WEBVTT

1
00:00.000 --> 00:08.000
So, umbrella identities and networks that we're going to use to categorize our

2
00:08.000 --> 00:09.000
traffic

3
00:09.000 --> 00:14.100
don't really do a whole lot of good unless we actually have policies that tell

4
00:14.100 --> 00:14.480
us what

5
00:14.480 --> 00:18.320
to do with that traffic once it's been identified.

6
00:18.320 --> 00:23.870
So let's start by looking at our first policy, the DNS policy, which is related

7
00:23.870 --> 00:24.840
to our DNS

8
00:24.840 --> 00:26.240
layer security.

9
00:26.240 --> 00:29.600
Let's jump in and take a look.

10
00:29.600 --> 00:33.850
So once again, starting from the umbrella overview screen to get to our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.600 --> 00:33.850
So once again, starting from the umbrella overview screen to get to our

11
00:33.850 --> 00:34.960
policies, they

12
00:34.960 --> 00:37.960
of course have their own whole section over here.

13
00:37.960 --> 00:43.200
If we expand policies, we'll see our four main policies here.

14
00:43.200 --> 00:47.720
Let's of course start as we mentioned with our DNS policies.

15
00:47.720 --> 00:49.840
So let's go ahead and click on this.

16
00:49.840 --> 00:54.720
And this will bring up the current policies in this particular environment.

17
00:54.720 --> 00:57.600
So we're going to pick on one of the more interesting ones.

18
00:57.600 --> 01:00.840
Let's scroll down, we're going to actually look at rule 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:57.600 --> 01:00.840
Let's scroll down, we're going to actually look at rule 10.

19
01:00.840 --> 01:06.160
And if we come down here to rule 10, first we can click on this arrow to expand

20
01:06.160 --> 01:06.560
it.

21
01:06.560 --> 01:10.600
Notice we get a warning right away telling us that we are a read-only user and

22
01:10.600 --> 01:11.240
therefore

23
01:11.240 --> 01:14.000
we will not be able to save this policy.

24
01:14.000 --> 01:17.980
Now that's understood, but what we're really here to do is just look over the

25
01:17.980 --> 01:18.680
policy and

26
01:18.680 --> 01:23.080
see what we could edit even though it's not going to actually let us.

27
01:23.080 --> 01:26.520
So notice the first thing is the identities.

28
01:26.520 --> 01:29.600
And it says that there are 15 identities affected.

29
01:29.600 --> 01:32.480
Let's go ahead and click on edit identity.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:29.600 --> 01:32.480
Let's go ahead and click on edit identity.

30
01:32.480 --> 01:38.020
And notice here we can see on the left side the identities that are available

31
01:38.020 --> 01:38.360
and on the

32
01:38.360 --> 01:41.760
right side we can see the ones that are selected.

33
01:41.760 --> 01:46.620
And we have options such as removing all of the ones from the right or on the

34
01:46.620 --> 01:47.240
left, we

35
01:47.240 --> 01:52.360
could actually select other things here and add them to the right side.

36
01:52.360 --> 01:56.630
Now once again, we can't save this, but you can see that we could come in here

37
01:56.630 --> 01:57.520
and add

38
01:57.520 --> 01:59.480
these different identities.

39
01:59.480 --> 02:03.680
And if we scroll down, we can see all the different ones that are available.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:59.480 --> 02:03.680
And if we scroll down, we can see all the different ones that are available.

40
02:03.680 --> 02:06.960
Now you don't have to add a whole category.

41
02:06.960 --> 02:10.160
So for example, take network devices here.

42
02:10.160 --> 02:13.160
You can see that there's 12 network devices.

43
02:13.160 --> 02:17.420
If we click on this little arrow here, it'll actually take us down into those

44
02:17.420 --> 02:19.440
network devices.

45
02:19.440 --> 02:23.520
And we could choose particularly which ones we want.

46
02:23.520 --> 02:29.530
So maybe we only want these branch routers from VPN 10 and maybe this branch

47
02:29.530 --> 02:30.520
three, see
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:29.530 --> 02:30.520
three, see

48
02:30.520 --> 02:33.800
add router from VPN 10.

49
02:33.800 --> 02:36.280
So you don't have to add a whole category.

50
02:36.280 --> 02:40.560
You can add different identities from within that category.

51
02:40.560 --> 02:44.410
So again, this is how we choose which identities are going to be affected by

52
02:44.410 --> 02:45.360
this particular

53
02:45.360 --> 02:46.360
rule.

54
02:46.360 --> 02:50.200
Now again, we can't change this, so let's go ahead and cancel.

55
02:50.200 --> 02:53.520
But you can see that each one of these has its own settings.

56
02:53.520 --> 02:58.340
If we hit edit here, we can choose which categories to block, such as malware,

57
02:58.340 --> 02:58.800
newly

58
02:58.800 --> 03:03.000
seen domains, command and control callbacks and so on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:58.800 --> 03:03.000
seen domains, command and control callbacks and so on.

59
03:03.000 --> 03:08.440
We could of course edit this list and we can turn any of these on and off.

60
03:08.440 --> 03:13.110
If we scroll down, we can see there's also integrations here at the bottom to

61
03:13.110 --> 03:13.600
integrate

62
03:13.600 --> 03:19.160
with things like checkpoint, fire eye, zero Fox and other things like that.

63
03:19.160 --> 03:22.560
So any of these can be turned on and off individually.

64
03:22.560 --> 03:23.920
Once again, we can't save this.

65
03:23.920 --> 03:27.800
So let's just hit cancel and hit cancel again.

66
03:27.800 --> 03:32.310
We can also see we can change things such as bandwidth hogs and we can set
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:27.800 --> 03:32.310
We can also see we can change things such as bandwidth hogs and we can set

67
03:32.310 --> 03:33.040
whether it's

68
03:33.040 --> 03:39.170
a custom or high, moderate, low over here on the side, we can expand these and

69
03:39.170 --> 03:40.000
see different

70
03:40.000 --> 03:44.360
content categories or we can select all.

71
03:44.360 --> 03:46.080
Let's cancel this.

72
03:46.080 --> 03:48.960
And again, we don't have to go through every single one of these.

73
03:48.960 --> 03:54.080
I just want you to get the idea that we can come in here and very simply modify

74
03:54.080 --> 03:54.560
any of

75
03:54.560 --> 03:56.000
these lists.

76
03:56.000 --> 03:58.560
There's also advanced settings down here at the bottom.

77
03:58.560 --> 04:03.200
You may have to expand these, but we can do things like enabling the proxy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:58.560 --> 04:03.200
You may have to expand these, but we can do things like enabling the proxy

78
04:03.200 --> 04:05.080
turning on SSL

79
04:05.080 --> 04:06.160
decryption.

80
04:06.160 --> 04:09.920
So as you can see, there's a lot of different things that we can set here.

81
04:09.920 --> 04:13.000
Once again, since we're read only will hit cancel.

82
04:13.000 --> 04:17.770
But the other thing we can do is if we scroll back up to the top, notice there

83
04:17.770 --> 04:18.440
's also a

84
04:18.440 --> 04:21.080
choice up here to add.

85
04:21.080 --> 04:24.680
If we add, it's again going to tell us that we're a read only user.

86
04:24.680 --> 04:28.080
However, it will let us go through the process.

87
04:28.080 --> 04:32.170
So here for the protection, we can choose whether we want to do access control,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
04:28.080 --> 04:32.170
So here for the protection, we can choose whether we want to do access control,

88
04:32.170 --> 04:32.560
which

89
04:32.560 --> 04:37.600
is going to include content category blocking, applying destination lists,

90
04:37.600 --> 04:39.400
application control,

91
04:39.400 --> 04:43.930
or we can just generally block threats, such as certain security categories and

92
04:43.930 --> 04:44.560
doing file

93
04:44.560 --> 04:48.960
analysis, or of course, any combination of these.

94
04:48.960 --> 04:52.400
We can see the default is to turn them all on.

95
04:52.400 --> 04:57.390
Now in case it's not clear, what we're basically in here is a wizard to create

96
04:57.390 --> 04:59.000
these new rules.

97
04:59.000 --> 05:01.000
What we can do is hit next.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:59.000 --> 05:01.000
What we can do is hit next.

98
05:01.000 --> 05:05.500
Here we're going to choose the identities that we're going to add to this new

99
05:05.500 --> 05:06.160
rule.

100
05:06.160 --> 05:09.400
So just like we did before, you could select a few things over here.

101
05:09.400 --> 05:12.960
You can see this is very much like the edit list.

102
05:12.960 --> 05:15.320
And then we'll go ahead and hit next.

103
05:15.320 --> 05:18.880
Next it asks what we want for our security settings.

104
05:18.880 --> 05:23.160
So if we click on the drop down here, there are certain pre-builts.

105
05:23.160 --> 05:26.680
So we could turn on all and you can see that it'll select everything down here

106
05:26.680 --> 05:28.200
at the bottom,

107
05:28.200 --> 05:31.360
or we could say default security protection.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
05:28.200 --> 05:31.360
or we could say default security protection.

108
05:31.360 --> 05:34.920
And you can see that it enables some things and not others.

109
05:34.920 --> 05:39.680
And of course, we could hit edit and customize this all we want.

110
05:39.680 --> 05:45.000
Notice it now grays out that drop down because now we're doing a custom.

111
05:45.000 --> 05:49.360
So I could say just add this one and this one, for example.

112
05:49.360 --> 05:53.470
So again, we can use either a pre-built setting, which automatically selects

113
05:53.470 --> 05:54.360
certain things

114
05:54.360 --> 05:57.920
on the list, or we can do it ourselves.

115
05:57.920 --> 05:59.560
Once again, we can scroll down.

116
05:59.560 --> 06:01.080
You can see there's a lot of choices here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:59.560 --> 06:01.080
You can see there's a lot of choices here.

117
06:01.080 --> 06:03.360
We can turn on or off.

118
06:03.360 --> 06:08.010
And again, this is where we would hit save, but we can't because we're read

119
06:08.010 --> 06:08.280
only.

120
06:08.280 --> 06:12.160
But this is how we would create a new policy.

121
06:12.160 --> 06:16.370
If we hit next with one of the pre-builts, it will let us continue because we

122
06:16.370 --> 06:17.000
haven't

123
06:17.000 --> 06:19.360
modified anything yet.

124
06:19.360 --> 06:22.000
We just couldn't create a custom list.

125
06:22.000 --> 06:25.480
Here we can choose how to limit content access.

126
06:25.480 --> 06:27.680
We can see the different categories.

127
06:27.680 --> 06:32.190
And over on the right, it shows us what types of things each of these things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
06:27.680 --> 06:32.190
And over on the right, it shows us what types of things each of these things

128
06:32.190 --> 06:32.960
blocks.

129
06:32.960 --> 06:35.000
So again, these are pre-built.

130
06:35.000 --> 06:37.880
You have high, moderate, and low.

131
06:37.880 --> 06:42.560
And then of course, there's custom where we could just choose whatever we want.

132
06:42.560 --> 06:45.810
Again, it would not let us continue like this because that would be making a

133
06:45.810 --> 06:46.680
custom list.

134
06:46.680 --> 06:50.680
So let's go ahead and put it back on high and we'll hit next.

135
06:50.680 --> 06:55.800
This is where it would let us set up control for certain types of applications.

136
06:55.800 --> 07:00.740
Once again, we have pre-built selections where we can click on this drop down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:55.800 --> 07:00.740
Once again, we have pre-built selections where we can click on this drop down

137
07:00.740 --> 07:01.280
and choose

138
07:01.280 --> 07:06.580
one of these choices or we could do custom and just choose the checkboxes here

139
07:06.580 --> 07:07.680
below.

140
07:07.680 --> 07:10.640
We'll leave this at the default and hit next.

141
07:10.640 --> 07:14.240
Next it's going to ask us what destinations to apply this to.

142
07:14.240 --> 07:18.450
So we would just click on the destinations on the left and add them to the

143
07:18.450 --> 07:19.120
right.

144
07:19.120 --> 07:23.070
Then it's going to ask us if we want to do file inspection for malicious files

145
07:23.070 --> 07:23.520
being

146
07:23.520 --> 07:24.680
downloaded.

147
07:24.680 --> 07:27.520
So we could either turn this on or off.

148
07:27.520 --> 07:34.200
Then it's going to ask us if we want to set a custom page for blocked content.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
07:27.520 --> 07:34.200
Then it's going to ask us if we want to set a custom page for blocked content.

149
07:34.200 --> 07:35.920
So this is getting a little advanced.

150
07:35.920 --> 07:39.780
We're not going to get into all this, but it lets you put up a custom message

151
07:39.780 --> 07:40.400
if somebody

152
07:40.400 --> 07:44.320
attempts to go to a page that they're not allowed to go to.

153
07:44.320 --> 07:48.660
If we hit next, it'll give us a summary of everything we've just chosen to do

154
07:48.660 --> 07:49.080
as well

155
07:49.080 --> 07:53.440
as giving it a name so we could say my policy.

156
07:53.440 --> 07:56.640
It doesn't matter what we name it at this point because again, we're going to

157
07:56.640 --> 07:57.040
have to

158
07:57.040 --> 08:01.720
hit cancel here, but it's going to show us everything that we chose so far.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:57.040 --> 08:01.720
hit cancel here, but it's going to show us everything that we chose so far.

159
08:01.720 --> 08:06.840
We can look over this, make sure it's okay, and then hit save.

160
08:06.840 --> 08:08.840
But of course, we can't.

161
08:08.840 --> 08:13.960
So in our case, we're going to hit cancel, but this is how we make a new DNS

162
08:13.960 --> 08:14.800
policy.

163
08:14.800 --> 08:16.840
We'll go ahead and cancel it.

164
08:16.840 --> 08:23.480
It'll take us back to our default list of DNS policies where we started.

165
08:23.480 --> 08:29.460
So in this video, we took a look at how to configure the DNS policies in Cisco

166
08:29.460 --> 08:30.640
umbrella.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
08:29.460 --> 08:30.640
umbrella.

167
08:30.640 --> 08:33.720
And hopefully your takeaway here is two things.

168
08:33.720 --> 08:36.760
One, this is actually very easy to do.

169
08:36.760 --> 08:39.760
We just click through things and make the choices we want.

170
08:39.760 --> 08:45.120
However, there's a lot of choices because this is a very powerful tool.

171
08:45.120 --> 08:49.170
So once we get everything set up the way we want, it can of course be edited

172
08:49.170 --> 08:49.760
later.

173
08:49.760 --> 08:55.090
And we also saw how it walks us through a wizard step by step if we make a new

174
08:55.090 --> 08:55.640
rule so

175
08:55.640 --> 08:58.120
we can choose all the different things we want.

176
08:58.120 --> 09:02.750
There's several pre-built as we go through or of course we can custom build
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
08:58.120 --> 09:02.750
There's several pre-built as we go through or of course we can custom build

177
09:02.750 --> 09:03.440
anything

178
09:03.440 --> 09:04.640
we want.

179
09:04.640 --> 09:07.920
So next, let's take a look at a similar function.

180
09:07.920 --> 09:10.960
But this time, let's look at the web policies.

181
09:10.960 --> 09:20.960
[BLANK_AUDIO]