WEBVTT

1
00:00.000 --> 00:00.810 align:middle line:84%


2
00:00.810 --> 00:03.510 align:middle line:90%
In the previous video, we had
the remote client all set up.

3
00:03.510 --> 00:04.080 align:middle line:84%
It was great.

4
00:04.080 --> 00:05.250 align:middle line:90%
We were going to
test the Umbrella

5
00:05.250 --> 00:07.350 align:middle line:90%
services to make sure the
filtering and the policy

6
00:07.350 --> 00:08.980 align:middle line:84%
was being applied.

7
00:08.980 --> 00:11.580 align:middle line:90%
And then we got this
message, wah, wah, wah,

8
00:11.580 --> 00:13.083 align:middle line:90%
the certificate
isn't being trusted,

9
00:13.083 --> 00:15.250 align:middle line:90%
the sign of the certificate
that was coming through.

10
00:15.250 --> 00:17.910 align:middle line:90%
So what I'd like to do in this
video is walk you through--

11
00:17.910 --> 00:19.600 align:middle line:90%
I left the screen
right where it was.

12
00:19.600 --> 00:22.650 align:middle line:90%
And I'd like to walk you through
the solution to implementing

13
00:22.650 --> 00:25.260 align:middle line:90%
a trusted CA certificate
on the computer.

14
00:25.260 --> 00:26.730 align:middle line:90%
And that way whenever
our computers

15
00:26.730 --> 00:29.190 align:middle line:90%
receive a certificate that's
signed by the Umbrella CA

16
00:29.190 --> 00:31.170 align:middle line:84%
Services, they can trust it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.190 --> 00:31.170 align:middle line:84%
Services, they can trust it.

17
00:31.170 --> 00:32.759 align:middle line:84%
So here's where we left off.

18
00:32.759 --> 00:34.533 align:middle line:90%
And here's how we
would solve it.

19
00:34.533 --> 00:36.450 align:middle line:90%
First of all, we'd want
to get the certificate

20
00:36.450 --> 00:37.700 align:middle line:84%
that we currently don't trust.

21
00:37.700 --> 00:40.650 align:middle line:90%
If we click here on the triangle
and look at certificate,

22
00:40.650 --> 00:44.310 align:middle line:90%
here it's showing us this is
Cisco Umbrella Secondary SubCA

23
00:44.310 --> 00:45.513 align:middle line:84%
lax-SG.

24
00:45.513 --> 00:47.430 align:middle line:90%
And if we want to look
at the details of that,

25
00:47.430 --> 00:49.680 align:middle line:90%
we see all the details
about that certificate

26
00:49.680 --> 00:52.710 align:middle line:90%
that currently my browser,
this browser doesn't trust.

27
00:52.710 --> 00:55.870 align:middle line:90%
So to fix that, what we would
do is go get the certificate.

28
00:55.870 --> 00:59.050 align:middle line:90%
So in the Umbrella dashboard,
if we expand deployments,

29
00:59.050 --> 01:01.200 align:middle line:90%
and then we go down
under Configuration,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.050 --> 01:01.200 align:middle line:90%
and then we go down
under Configuration,

30
01:01.200 --> 01:03.990 align:middle line:90%
there's an option here
for Root Certificate.

31
01:03.990 --> 01:06.720 align:middle line:90%
If we click on that, we can
download that certificate.

32
01:06.720 --> 01:08.490 align:middle line:90%
And then we can deploy
that to our client.

33
01:08.490 --> 01:10.110 align:middle line:90%
So you can do it manually,
which I'll walk you

34
01:10.110 --> 01:12.150 align:middle line:90%
through here in just a
moment, or we could do it

35
01:12.150 --> 01:14.730 align:middle line:90%
through group policy, which
would be a more efficient way

36
01:14.730 --> 01:17.200 align:middle line:90%
to push that out to
thousands of devices.

37
01:17.200 --> 01:20.280 align:middle line:90%
So I'm going to go ahead and
download this certificate down

38
01:20.280 --> 01:23.560 align:middle line:90%
to Bob's computer, and then we
can go ahead and install it.

39
01:23.560 --> 01:25.830 align:middle line:90%
So back here on Bob's
computer-- let me go ahead

40
01:25.830 --> 01:28.140 align:middle line:90%
and verify I have that
certificate downloaded

41
01:28.140 --> 01:29.280 align:middle line:84%
in the Downloads folder.

42
01:29.280 --> 01:31.833 align:middle line:90%
There it is right there,
the Cisco_Umbrella_Root_CA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:29.280 --> 01:31.833 align:middle line:90%
There it is right there,
the Cisco_Umbrella_Root_CA.

43
01:31.833 --> 01:33.750 align:middle line:90%
So if we want to install
that as a trusted CA,

44
01:33.750 --> 01:35.260 align:middle line:90%
there's several
ways of doing it.

45
01:35.260 --> 01:38.370 align:middle line:84%
We could type in certificate.

46
01:38.370 --> 01:41.670 align:middle line:90%
And we can install that
per user, or per computer,

47
01:41.670 --> 01:44.370 align:middle line:90%
and another way of doing it is
just click on the certificate,

48
01:44.370 --> 01:46.360 align:middle line:84%
and saying, please, install it.

49
01:46.360 --> 01:47.350 align:middle line:84%
In fact, let's do that.

50
01:47.350 --> 01:49.350 align:middle line:90%
Let's go back to
our file system.

51
01:49.350 --> 01:51.338 align:middle line:90%
And we'll get the
Cisco_Umbrella_Root_CA.

52
01:51.338 --> 01:52.380 align:middle line:84%
We'll double-click on it.

53
01:52.380 --> 01:53.800 align:middle line:90%
And it says, hey, what
do you want to do?

54
01:53.800 --> 01:54.840 align:middle line:84%
I'm going to open it.

55
01:54.840 --> 01:57.250 align:middle line:90%
And then I'm going to
go ahead and install it.

56
01:57.250 --> 01:58.833 align:middle line:90%
So we'll click on
Install Certificate.

57
01:58.833 --> 02:00.167 align:middle line:84%
I'll do it for the current user.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:58.833 --> 02:00.167 align:middle line:84%
I'll do it for the current user.

58
02:00.167 --> 02:01.110 align:middle line:84%
We'll click on Next.

59
02:01.110 --> 02:04.350 align:middle line:90%
And then I am going to specify
where I want this to go.

60
02:04.350 --> 02:07.200 align:middle line:90%
And I want this to be in the
Trusted Root Certificate Store

61
02:07.200 --> 02:08.169 align:middle line:84%
right there.

62
02:08.169 --> 02:09.370 align:middle line:84%
So click on that.

63
02:09.370 --> 02:10.710 align:middle line:84%
Click on OK.

64
02:10.710 --> 02:12.360 align:middle line:90%
I guess I better
press Next there.

65
02:12.360 --> 02:14.035 align:middle line:84%
And now we'll click on Finish.

66
02:14.035 --> 02:15.660 align:middle line:90%
And now we'll get a
message, hopefully,

67
02:15.660 --> 02:16.890 align:middle line:84%
saying it's installed.

68
02:16.890 --> 02:19.710 align:middle line:84%
Survey says, yay, OK.

69
02:19.710 --> 02:21.660 align:middle line:90%
And it asks me do I
want to install this.

70
02:21.660 --> 02:23.820 align:middle line:84%
And I'm going to say yes.

71
02:23.820 --> 02:24.330 align:middle line:84%
Boom.

72
02:24.330 --> 02:24.920 align:middle line:84%
It's done.

73
02:24.920 --> 02:27.990 align:middle line:90%
So now that that's done,
let's close all those windows.

74
02:27.990 --> 02:29.680 align:middle line:84%
I'll close the browser.

75
02:29.680 --> 02:31.510 align:middle line:84%
I'll open the browser again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:29.680 --> 02:31.510 align:middle line:84%
I'll open the browser again.

76
02:31.510 --> 02:34.110 align:middle line:84%
And let's go to google.com.

77
02:34.110 --> 02:35.880 align:middle line:90%
So now we're going
to google.com.

78
02:35.880 --> 02:37.110 align:middle line:84%
And I didn't get a message.

79
02:37.110 --> 02:38.670 align:middle line:84%
Let's just go click on the lock.

80
02:38.670 --> 02:41.940 align:middle line:90%
And click on the certificate,
which it says is valid.

81
02:41.940 --> 02:43.830 align:middle line:84%
And here it's-- great.

82
02:43.830 --> 02:46.410 align:middle line:90%
It's a certificate
issued to google.com.

83
02:46.410 --> 02:50.180 align:middle line:90%
And it shows that it's issued by
or signed by the Cisco Umbrella

84
02:50.180 --> 02:52.740 align:middle line:90%
Secondary Sub-- blah,
blah, blah, the CA server

85
02:52.740 --> 02:55.723 align:middle line:90%
that we now trust, because we
just added it to this computer.

86
02:55.723 --> 02:56.890 align:middle line:84%
So that's an important step.

87
02:56.890 --> 02:59.790 align:middle line:90%
Now let's go ahead and
continue to test our policy.

88
02:59.790 --> 03:02.520 align:middle line:90%
One of the things that we
said we didn't want to do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
02:59.790 --> 03:02.520 align:middle line:90%
One of the things that we
said we didn't want to do

89
03:02.520 --> 03:06.298 align:middle line:90%
was have a user be able to go
to alcohol-related websites.

90
03:06.298 --> 03:07.590 align:middle line:84%
That was one of the categories.

91
03:07.590 --> 03:09.090 align:middle line:90%
In fact, I think that
was the only category.

92
03:09.090 --> 03:10.540 align:middle line:84%
Let's take a peek real quick.

93
03:10.540 --> 03:13.410 align:middle line:90%
So if we go back to
Policies, expand that,

94
03:13.410 --> 03:17.040 align:middle line:90%
and go to All Policies, and
click on our custom policy

95
03:17.040 --> 03:18.810 align:middle line:84%
that we made right here.

96
03:18.810 --> 03:21.210 align:middle line:90%
And we look at Content
Settings Applied,

97
03:21.210 --> 03:22.460 align:middle line:84%
alcohol will be blocked.

98
03:22.460 --> 03:23.460 align:middle line:84%
All right, that's great.

99
03:23.460 --> 03:25.320 align:middle line:90%
I just wanted to confirm
we had that in our policy.

100
03:25.320 --> 03:28.050 align:middle line:90%
And this policy is applied to
roaming computers, specifically

101
03:28.050 --> 03:29.700 align:middle line:84%
Bob's roaming computer.

102
03:29.700 --> 03:31.620 align:middle line:90%
And he's the only one
we currently have.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:29.700 --> 03:31.620 align:middle line:90%
And he's the only one
we currently have.

103
03:31.620 --> 03:33.360 align:middle line:84%
So if we search for alcohol--

104
03:33.360 --> 03:35.650 align:middle line:84%
so the Google search is working.

105
03:35.650 --> 03:39.570 align:middle line:90%
But if we actually tried
to go to a alcohol website,

106
03:39.570 --> 03:40.980 align:middle line:84%
let's just go to one--

107
03:40.980 --> 03:42.510 align:middle line:90%
let's go to this
right here, www--

108
03:42.510 --> 03:43.680 align:middle line:84%
I've tested this before--

109
03:43.680 --> 03:45.180 align:middle line:84%
liquor.com.

110
03:45.180 --> 03:45.810 align:middle line:84%
So boom!

111
03:45.810 --> 03:46.620 align:middle line:84%
It's being blocked.

112
03:46.620 --> 03:49.470 align:middle line:90%
And this message, which
is HTTPS is coming back

113
03:49.470 --> 03:51.060 align:middle line:84%
from opendns.com.

114
03:51.060 --> 03:52.265 align:middle line:84%
This is our Block page.

115
03:52.265 --> 03:53.640 align:middle line:90%
And if we tried
that again, let's

116
03:53.640 --> 03:56.580 align:middle line:90%
go back and let's just
grab another site.

117
03:56.580 --> 03:58.770 align:middle line:90%
And I'll go to the
second page here.

118
03:58.770 --> 04:00.570 align:middle line:84%
Let's go to missionliquor.com.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
03:58.770 --> 04:00.570 align:middle line:84%
Let's go to missionliquor.com.

119
04:00.570 --> 04:01.120 align:middle line:84%
And boom!

120
04:01.120 --> 04:02.728 align:middle line:84%
That's great, fantastic.

121
04:02.728 --> 04:04.020 align:middle line:84%
And it's blocking as it should.

122
04:04.020 --> 04:06.395 align:middle line:90%
And if we try to go somewhere
else, let's go to ebay.com.

123
04:06.395 --> 04:09.030 align:middle line:84%


124
04:09.030 --> 04:10.680 align:middle line:84%
And we're not blocking that.

125
04:10.680 --> 04:14.880 align:middle line:90%
We're not blocking social
media, so Facebook should work.

126
04:14.880 --> 04:15.912 align:middle line:84%
Fantastic.

127
04:15.912 --> 04:18.120 align:middle line:90%
And the other one-- oh,
yeah, there was one other one

128
04:18.120 --> 04:18.870 align:middle line:84%
that we did block.

129
04:18.870 --> 04:21.120 align:middle line:84%
We did block one URL.

130
04:21.120 --> 04:25.002 align:middle line:84%
And that was www.acme.com.

131
04:25.002 --> 04:26.710 align:middle line:90%
Sure enough, that was
part of our policy.

132
04:26.710 --> 04:29.040 align:middle line:90%
And to confirm that, if
we go back to our policy,

133
04:29.040 --> 04:30.660 align:middle line:90%
and we go to our
destination list,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:29.040 --> 04:30.660 align:middle line:90%
and we go to our
destination list,

134
04:30.660 --> 04:32.130 align:middle line:84%
that's where we specified that.

135
04:32.130 --> 04:33.150 align:middle line:84%
We'll click on Edit.

136
04:33.150 --> 04:35.070 align:middle line:90%
There's our custom
destination list.

137
04:35.070 --> 04:36.570 align:middle line:90%
And that custom
destination list,

138
04:36.570 --> 04:38.283 align:middle line:90%
if we go over here
to destination lists,

139
04:38.283 --> 04:39.700 align:middle line:90%
we can take a look
at the details.

140
04:39.700 --> 04:41.820 align:middle line:90%
So here are the details
of our custom destination

141
04:41.820 --> 04:45.480 align:middle line:90%
list, which is filtering
on www.acme.com.

142
04:45.480 --> 04:47.130 align:middle line:84%
So our policy is working.

143
04:47.130 --> 04:49.140 align:middle line:90%
And as a final test, if
we went somewhere else,

144
04:49.140 --> 04:51.940 align:middle line:84%
like CBTNuggets.com--

145
04:51.940 --> 04:53.270 align:middle line:84%
and this site works.

146
04:53.270 --> 04:56.260 align:middle line:90%
So there's a lot of benefits of
using Umbrella with a license

147
04:56.260 --> 04:58.420 align:middle line:90%
and a policy, because
we're now enforcing

148
04:58.420 --> 05:00.490 align:middle line:90%
that policy on our
devices, or subnets,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
04:58.420 --> 05:00.490 align:middle line:90%
that policy on our
devices, or subnets,

149
05:00.490 --> 05:04.240 align:middle line:90%
or networks where we specify
that policy should be enforced.

150
05:04.240 --> 05:06.100 align:middle line:90%
Now, another great
feature in addition

151
05:06.100 --> 05:09.220 align:middle line:90%
to enforcing our policy is
the ability after the fact

152
05:09.220 --> 05:12.280 align:middle line:90%
to see what the heck happened
with reporting, and some really

153
05:12.280 --> 05:14.560 align:middle line:90%
cool tools for
investigation as well that

154
05:14.560 --> 05:16.080 align:middle line:84%
are built into Umbrella.

155
05:16.080 --> 05:18.080 align:middle line:90%
And this we'll take a
look at in the next video.

156
05:18.080 --> 05:19.720 align:middle line:90%
So I'll see you there
in just a minute.

157
05:19.720 --> 05:22.180 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

158
05:22.180 --> 05:25.590 align:middle line:90%
And I'd like to thank
you for viewing.