WEBVTT

1
00:00.000 --> 00:08.760
So next up, let's take a look at two other very important aspects of umbrella,

2
00:08.760 --> 00:09.320
managing

3
00:09.320 --> 00:13.040
our identities and our network tunnels.

4
00:13.040 --> 00:16.520
So for this, we want to take a look at the different types of entities.

5
00:16.520 --> 00:20.520
We can also download the client through here, and then we'll take a look at how

6
00:20.520 --> 00:21.320
to configure

7
00:21.320 --> 00:26.000
and set up tunnels and the different various device types that are supported

8
00:26.000 --> 00:26.640
for those

9
00:26.640 --> 00:27.640
tunnels.

10
00:27.640 --> 00:33.300
So let's go ahead and jump in and take a look, we'll start with managing the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.640 --> 00:33.300
So let's go ahead and jump in and take a look, we'll start with managing the

11
00:33.300 --> 00:34.600
identities.

12
00:34.600 --> 00:39.080
So the identities and the network tunnels are in the same place.

13
00:39.080 --> 00:43.240
Here from the overview page, let's go over here to deployments.

14
00:43.240 --> 00:47.360
Let's begin by taking a look at the first one here, networks.

15
00:47.360 --> 00:53.820
So if we click on this, this is going to show us the external addresses that

16
00:53.820 --> 00:54.840
our umbrella

17
00:54.840 --> 00:59.200
deployment is going to accept DNS requests from.

18
00:59.200 --> 01:04.640
So here you would want to put the outside address of any of your locations that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.200 --> 01:04.640
So here you would want to put the outside address of any of your locations that

19
01:04.640 --> 01:04.760
are

20
01:04.760 --> 01:09.400
going to be pointing their DNS servers towards umbrella.

21
01:09.400 --> 01:13.340
The way we add something here is we simply click on add in the top corner, we

22
01:13.340 --> 01:13.720
give it

23
01:13.720 --> 01:20.360
a name, we could call it something like outside, give it an address, something

24
01:20.360 --> 01:21.580
like that.

25
01:21.580 --> 01:25.810
You can choose the mask, again, for most environments, this is probably going

26
01:25.810 --> 01:27.260
to be a single address,

27
01:27.260 --> 01:29.240
a host entry.

28
01:29.240 --> 01:32.740
You can also choose if it's going to be a dynamic address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:29.240 --> 01:32.740
You can also choose if it's going to be a dynamic address.

29
01:32.740 --> 01:35.840
But again, keep in mind, it could also be a range.

30
01:35.840 --> 01:39.460
Now again, we are in our read only environment at this point.

31
01:39.460 --> 01:44.220
So we can't actually click save, we can click it, it just won't do anything.

32
01:44.220 --> 01:46.460
So we're going to hit cancel.

33
01:46.460 --> 01:50.270
But this is how you would add the outside addresses for your network that are

34
01:50.270 --> 01:50.660
allowed

35
01:50.660 --> 01:54.540
to send DNS requests to umbrella.

36
01:54.540 --> 01:58.300
Next on our list is network devices.

37
01:58.300 --> 02:02.530
This is sort of similar to what we saw just a minute ago, except these are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:58.300 --> 02:02.530
This is sort of similar to what we saw just a minute ago, except these are

38
02:02.530 --> 02:03.700
actually network

39
02:03.700 --> 02:09.740
devices, either hardware or virtual, that are going to forward DNS requests

40
02:09.740 --> 02:10.340
from client

41
02:10.340 --> 02:13.020
computers to Cisco umbrella.

42
02:13.020 --> 02:18.240
So we can either again just use our outside address or we can send it from a

43
02:18.240 --> 02:20.580
network device.

44
02:20.580 --> 02:23.580
Next we can configure roaming computers.

45
02:23.580 --> 02:27.580
Here under roaming computers, we're going to see devices that are connected

46
02:27.580 --> 02:29.220
into our environment

47
02:29.220 --> 02:34.900
using either the umbrella roaming client or the Cisco secure client umbrella
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.220 --> 02:34.900
using either the umbrella roaming client or the Cisco secure client umbrella

48
02:34.900 --> 02:35.900
module.

49
02:35.900 --> 02:38.700
This was formerly any connect.

50
02:38.700 --> 02:43.210
If you don't have the client, you can actually click on the roaming client up

51
02:43.210 --> 02:43.940
here and it

52
02:43.940 --> 02:48.750
gives you the opportunity here to download the client for your various

53
02:48.750 --> 02:50.100
operating systems

54
02:50.100 --> 02:54.870
and we can then download the umbrella roaming security module so that we can

55
02:54.870 --> 02:55.900
use the roaming

56
02:55.900 --> 02:59.100
client to connect into umbrella.

57
02:59.100 --> 03:03.940
So we can close this next here, we can see mobile devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:59.100 --> 03:03.940
So we can close this next here, we can see mobile devices.

58
03:03.940 --> 03:09.020
In this case, we see that there's various iOS devices connected in and up at

59
03:09.020 --> 03:09.620
the top

60
03:09.620 --> 03:14.080
right, we can manage this if we were not in a read only environment, but this

61
03:14.080 --> 03:14.580
is where

62
03:14.580 --> 03:17.420
you manage your mobile devices.

63
03:17.420 --> 03:19.860
Next is Chromebook users.

64
03:19.860 --> 03:23.730
Again they have some demo devices connected in here, but this is where you

65
03:23.730 --> 03:24.620
would actually

66
03:24.620 --> 03:29.980
add Chromebook users and again, we can configure it in the top right.

67
03:29.980 --> 03:33.060
This is also where we're going to configure our network tunnels.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:29.980 --> 03:33.060
This is also where we're going to configure our network tunnels.

68
03:33.060 --> 03:36.360
So if we click on our network tunnels, we can see here that in their

69
03:36.360 --> 03:37.940
demonstration environment,

70
03:37.940 --> 03:43.480
they currently have three active tunnels and some of the cool things we can do

71
03:43.480 --> 03:43.820
here.

72
03:43.820 --> 03:48.140
First on the detail over here, we can click on this drop down and we can

73
03:48.140 --> 03:49.060
actually get

74
03:49.060 --> 03:53.780
a lot of detailed information about this particular tunnel.

75
03:53.780 --> 03:57.170
If we scroll down a little bit, we can see things such as what type of

76
03:57.170 --> 03:58.460
encryption algorithm

77
03:58.460 --> 04:03.700
it's using, how much traffic's gone through this tunnel and so on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:58.460 --> 04:03.700
it's using, how much traffic's gone through this tunnel and so on.

78
04:03.700 --> 04:08.820
So right next to this detail drop down is a little action menu.

79
04:08.820 --> 04:13.450
If we click on this, we can again look at the details, but this is also where

80
04:13.450 --> 04:14.060
we could

81
04:14.060 --> 04:16.260
go to delete this.

82
04:16.260 --> 04:19.940
Another option on this page of course is to add a tunnel.

83
04:19.940 --> 04:23.970
If we click add, we have to of course give it a name of some sort and then we

84
04:23.970 --> 04:24.540
have to

85
04:24.540 --> 04:27.580
choose from our supported devices.

86
04:27.580 --> 04:32.540
If we click on the drop down, we can see that it supports things such as the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:27.580 --> 04:32.540
If we click on the drop down, we can see that it supports things such as the

87
04:32.540 --> 04:33.420
ASA, the integrated

88
04:33.420 --> 04:39.340
services router, if we scroll down, we can see that it also supports our C edge

89
04:39.340 --> 04:39.740
and our

90
04:39.740 --> 04:43.220
V edge devices from SD WAN.

91
04:43.220 --> 04:47.620
So this is where we would go to actually configure one of these tunnels.

92
04:47.620 --> 04:52.140
Of course, we can't actually do that since we're in a read only environment.

93
04:52.140 --> 04:55.420
The last thing we want to look at here is users and groups.

94
04:55.420 --> 05:00.300
And what we see here is that we can have our users and groups for identity in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:55.420 --> 05:00.300
And what we see here is that we can have our users and groups for identity in

95
05:00.300 --> 05:00.980
umbrella

96
05:00.980 --> 05:06.690
tied to things like active directory or Azure active directory, things like G

97
05:06.690 --> 05:07.460
suite.

98
05:07.460 --> 05:12.680
There's several choices here of what we want to use for our user authentication

99
05:12.680 --> 05:13.220
to identify

100
05:13.220 --> 05:15.860
themselves to umbrella.

101
05:15.860 --> 05:19.320
One other thing that might be important here on this discussion, let's skip

102
05:19.320 --> 05:19.820
down here a

103
05:19.820 --> 05:23.220
little bit to internal networks.

104
05:23.220 --> 05:27.290
If we come down here, the reason this is important is actually sort of shown in

105
05:27.290 --> 05:28.300
the banner up

106
05:28.300 --> 05:30.060
here at the top.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:28.300 --> 05:30.060
here at the top.

107
05:30.060 --> 05:36.800
The umbrella firewall is actually expecting traffic to be coming from RFC 1918

108
05:36.800 --> 05:37.980
addresses.

109
05:37.980 --> 05:44.300
However, we do still need to identify those internal networks to umbrella.

110
05:44.300 --> 05:48.450
The reason this is important, of course, is because we may have sort of

111
05:48.450 --> 05:49.620
different departments

112
05:49.620 --> 05:54.360
or subnets as are picturing here below where we might want to treat that

113
05:54.360 --> 05:56.180
traffic differently.

114
05:56.180 --> 06:01.220
We some subnets or departments are allowed to go certain places and other ones
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
05:56.180 --> 06:01.220
We some subnets or departments are allowed to go certain places and other ones

115
06:01.220 --> 06:01.900
aren't.

116
06:01.900 --> 06:06.120
So we need to be able to identify our internal networks so that they can be

117
06:06.120 --> 06:07.420
treated differently

118
06:07.420 --> 06:09.940
in the policies in umbrella.

119
06:09.940 --> 06:12.700
And that's what this section is for.

120
06:12.700 --> 06:18.180
So in this video, we saw where we would go to manage all the different identity

121
06:18.180 --> 06:18.660
types

122
06:18.660 --> 06:20.220
in umbrella.

123
06:20.220 --> 06:24.560
We also saw where you go to configure those tunnels to bring your outside

124
06:24.560 --> 06:25.460
traffic from

125
06:25.460 --> 06:28.740
in your offsite network into umbrella.

126
06:28.740 --> 06:32.570
But remember that that's going to be considered coming in on the inside of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
06:28.740 --> 06:32.570
But remember that that's going to be considered coming in on the inside of

127
06:32.570 --> 06:33.740
umbrella, not the

128
06:33.740 --> 06:35.220
internet side.

129
06:35.220 --> 06:39.290
Now all of this said, it's probably time to jump in and start looking at some

130
06:39.290 --> 06:39.660
of the

131
06:39.660 --> 06:45.220
policies that we have in umbrella because that is really its main function.

132
06:45.220 --> 06:50.150
So let's go ahead and start by taking a look at the DNS policies in the next

133
06:50.150 --> 06:50.580
video.

134
06:50.580 --> 07:00.300
[BLANK_AUDIO]