If we want to use the web security
appliance in conjunction with Active Directory,
like matching based on usernames or group membership
from Active Directory, we have to set up
that link between the web security appliance and Active
Directory, and that's what we're going
to do together in this video.
So here is the play by play.
I've got the WSA at .155 on this 192.168.1.0 network,
and I've got the Active Directory server at .100.
So the basic installation of the WSA was already put in place. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the basic installation of the WSA was already put in place.
I'm just using one interface.
You can actually use multiple, but I use just one interface
for both management and also for the proxy services,
and it is at .155.
So here I am at the logon.
I logged on to the IP address of the web security appliance
with the port 8443, which was agreed to in the initial setup.
So I'll login in as admin.
I'll put in the password I set.
The default password is ironport,
put the setup installation has you
change that as you go along.
So it's dropping us by default under the reporting tab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's dropping us by default under the reporting tab
to my dashboard, and if we want to integrate Active Directory,
we simply go to network right over here and then
other network, we would select authentication right here.
And to add our Active Directory, we'd add it as a realm,
so we click on add realm here under authentication realms.
And it's going to give the realm name of AD server.
We can select the type of authentication schemes
we'd like to use, so this option here, Active Directory,
allows Kerberos, NTLSM, SSP, or basic authentication,
lots of options.
So that give us the most flexibility,
and then if we had multiple interfaces on our website WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then if we had multiple interfaces on our website
security appliance, we could go ahead
and do set source interface.
And if we had multiple interfaces,
we could also specify which interface
we're using to communicate with the Active Directory server.
In this case, I only have the management interface,
which I'm using for both management
and for proxy services.
So I have no options other than the management interface.
And then we're going to specify the IP address of our server.
If we go back to our topology, our Active Directory server
is at .100 right here.
So we plug in that IP address, 192.168.1.100. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we plug in that IP address, 192.168.1.100.
And as a point of interest, this WSA,
this web security appliance, as well as
the Windows server and some other gear,
is all running over here on this rack of server
in a VMware environment.
So I'm going to go ahead and specify my Active Directory
domain as ogit.com.
It just happened to be that in my little lab here.
So once I supply the IP address of the Active Directory
server and the Active Directory domain,
I'll then go ahead and scroll down just a little bit
and click on Join.
It's going to ask me for credentials about some
of the inactive directory who has the ability to do this, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the inactive directory who has the ability to do this,
so I'll supply the administrator credentials.
And the password associated with that over there
on my Active Directory server, and we'll
click on create account, and we'll cross our fingers.
Let me scroll up to the top here.
Now, one of the things I had challenges with
is I didn't have DNS all dialed in with everybody's names here,
and it barked at me a few times, because it couldn't resolve
a certain IP address to a name.
So in the background, I also tweaked the DNS services
on the Windows server so that everything was resolvable.
Also what I did was I went to network and DNS, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also what I did was I went to network and DNS,
and I also told this web security appliance
to use that Active Directory server,
that Windows server as a DNS server as well.
So that was a little hiccup that I had to resolve,
and I wanted to pass that tip along to you as well.
So make sure DNS works.
So once we've configured this, it says success.
This is a really cool feature.
If we go down here to the bottom,
we have an option for test current settings,
so we click on start test, it will literally
go out and test to see whether or not
that integration between this web security
appliance and Active Directory server is currently working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
appliance and Active Directory server is currently working.
And it's starting off with DNS resolution.
Here we go.
That's a great start, and it's going to continue on.
And with any success, and hopefully
it'll pass all the tests, we can click on
submit, save our changes, and then we'd
have integration between the web security
appliance and our Active Directory environment.
So I sped that up, but that took about two minutes in real time,
and it says test completed successfully.
So we'll click on submit here.
We need to go up to the top right up here
and click on commit changes.
So we'll click on commit changes,
and then it's going to ask us to supply a note regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then it's going to ask us to supply a note regarding
this change or this commit we're about to do,
and I've just added add to the mix
for the benefit of authentication and policy
that we can set up.
Now we'll go ahead and click on commit changes,
and it says our changes have been committed.
Success.
Fantastic.
So now that the web security appliance knows about Active
Directory and how to communicate with it and query it,
we can now use users and group membership
in Active Directory as part of our web security appliance
policies.
So we'll take a closer look at policies in the next video.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'd like to thank you for viewing.