WEBVTT

1
00:00.000 --> 00:08.260
So now that we've got a baseline knowledge down for Cisco umbrella, we know

2
00:08.260 --> 00:08.480
that it's

3
00:08.480 --> 00:11.080
far more than just the firewall.

4
00:11.080 --> 00:15.640
We know that it has several different components, including our DNS layer

5
00:15.640 --> 00:16.760
security, the secure

6
00:16.760 --> 00:21.800
web gateway, the cloud delivery firewall, which of course is still part of it.

7
00:21.800 --> 00:26.370
But the question then becomes, how does the traffic actually flow between these

8
00:26.370 --> 00:27.080
different

9
00:27.080 --> 00:31.480
components and make decisions as far as whether the traffic should be forwarded
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.080 --> 00:31.480
components and make decisions as far as whether the traffic should be forwarded

10
00:31.480 --> 00:32.080
or not?

11
00:32.080 --> 00:34.280
Well, that's the purpose of this video.

12
00:34.280 --> 00:38.250
We're going to jump in and we're going to talk about how the traffic gets

13
00:38.250 --> 00:39.240
flowed logically

14
00:39.240 --> 00:42.810
between these different components and make the decision as to whether we're

15
00:42.810 --> 00:43.320
actually

16
00:43.320 --> 00:46.920
going to send the traffic or if it's going to be denied.

17
00:46.920 --> 00:52.400
So let's go ahead and take a look at that logical process.

18
00:52.400 --> 00:57.160
So of course, the very first thing that has to happen is the end user traffic

19
00:57.160 --> 00:57.800
has to actually

20
00:57.800 --> 01:00.480
get to umbrella umbrella.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.800 --> 01:00.480
get to umbrella umbrella.

21
01:00.480 --> 01:04.400
Umbrella of course can't do anything until the traffic arrives.

22
01:04.400 --> 01:06.520
Well, how's it going to do that?

23
01:06.520 --> 01:12.290
So it's going to do that through IP sec tunnels that are actually coming from

24
01:12.290 --> 01:12.760
the SD

25
01:12.760 --> 01:18.240
WAN devices that are connecting them to umbrella or through end point

26
01:18.240 --> 01:20.200
connectors, which are

27
01:20.200 --> 01:25.200
basically end workstations connecting directly into umbrella.

28
01:25.200 --> 01:30.820
Now once this traffic actually arrives at umbrella, umbrella has to identify it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:25.200 --> 01:30.820
Now once this traffic actually arrives at umbrella, umbrella has to identify it

29
01:30.820 --> 01:31.000
.

30
01:31.000 --> 01:34.810
And for the umbrella identities, we have several different things that can use

31
01:34.810 --> 01:36.760
for classification.

32
01:36.760 --> 01:42.020
It can classify based on the networks that the traffic is either coming from or

33
01:42.020 --> 01:42.520
going

34
01:42.520 --> 01:43.800
to.

35
01:43.800 --> 01:49.090
It can also identify traffic based on the users, so traffic coming from a

36
01:49.090 --> 01:50.920
particular user or

37
01:50.920 --> 01:52.600
from groups.

38
01:52.600 --> 01:55.400
So we don't have to do everything based on individual users.

39
01:55.400 --> 01:57.520
We can use groups.

40
01:57.520 --> 02:02.730
Once we've actually identified that traffic, that is then matched with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:57.520 --> 02:02.730
Once we've actually identified that traffic, that is then matched with

41
02:02.730 --> 02:04.160
destinations that

42
02:04.160 --> 02:06.600
the traffic is going to.

43
02:06.600 --> 02:10.450
Once that's determined, of course, we have to figure out what to do with the

44
02:10.450 --> 02:11.160
traffic.

45
02:11.160 --> 02:13.200
So we know what the traffic is.

46
02:13.200 --> 02:15.760
We know where the traffic's going.

47
02:15.760 --> 02:20.240
Then what we have to do is actually apply the proper policies.

48
02:20.240 --> 02:25.060
We have to look and see is this traffic supposed to be allowed or is it

49
02:25.060 --> 02:26.920
supposed to be denied?

50
02:26.920 --> 02:31.070
And this is sort of where the logic comes in, where we have to look at how the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:26.920 --> 02:31.070
And this is sort of where the logic comes in, where we have to look at how the

51
02:31.070 --> 02:31.720
traffic

52
02:31.720 --> 02:34.320
is passed between the components.

53
02:34.320 --> 02:38.720
So let's take a closer look at that actual process.

54
02:38.720 --> 02:44.760
So as we mentioned in the previous video, the very first thing is we get a DNS

55
02:44.760 --> 02:45.840
request.

56
02:45.840 --> 02:49.800
This is where we hit our DNS layer security first.

57
02:49.800 --> 02:52.970
So of course, the first thing that has to happen is when we look at that

58
02:52.970 --> 02:53.640
identity and

59
02:53.640 --> 03:00.750
the destination, we have to figure out which DNS policy is going to actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:53.640 --> 03:00.750
the destination, we have to figure out which DNS policy is going to actually

60
03:00.750 --> 03:01.160
apply.

61
03:01.160 --> 03:07.160
Then we're going to enforce the action either permit or deny that request.

62
03:07.160 --> 03:12.820
If we permit the request, we're going to send a DNS reply back to the requester

63
03:12.820 --> 03:12.960
.

64
03:12.960 --> 03:17.560
If we deny it, then we simply don't answer and the client can't initiate a

65
03:17.560 --> 03:18.400
connection

66
03:18.400 --> 03:20.960
because it has no name resolution.

67
03:20.960 --> 03:25.880
So if the action here is deny, that's essentially the end of the processing.

68
03:25.880 --> 03:31.300
However, if the action is to permit the traffic, the next thing we did was look
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:25.880 --> 03:31.300
However, if the action is to permit the traffic, the next thing we did was look

69
03:31.300 --> 03:32.400
to see if there's

70
03:32.400 --> 03:35.560
a firewall policy actually enabled.

71
03:35.560 --> 03:40.850
If there is, we're of course then going to route all of the permitted requests

72
03:40.850 --> 03:41.360
to the

73
03:41.360 --> 03:43.080
firewall.

74
03:43.080 --> 03:47.110
Once it gets to the firewall, of course, the firewall is going to do one of two

75
03:47.110 --> 03:47.840
things.

76
03:47.840 --> 03:49.800
That's sort of what firewalls do.

77
03:49.800 --> 03:54.450
First, it's either going to filter the request if we identify the traffic and

78
03:54.450 --> 03:55.360
see that it's

79
03:55.360 --> 04:01.300
going to be denied or we're going to forward that traffic and we forward it to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:55.360 --> 04:01.300
going to be denied or we're going to forward that traffic and we forward it to

80
04:01.300 --> 04:02.160
the secure

81
04:02.160 --> 04:07.200
web gateway, which is the next component that the traffic is going to go to.

82
04:07.200 --> 04:14.480
And it's either going to use port 80 or port 443 depending on configuration.

83
04:14.480 --> 04:19.750
So to get to this point, the traffic has to be permitted by DNS layer security

84
04:19.750 --> 04:20.080
by the

85
04:20.080 --> 04:26.320
CDFW and then it gets passed to the secure web gateway.

86
04:26.320 --> 04:30.520
This is of course assuming that we have a web policy enabled as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:26.320 --> 04:30.520
This is of course assuming that we have a web policy enabled as well.

87
04:30.520 --> 04:34.520
But if we do, it's going to go to that secure web gateway.

88
04:34.520 --> 04:40.600
Of course, it's going to receive that from either port 80 or port 443 one of

89
04:40.600 --> 04:41.320
the two.

90
04:41.320 --> 04:46.540
But either way, this traffic arrives at the secure web gateway, which just like

91
04:46.540 --> 04:47.080
the DNS

92
04:47.080 --> 04:53.080
policy and the firewall policy, we have to look at what the policy actions are.

93
04:53.080 --> 04:57.360
Once again, it's either going to be permit or deny.

94
04:57.360 --> 05:02.640
And just like our other policies, of course, if any of these are denied, that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:57.360 --> 05:02.640
And just like our other policies, of course, if any of these are denied, that's

95
05:02.640 --> 05:03.160
the end

96
05:03.160 --> 05:04.840
of the process right there.

97
05:04.840 --> 05:06.280
The traffic is dropped.

98
05:06.280 --> 05:10.080
This whole thing stops and the client's been protected.

99
05:10.080 --> 05:14.720
However, if we have gotten to permit from the DNS request and we've gotten to

100
05:14.720 --> 05:15.280
permit

101
05:15.280 --> 05:20.280
from the firewall policy and we've gotten to permit from the web policy, the

102
05:20.280 --> 05:21.040
final step

103
05:21.040 --> 05:25.240
here is going to be actually allowing that traffic.

104
05:25.240 --> 05:30.870
And that traffic is then going to exit umbrella through network address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
05:25.240 --> 05:30.870
And that traffic is then going to exit umbrella through network address

105
05:30.870 --> 05:32.520
translation or NAT.

106
05:32.520 --> 05:36.060
So as is common practice in most environments, we're of course going to be

107
05:36.060 --> 05:37.160
hiding the internal

108
05:37.160 --> 05:45.200
addresses behind an outside public address, which actually belongs to umbrella.

109
05:45.200 --> 05:50.370
So in this video, we just took a look at how the traffic flow logic works

110
05:50.370 --> 05:51.360
through the different

111
05:51.360 --> 05:54.480
components in Cisco umbrella.

112
05:54.480 --> 05:58.640
We saw how it first goes into our DNS layer security.

113
05:58.640 --> 06:02.840
And if that permits it, it then flows into the firewall.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:58.640 --> 06:02.840
And if that permits it, it then flows into the firewall.

114
06:02.840 --> 06:07.400
If it's permitted there, it then flows into the secure web gateway.

115
06:07.400 --> 06:12.110
And finally, if it's permitted by all three of those components, it then exits

116
06:12.110 --> 06:12.760
umbrella

117
06:12.760 --> 06:16.080
through the network address translation component.

118
06:16.080 --> 06:21.070
Now the next thing we want to look at is to take a closer look at that Saa

119
06:21.070 --> 06:22.200
architecture

120
06:22.200 --> 06:24.400
that we mentioned in the first video.