --> 04:08.240 align:middle line:84%
with an associated policy.

114
04:08.240 --> 04:10.580 align:middle line:90%
So now once we click
on Set and Return,

115
04:10.580 --> 04:13.130 align:middle line:90%
it's going to apply the
policy called Our Custom

116
04:13.130 --> 04:16.370 align:middle line:90%
Policy with all the devices
in the category of roaming

117
04:16.370 --> 04:17.060 align:middle line:84%
computers.

118
04:17.060 --> 04:18.990 align:middle line:90%
And so we'll click
on Set and Return.

119
04:18.990 --> 04:21.329 align:middle line:90%
So now under Identity
Affected, we have 1.

120
04:21.329 --> 04:22.790 align:middle line:84%
And we'll click on Save.

121
04:22.790 --> 04:24.415 align:middle line:84%
And that will apply that policy.

122
04:24.415 --> 04:25.790 align:middle line:90%
Now, another thing
to be aware of

123
04:25.790 --> 04:26.998 align:middle line:84%
is that we just applied that.

124
04:26.998 --> 04:29.040 align:middle line:90%
We'd also want to make
sure that our clients have

125
04:29.040 --> 04:29.880 align:middle line:84%
gotten that update.

126
04:29.880 --> 04:31.630 align:middle line:90%
So we just changed
that policy right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:29.880 --> 04:31.630 align:middle line:90%
So we just changed
that policy right here.

127
04:31.630 --> 04:34.040 align:middle line:90%
We can see how long ago we
had a synchronization of that

128
04:34.040 --> 04:34.860 align:middle line:84%
with the client.

129
04:34.860 --> 04:37.200 align:middle line:90%
So here it's showing us the
last sync with that client.

130
04:37.200 --> 04:41.015 align:middle line:90%
So if we expand that real quick
and scroll down, see right here

131
04:41.015 --> 04:43.880 align:middle line:90%
it says, last active policy
is the default policy.

132
04:43.880 --> 04:46.320 align:middle line:90%
So there will be a resync
here in a little bit of time.

133
04:46.320 --> 04:48.653 align:middle line:90%
And when it does, it should
show the current information

134
04:48.653 --> 04:51.210 align:middle line:90%
regarding the active policy
associated with that client.

135
04:51.210 --> 04:53.480 align:middle line:90%
So now we've associated
the roaming computers

136
04:53.480 --> 04:54.507 align:middle line:84%
with our custom policy.

137
04:54.507 --> 04:56.090 align:middle line:90%
So as soon as the
dust settles, it all

138
04:56.090 --> 04:58.430 align:middle line:90%
synchronizes, any
traffic that's being

139
04:58.430 --> 05:00.970 align:middle line:90%
sent by those clients
regarding DNS requests
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
04:58.430 --> 05:00.970 align:middle line:90%
sent by those clients
regarding DNS requests

140
05:00.970 --> 05:03.315 align:middle line:90%
and so forth, all of our
components of our policy

141
05:03.315 --> 05:04.690 align:middle line:90%
that we've
implemented should now

142
05:04.690 --> 05:06.598 align:middle line:90%
be enforced on that
roaming client.

143
05:06.598 --> 05:08.890 align:middle line:90%
So here on Bob's computer,
let me go ahead and bring up

144
05:08.890 --> 05:09.625 align:middle line:84%
a command prompt.

145
05:09.625 --> 05:11.500 align:middle line:90%
And let me go ahead and
do it with privileges

146
05:11.500 --> 05:12.850 align:middle line:84%
so we can flush the cache.

147
05:12.850 --> 05:16.730 align:middle line:90%
So we'll say, ipconfig
slash flushdns.

148
05:16.730 --> 05:17.980 align:middle line:84%
I could also use a dash there.

149
05:17.980 --> 05:18.880 align:middle line:84%
That would also work.

150
05:18.880 --> 05:21.520 align:middle line:84%
Let's do an ipconfig dash all.

151
05:21.520 --> 05:23.050 align:middle line:84%
And right here, check this out.

152
05:23.050 --> 05:24.812 align:middle line:84%
It says 127.0.0.1.

153
05:24.812 --> 05:26.770 align:middle line:90%
That's because I installed
the Umbrella client.

154
05:26.770 --> 05:28.360 align:middle line:90%
And the control for
those DNS requests

155
05:28.360 --> 05:30.740 align:middle line:90%
is being handled by
the Umbrella client.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:28.360 --> 05:30.740 align:middle line:90%
is being handled by
the Umbrella client.

156
05:30.740 --> 05:32.500 align:middle line:90%
So let's go ahead and
open up a browser.

157
05:32.500 --> 05:34.840 align:middle line:84%
And let's go out to google.com.

158
05:34.840 --> 05:36.832 align:middle line:90%
That's not being
restricted by our policy.

159
05:36.832 --> 05:38.320 align:middle line:84%
Ooh!

160
05:38.320 --> 05:41.080 align:middle line:90%
So right here it's saying,
the certificate authority

161
05:41.080 --> 05:42.080 align:middle line:84%
is invalid.

162
05:42.080 --> 05:44.978 align:middle line:90%
So if we click here and
click on the certificate,

163
05:44.978 --> 05:45.770 align:middle line:84%
yeah, look at that.

164
05:45.770 --> 05:47.103 align:middle line:84%
Here's the challenge right here.

165
05:47.103 --> 05:49.330 align:middle line:90%
This is going to happen
to everybody, by the way,

166
05:49.330 --> 05:52.990 align:middle line:90%
because what's happening is
Cisco Umbrella and the SSL

167
05:52.990 --> 05:56.530 align:middle line:90%
decryption, and also the SSL
pages that they're serving us,

168
05:56.530 --> 05:59.210 align:middle line:90%
they're signed by their
own certificate authority.

169
05:59.210 --> 06:02.013 align:middle line:90%
And if our browsers don't trust
that certificate authority,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
05:59.210 --> 06:02.013 align:middle line:90%
And if our browsers don't trust
that certificate authority,

170
06:02.013 --> 06:04.180 align:middle line:90%
we're not going to trust
the certificates, including

171
06:04.180 --> 06:06.680 align:middle line:90%
resigned certificates that are
coming back from the internet

172
06:06.680 --> 06:08.793 align:middle line:84%
if SSL decryption is enabled.

173
06:08.793 --> 06:10.960 align:middle line:90%
So because that's a real
problem and almost everyone

174
06:10.960 --> 06:12.580 align:middle line:90%
is going to see it when
they're implementing Umbrella

175
06:12.580 --> 06:14.920 align:middle line:90%
like this, let me walk you
through in the next video

176
06:14.920 --> 06:18.340 align:middle line:90%
exactly how we can install the
trusted certificate so that we

177
06:18.340 --> 06:19.510 align:middle line:84%
won't have that problem.

178
06:19.510 --> 06:21.710 align:middle line:90%
And then we can proceed
with the testing.

179
06:21.710 --> 06:24.400 align:middle line:90%
So I'll see you, my friend, in
the very next video, when we'll

180
06:24.400 --> 06:26.860 align:middle line:84%
solve the trusted CA problem.

181
06:26.860 --> 06:29.200 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

182
06:29.200 --> 06:32.460 align:middle line:90%
And I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

182
06:29.200 --> 06:32.460 align:middle line:90%
And I'd like to thank
you for viewing.