The single act of just pointing and using the DNS servers
in the Umbrella cloud is going to be
a huge benefit for most systems and most computers on networks
today.
Now, if we want to kick it up a notch
and have a licensed version of Umbrella,
we can start setting up policies to do further control.
In this video, I'd like to give you a big picture
view of what some of those options are
and where we can set those.
And then we'll follow it up with an example
of creating a policy, and then subsequently testing it out
to verify that it works.
So let's take a look at what goes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's take a look at what goes
into this thing called a policy as part of Cisco Umbrella.
And the policy that we're going to set up
is sort of like a shopping cart.
Let's put a cart there.
So if we go shopping and we have a shopping cart,
we're putting a lot of individual components
into that shopping cart.
Then we checkout, and basically we purchase those items.
And we leave with them.
Well, a Cisco Umbrella policy is a lot like that, too.
We have a policy that's going to include
several specific details that all go into a policy,
and then with that policy is all the individual details.
We can then apply that and have it enforced. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can then apply that and have it enforced.
So let's have a chat about a few of the elements that
are in a policy.
One of the components is destinations.
So if you have specific destinations based on URL or IP
address that you want to always permit or always deny,
you can simply add those to the Destinations category
of a policy, and that would then allow that traffic
or deny that traffic based on those destinations.
Another section is content categories.
So at our organization if we had policies,
say we want to stop users like Bob and everybody else WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say we want to stop users like Bob and everybody else
from going to certain categories of websites,
like alcohol-related websites, hate
websites, or gaming websites, or social media, whatever
the policy is, we can identify those categories,
and then when the requests make it up to the Umbrella DNS
servers, based on our policy, they can either say,
yep, here's the IP address you asked for.
Go ahead.
Or they can redirect that client to a web page that says,
you know what?
This has been blocked by your policy.
Another section of a policy is the applications. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another section of a policy is the applications.
So an application would be like Google Maps, or Google Drive,
or Facebook Messenger, or some other internet-related app
so that when Bob the user tries to go there,
the DNS server can identify that,
and say, ooh, I see you're trying to go here.
And I'm going to go ahead and stop it.
And based on the license, there's
some additional options in Cisco Umbrella
which can use TLS decryption.
And that would come into play if Bob
is trying to go to a website.
And let's imagine that the Talos in the cloud as part of Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's imagine that the Talos in the cloud as part of Cisco
Umbrella hasn't quite identified that server,
or they're not sure.
They can actually have Bob's traffic
redirected up to their servers up in the cloud.
They can then do TLS decryption so they
can see what the real request is,
and then say, ooh, that's what you're really trying to do.
We're going to block it.
So the TLS decryption is an option
that is very handy if the Talos cloud and the Cisco Umbrella
isn't sure about a category, or really
wants to see what's happening.
Using TLS decryption, it has a chance
to then analyze that traffic, and then
make a decision on whether it should allow it or drop it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
make a decision on whether it should allow it or drop it.
There's also a security setting section,
which has some defaults such as like malware sites,
if Talos in the cloud knows that the site that Bob is trying
to go to has a reputation for having a lot of malware,
the default for that in the security policy
is going to say, no.
Just say no.
Block that.
Don't allow that to happen.
But we can override that, and we can also
make it more stringent, based on the properties of the security
settings.
There's also the feedback that we're going to give to Bob.
And that's referred to as the Block page,
so that when Bob does go out to a site WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so that when Bob does go out to a site
or attempts to go out to a site and it's being blocked,
there can be a web page from a server as part
of Cisco Umbrella that's coming back with a message.
And we can customize what that Block page looks like,
and what options exist there, including, for example,
an email address for Bob to request access to a site
or to a category so he's just not
left hanging with a blank page.
He's actually got a feedback page
that indicates what's going on.
There's also some integration as part
of our policies with third-party software and features, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of our policies with third-party software and features,
which we'll take a look at in the interface here
in the next video.
And then once we have a policy created,
we could apply that to all traffic coming
from this network, or we could apply it
to all traffic coming from Bob if he
has the remote client installed on him for OpenDNS,
or for Cisco Umbrella, rather.
And that way, no matter where Bob is coming from,
whether it's the corporate network, or if he's roaming,
when those requests, those DNS requests
are sent up to Cisco Umbrella's servers,
then the Umbrella servers, based on the policy for Bob
that's been assigned to him, can respond back appropriately.
So in our policy for blocking alcohol-related sites WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in our policy for blocking alcohol-related sites
we can have a Block page coming back saying, hey,
you're not allowed to go there.
And that's because of the policy blocking alcohol-related sites.
So that's the big picture view of how policies
work with Cisco Umbrella.
We identify each of the individual components
about what we want to allow or not allow,
such as certain applications, or certain categories of websites
and so forth.
And then we bundle those, or include those in a policy.
And then we specify who we want that to apply to
in our organization.
Is it people who are just coming from the corporate headquarter
site?
Or is it for our roaming clients? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or is it for our roaming clients?
Is it for everybody?
So we have some flexibility about which policies
we apply to which devices.
So we'll get right into the policy in the very next video.
So I look forward to seeing you, my friend,
there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.