One of the challenges that can come up
as we may want to have different policies for different subnets
inside our organization.
But as they all go out to the internet,
they all appear as just one IP address.
And so how do you take 1,000 users on different subnets
that all appear as one IP address for DNS requests?
And how do you enforce different policies based
on which subnet they came from?
Well, one solution to that is to go ahead
and use the Umbrella virtual appliance
inside of our network.
So in this video, I'd like to chat
with you about what that is, how to get it, and how it works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with you about what that is, how to get it, and how it works.
So let's imagine inside of our network, we've got some VLANs
and associated IP subnets.
Let's say Bob is on one of them and that Lois
is on yet a different one.
So maybe this is VLAN 10 and this is 192.168.10.01
with a 24-bye mask.
And maybe Lois is at 192.168.20.0.
So for VLAN 10 and VLAN 20 with their associate layer
3 addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
3 addresses.
And as our traffic goes out to the internet,
if everything's being padded to this one IP
address or a single address out here,
then when those DNS requests go to the cloud,
if we've identified through the Umbrella interface
that this is the IP address to expect,
we can still apply policy.
But we won't be able to differentiate traffic,
if it's coming from this subnet, from this subnet, because it
all looks like it's coming from one IP address.
So let me clear off the screen.
Let's talk about a solution to that.
So here's what we would do.
We'd download the virtual appliance.
We'd boot it up, launch it in our hypervisor. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'd boot it up, launch it in our hypervisor.
And then we'd give it an IP address.
In my topology, I just have .41.
And then we would train all of our computers
to go ahead and use that IP address as their DNS server.
We can also in our Umbrella, specify.
Let's say this is ogit.com.
And we can specify that this is our internal domain,
and everything else is external.
So when clients make requests to this virtual appliance,
if it's for ogit.com, those requests
can go to our internal DNS server.
And if they're for something outside of our domain,
the virtual appliance can then make the request up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the virtual appliance can then make the request up
to the Umbrella DNS servers.
And because the virtual appliance
can differentiate and communicate
where they're coming from, then based on the policy,
if we have different policies for those internal subnets,
the correct policy can be deployed.
So in this video, let me share with you,
first of all, how do I download this virtual appliance
as part of my Umbrella license?
Let me show you that first.
So here is what we'd do.
In the Umbrella Client, we would go to Deployments.
And so under Core Identities, here's
where we can specify our network devices
and carve them all out independently. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and carve them all out independently.
But under Configuration, we'd go to Domain Management.
And here's where I specify my local domain of ogit.com.
And then other Sites and Active Directory, this
is where we can download the virtual appliance, the Umbrella
virtual appliance.
And to do that up, here on the right-hand corner,
we have the option for download.
We'll click on Download.
Then we have some options for downloading a script
to use as part of Active Directory.
And here we have the download for the virtual appliance.
So there's one that runs in Hyper-V Microsoft,
and there's one that runs in VMware on their ESXI host. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and there's one that runs in VMware on their ESXI host.
So I simply clicked on Download.
And it just downloaded it to my Downloads folder.
And then I open up my hypervisor,
which is right here.
And I simply went to Host, right-clicked,
and said I want to create a VM.
And then I said I've got an OVA or OVF file.
I clicked on Next.
I point it to that file.
And it installed it for me.
And away I went.
And this is the virtual machine here that's currently running.
So here is the IP address.
You can also manually configure that.
It's just got to be a DHB.
In a production environment, you'd WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In a production environment, you'd
want to hard-code so it sticks.
And then I configured it to tell where my local DNS
server was, which is at .100.
It has the default gateway, so it
knows how to get out to the Umbrella cloud.
So here it says for connectivity, this DNS server's
OK.
The local DNS server's OK.
And the Umbrella DNS servers are all OK.
And what we can do is take Bob's computer.
And I took the liberty of removing the remote client off
of Bob's computer.
What we could do is we could point Bob
to this server at 192.168.1.41. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to this server at 192.168.1.41.
This is the virtual appliance.
And then if Bob is doing a resolution for ogit.com,
it'll work locally.
If Bob does a resolution for anything else,
his request will be forwarded by this virtual appliance up
to the Umbrella servers.
And we can still enforce the policy that way.
Oh, and one other thing.
If you do need to log on to this virtual appliance
to configure it, which I did, the password
is umbrella followed by a series of numbers.
And let me show you how to find that because that
was kind of tricky for me.
If you go to Admin and Accounts, it's
going to have in the string this set of numbers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to have in the string this set of numbers.
Mine's 502, yada, yada, yada.
And the password for the virtual appliance
is going to be Umbrella with a capital
U followed by those series of numbers regarding your account.
And that's how you log into that virtual appliance
to modify and tweak it.
So what I propose we do, let's verify on Bob's computer
that we're not using Umbrella at the moment.
Let's do an ipconfig -all or /all, either way.
So we're using a DNS server 8.8.8.8.
And if we opened up a browser and we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we opened up a browser and we
went to alcohol websites, this is all
going to work because we don't have a policy stopping it.
So let's go ahead and grab one that we did previously
to make it consistent.
Liquorama will do.
And it's allowing us to go through.
And if we tried to go to www.acme.com,
that's going to work as well because we're not sending
any requests up to Umbrella.
So I'm going to go ahead and close that.
And let's change our settings.
So if we change our network adapter settings
by right-clicking on that adapter and going to IPv4, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by right-clicking on that adapter and going to IPv4,
now, if I just pointed to the Umbrella servers
here, if I wasn't registered or didn't
have the remote client running on this device,
it wouldn't recognize that Bob is part of our organization.
So what I'm going to do is I'm going to go ahead and point
to 192.168.1.41.
That's the virtual appliance.
And because the virtual appliance
is registered with Umbrella, its request
is it forwards request up to the Umbrella cloud.
We can then have our policy applied
because Umbrella knows that those requests came
from our organization.
So we'll go ahead and click on OK and OK. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll go ahead and click on OK and OK.
And let's flush the cache real quick.
So I'll do an ipconfig -flushdns just
to make sure we're not caching anything.
We'll minimize that.
We'll close that.
And let's open up a browser.
Let's go out to google.com just to make sure we
have basic connectivity.
And that seems to be working.
Let's do a search for alcohol websites.
And let's go ahead and grab one again.
And that is--
[LAUGHING] All right.
All right, pause the track. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, pause the track.
That's working.
Why is that working?
Let's just go check our work real quick.
So we do an ipconfig -all.
I want to see how our current settings are.
Our DNS server is 192.168.1.41.
And let me verify that's our address.
192.168.1.41.
It says from the virtual appliance
that everything looks good.
And also because I was able to go to those sites,
that means DNS was working.
Let's do an nslookup real quick.
Yeah, so that's the DNS server that we're using. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah, so that's the DNS server that we're using.
Let's do a cisco.com.
Yeah, so DNS is working.
It's working through that.
What is going on with that virtual appliance?
So let's go back to the interface here.
On the Overview page, it says--
Oh, right there.
192.168.1.41 is in a state of error.
Hmm.
This morning, there was an icon for an update.
I did it.
This says it's OK, though.
Let me do this.
Let's go ahead and reboot the virtual appliance,
because I just did do an upgrade. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because I just did do an upgrade.
And I will leave the camera rolling.
All right.
So here, let me bring this up so we can see a little bit better.
All right, down at the bottom it says
control plus s, which I will go ahead and do.
And then I have an option here for Poweroff
in the upper left-hand corner.
I'm going to go ahead and power this off with an OK.
And then I will go ahead in power
it on here on the ESXI host.
So I think after the update, that
may be causing us some grief.
That seems reasonable.
Let me give it a moment and I'll reboot it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me give it a moment and I'll reboot it.
All right, so that's powered off.
Let me go ahead and power that baby back on.
Here it goes.
All right, so as that boots up, let's
go back to Bob's computer.
And let's go to a command prompt and just verify
a couple of things.
Yeah.
Well, let's flush the DNS cache.
So the ipconfig -flushdns.
Great, great, great.
And then we'll do nslookup.
up And let's look for cbtnuggets.com
Yeah, DNS seems to be working great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah, DNS seems to be working great.
All right.
And that says it's all coming back from the server too.
All right.
So let's type exit.
So I've got green lights.
That looks good.
Let's go to Bob's computer.
I'll open up a browser.
We'll go to google.com.
And let's just try www.acme.com.
That'll be a quick test.
[LAUGHING]
All right.
So we've verified that DNS is working.
It's going to the virtual appliance.
Why are we not getting the policy enforced? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why are we not getting the policy enforced?
Oh, yeah.
That would be why.
Check this out.
If we go to Policies, All Policies,
we have zero identities in our custom policy
because I removed the remote client.
And so basically, our custom policy applies to no one.
And the default policy is applying to everything else.
So there's our problem right there.
I'm going to apply it to all networks and all sites.
And that's all I have to find.
So that'll catch it.
So with those selected, I'll click on Set & Return.
And now I have two identities included in this custom policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now I have two identities included in this custom policy.
Click on Save.
And there we go, two identities associated with that.
All right.
So we're not going crazy.
So let's go back to Bob's computer.
Let's close the browser.
Let's open up a command prompt.
And we'll run that with admin privileges.
And let's do a couple of verifications, number one,
that our DNS cache is flushed.
We'll do that with ipconfig -flushdns and ipconfig -all.
And we are still pointing to that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we are still pointing to that.
Just to verify that we have name resolution in general,
we'll do a nslookup cisco.com.
All right, great, great, great.
OK, so now we'll open up a browser.
In fact, I'm just going to go for incognito mode
to make sure we're really free and clear.
Let's go to www.acme.com.
And thank goodness.
That's being blocked.
Let's go ahead and do a Google search.
And Google seems to be working.
That's great.
If we click on the little lock, it indicates under Certificate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we click on the little lock, it indicates under Certificate.
It's signed by our Cisco Umbrella ACA.
That's fantastic.
And let's do a search for liquor.
And let's go grab one that we've done before.
How about liquor.com.
And that should be blocked.
And survey says, yes!
I saw the block.
That opened up DNS at the top.
It's been blocked.
Fantastic, that means our policy is now successfully working.
So thanks for joining me in this video
as we've taken a look at the virtual appliance used
in conjunction with Umbrella cloud. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in conjunction with Umbrella cloud.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.