One of the trickiest pieces for any security appliance
is to allow what needs to be allowed, and at the same time
be very granular in choosing what to deny.
A good case in point is Facebook.
Maybe we want our users to be able to go to Facebook
and use most of their apps and services there.
But maybe just not messaging or file transfer services
at Facebook.
Can we restrict those?
Well that depends on your appliance.
It just so happens that the web security appliance
has the ability to identify and filter specific web
applications that we don't want our users to have access to. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
applications that we don't want our users to have access to.
So in this video, we're going to still focus on access controls,
but with a focus on application-specific programs
or services that we want to permit or block.
So here in the access policy, we got there
by going to Web Security Manager and then
clicking on Access Policies right here,
we created a new policy called No Drinks for Bob.
I think I'd like to edit that.
And we'll just call this Sorry Bob,
because we're, about to limit more than just alcohol.
So we'll say Sorry Bob.
Great.
And we'll go ahead and click on Submit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll go ahead and click on Submit.
And we have a few other changes I'm
going to make before we actually do the commit up
here in the upper right.
So regarding application filtering,
by default we have 345 applications
that are being monitored and allowed in the global policy.
If we want to take this policy rule number one and modify it,
we can just click right here.
By default, this is going to match the default policy.
We're going to tweak it.
So if it's Bob, we're going to filter on what applications
he can go ahead and use.
So there's a couple of options here.
One is to use global policy application settings.
And the other is to go ahead and define custom settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the other is to go ahead and define custom settings.
And what I'd like to do is let's go down to something fun.
Let's pick something we can measure.
So let's go down to, we could go to Google.
Let's go down to internet utilities.
And here's a whole bunch of internet utilities
that we could deny if we wanted to, as far as applications.
So across from Google Translate where
it says Use Global, which is Monitor at the moment,
we'll click on that.
And we're going to change it.
So as part of this policy, we'll go ahead
and block by clicking on the Block radio button
and clicking on Apply.
And then let's scroll down. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then let's scroll down.
Click on Submit.
And then once we click on Commit Changes,
we'll have this access policy 1 called
Sorry Bob that will be blocking any URL categories regarding
alcohol.
And it'll also be blocking Google Translate.
So let's go ahead and--
Actually before we do that, let's test before we commit it.
Let's test and verify that Bob can get there
before we do the blocking.
So we'll go back to Bob's computer.
And we'll watch an incognito window from Google Chrome
just to gives the best chance of not catching anything.
And let's go to translate.google.com. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go to translate.google.com.
We'll log in as Bob.
And sure enough, OK, great.
Google Translate seems to work.
So we said Hello.
And we want to see it in Spanish, Hola.
OK, fantastic.
Google Translate works like a champ.
Now that's before--
I'll go ahead and close that browser.
That's before we commit these changes.
So we'll go ahead and commit the changes.
Without our comment regarding this change.
We'll call it No Translations for You,
and click on Commit Changes.
We'll give that just a moment to confirm it's done. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll give that just a moment to confirm it's done.
And then we'll go back to Bob's computer.
So back at Bob's computer, we'll go ahead and open up
an incognito window once again.
We'll go to translate.google.com.
We'll authenticate as Bob.
Press Enter.
And that is still working.
Why is that?
Holy Schnikers!
Let's take a look.
So our changes have been committed.
We are blocking.
Let's just verify that we're blocking
based on Google Translate.
And if you go down to Define Custom Settings WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you go down to Define Custom Settings
and expand Internet Utilities, Google Translate
should be blocked.
Let me try that one more time.
So we'll go ahead and close that.
Perhaps I went to the browser too quickly.
So let's go ahead and bring up another browser window.
We'll go to translate.google.com.
We'll authenticate as Bob.
Click on Sign In.
And there we go.
That's much better.
I must have just gone a little bit too quickly last time.
So it's showing us the page cannot be displayed.
It shows us the source IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It shows us the source IP address.
That is my laptop that I'm currently remote desktop to,
which represents Bob.
There's Bob's username.
There's the category of web page translation.
There are URL we were going for was translate.google.com.
And it says BLOCK AVC, application, visibility,
and control.
Now let me share with you some really sad news,
and that's this.
This block worked.
And I'm grateful for that.
However, many times we'll block an application
or if you do an application filtering,
and a customer can still get there.
Why is that?
Well, with application, visibility, and control,
we're looking at the actual payload of what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're looking at the actual payload of what
they're trying to get to.
Now in this case, I think it saw the URL
and said Oh, that's Google Translate.
And as a result, it stopped it right there.
But if a customer was doing a HQBS session
and then they were going on to some other service,
because the payload is all encrypted with HTTPS,
the web security appliance may not be able to catch it,
because it couldn't identify that specific service that
was being sought after.
So the solution that many firewalls and the web security
alliance takes is to go ahead and actually
do TLS decryption, where the client like Bob,
has a TLS session using HQBS, going from his client WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has a TLS session using HQBS, going from his client
to the web security appliance.
And then the traffic is naked for a moment.
And then the web security appliance
builds its own session out to the final server.
And that way it can see the payload and the application
layer services and so forth, and then apply the rules.
So in short if we want application, visibility,
and control to work consistently to block
all of our applications that we say it should,
we need to have that TLS decryption in place.
So in the next video, I'd like to provide
an overview of how that looks and how that works on the web WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
an overview of how that looks and how that works on the web
security appliance.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.