In the previous video, we linked or integrated Web Security
Appliance with Active Directory, so it
can make queries and identify a user or a member of a group.
That's fantastic.
But we have to as part of our policies
have a way of identifying or looking
for those specific users or group membership.
And a big way of doing that as part of our overall policy
with the WSA is to use identity profiles, which are
critical to making that work.
So in this video, I'd like to walk you
through the basic set up and creation of an identity
profile on the WSA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
profile on the WSA.
So on this virtual appliance, this
is the My Dashboard page, which is taking me to by default.
And if we want to create an identity profile,
what we could do is go to Web Security Manager,
and then under Authentication, we can specify Identification
Profiles right here.
With that selected, it is showing us right here
that it has a Global Identification Profile that's
exempting from authentication, meaning no one's ever going
to be asked for who they are.
It doesn't care if you're an Active Directory or not,
we just don't care by default. So case WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we just don't care by default. So case
in point, if we took a PC that was currently using
the WSA as a proxy server.
In fact, I've got one right here.
Let me bring him in the view here.
If we opened up a browser--
I'll go ahead and use Chrome in this example--
and we go to a website like fireballwhiskey.com-- now,
I'm doing this intentionally because perhaps we
have a policy that we shouldn't have any customers going
to alcohol-related websites-- not only will the Web Security
Appliance be able to identify this is happening,
but it can also go ahead and stop it
once we put it in policy.
So this is from a client currently
that's using as a proxy server, it's using the WSA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's using as a proxy server, it's using the WSA.
And to verify that, just going to type in "proxy"
here for our proxy settings.
Here it's showing the IP address of the proxy server.
It's also showing the port.
Now this port of 3128.
Now this port of 3128 is the port
that's also listening and configured at the Web Security
Appliance.
Now for a large number of devices,
we wouldn't want to do this manually because two reasons--
a user may be able to turn this off
and also if we have lots of users, like thousands of users,
we'd want to do this through policy and have it automated WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'd want to do this through policy and have it automated
and not have to do it manual.
So anyway, I want to show you that this is
going through the proxy server.
And because the default Identification Profile
says exempt from authentication.
They also exempt from user identification,
basically saying, great, we're not going to ask who you are.
Just go on.
And then it's using default policies as far
as what's being allowed and what's being monitored.
And that's why if we go back to Reporting
and go to My Dashboard and we scroll down, here
it's showing us under Alcohol in the top URL categories
that we've had a few hits.
And that's all on that one client
going to various websites.
However, the system does not yet know WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, the system does not yet know
what the user is behind those transactions
because it's not using authentication yet,
and also it's not doing any blocking by default
of any URL categories.
We can change all that and we will change all
that as we proceed through these videos together.
So to create an identity profile,
we go to Web Security Manager and Authentication,
we click on Identity Profiles.
From here, we click on Add Identification Profile,
and then we simply give it a name.
Let's call this "OurProfileOne."
And you could name it something that's meaningful,
but this is our first one we're creating together. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Give it a description.
And it's also asking where do we want to put this new profile.
Now we have the default global profiles at the bottom.
We're going to put in front or on top of that
because it's our only other profile we have to play with.
And then down on our user identification method,
we can click here and we can specify that we
want to authenticate users.
Now, if we had not yet set up, as we
did in the previous video-- if we had not yet
set up Active Directory integration,
we wouldn't even have an option here for Authenticate Users
because it has no source to go to.
So we'll go ahead and specify Authenticate Users.
Then it's going to ask us about our realm
that we want to use for authenticating WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we want to use for authenticating
those users and the method.
So here we have several options.
Now for the lab, I'm going to go ahead and use basic, which--
this is not convenient for a production environment
because it's going to prompt--
every time the traffic hits the proxy server
it's going to prompt them initially and say, who are you?
And then they have to provide their credentials.
So for a production environment, where our user's
authenticated to their local machine
and is very actively involved in the domain,
we could use other options like Kerberos or NTLMSSP,
so that the user wouldn't have to re-authenticate.
That's one of the benefits of single sign-on
is that you don't have to sign on over and over again. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that you don't have to sign on over and over again.
However, for the lab, I'm going to specify basic
and that way is going to require us every time
if something is not cached for me to force an authentication.
And then if you scroll down just a little bit more,
we have options for persistent cookies or session cookies,
and that way when a user has been authenticated,
it can remember that individual based on the cookie
if we specify it, and that way it won't have
to re-authenticate them again.
So for the lab, I'm going to specify Use Basic,
so it can prompt me every time and not use any cookies,
so it can have a better chance of reproving
who I am if I want to go to a different user account. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
who I am if I want to go to a different user account.
We can additionally restrict the matching
on this identity profile based on the subnet or IP address
that they're coming from.
I'm not going to add that restriction to my lab
but we could, if we wanted for example,
users that are only coming from a certain IP address
to match this identity profile.
And then when we get to policies,
I'll show you how we can specify which profile has to match
for a policy to kick in.
So I'm going to leave this empty.
I'm also going to leave the checkbox next to HTTP and HTTPS
and then click on Submit.
And when we click on Submit, it's not over.
We also now this option in the upper right hand corner WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also now this option in the upper right hand corner
called Commit Changes, which actually
makes those changes real.
So we'll go ahead and click on Commits Changes
and then add a comment and Commit and give
that a second to finish.
And now if we go back to our client
and open a browser again--
I'm going to open up a incognito window once more--
and go to Fireball Whiskey because we're
going through the proxy and authentication profiles
are being match, it's asking us who the heck we are.
And so I'm going to go ahead and specify my name as "Bob"
and my password is this.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now here's the funny thing, I didn't
realize I had a "Bob" account, but I must.
Let's go check Active Directory just
to verify I really do have a user account called "Bob."
so this is my vSphere Console.
Let's go to the 2019 Server, open a console to it.
I'll go ahead and log in.
Close DNS Manager, go to Tools, Active Directory Users
and Computers, and sure enough, I've
got a user named Bob and I've got a user named Louis.
So we could actually use either one
of those names for the authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of those names for the authentication
and it should work.
In fact, let me just check out Louis real quick
and if that works, we'll use those two accounts going
forward.
So here we'll go ahead and close the browser, we'll open it up,
and we'll just go to google.com.
And because we're going through the proxy,
we'll log in as Louis.
Hopefully I remember the password.
Click Sign In, and sure enough, we are there.
Fantastic.
All right.
Also, if we go back to the Web Security Appliance
and go to Reporting and then go to URL categories
and scroll down a little bit, here we
have some for alcohol, which I've WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have some for alcohol, which I've
gone to a few times in this test environment.
And by default, it's monitoring that traffic,
it's allowing it to happen, it's not blocking it.
Now to actually block the traffic, what we also
need in conjunction with an identity profile that says,
who are you?
We also are going to need a policy that
says this is allowed or this is not allowed,
and that's we're going to take a look at more
closely in the next video.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.