One of the challenges I'd like to address with you
in this video is that if everybody in the world
can just point to the DNS servers
in Umbrella Cloud for free and use them and get
those basic security services, how
do we differentiate our requests if we're a paying customer,
and we have a license, and we have policies?
How does the Umbrella Cloud DNS servers know that it's us?
And the answer is we are going to have
to identify in our configuration for Umbrella Cloud
our source IP addresses, and who it should expect.
And that way when the Umbrella Cloud gets the DNS requests WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way when the Umbrella Cloud gets the DNS requests
from us, or from your organization,
or from another organization, they
know, oh, this is coming from organization XYZ.
And as a result, I'm going to apply the policies
for that organization.
So let me show you how that's set up
through the use of identities here in Umbrella.
So I have logged into Umbrella.
And if we go to Policies, here's the policy
that we created in the previous video.
There's our custom policy with all the policy
components that are tucked in.
And if we want to specify who this policy should apply to, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we want to specify who this policy should apply to,
that's related to the identities of where those requests are
coming from, where those DNS requests are coming from.
And to set that up, we're going to go under Deployments.
And under Deployments we have a section called Core Identities.
And there's several options here, including Networks.
And here we can identify the source IP address
or addresses that those requests would be coming from.
If our entire organization is hidden behind one IP address,
it would look something like this.
That currently is my NATed address out to the internet.
But if we wanted to add additional networks,
we click on Add right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we click on Add right here.
We could also specify network devices.
An example of a network device would
be something in our environment where
like Bob sends his DNS request to this device.
And then this device forwards that
request up to the Umbrella Cloud.
And that way if DNS requests do come
from the devices we've identified,
it can say, oh, this is part of that organization.
Or if we have roaming computers, we
can download the roaming client, install it on a computer,
and then based on that roaming client software being
installed, as it checks in, the Umbrella Cloud servers
can also be aware that, oh, that's Bob's machine.
He's part of our organization. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
He's part of our organization.
So to make a client a roaming computer what we would do is we
could go right here onto this page
where says Roaming Computers.
Click on Roaming Client, so download.
We then download our appropriate client, Windows or Mac.
And then once we download it, we can install it.
And then that client software would check in
with Umbrella Cloud.
And then when DNS requests come from that client,
the Umbrella Cloud knows is coming
from a device in our organization.
So earlier I took the liberty of installing--
this is Bob's computer.
I took the liberty of installing the remote client WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I took the liberty of installing the remote client
on Bob's computer.
It checked in.
And so these are the details currently regarding
Bob's computer.
There's also apps and services to bring in mobile devices,
as well as Chromebook users as well.
The goal is we want the Umbrella Cloud to be able to correctly
identify us, whether we're coming in
from a certain network, or based on roaming using the client,
so it can properly apply the policy to us.
And now that leads me to the next problem
here is what policies should be applied to whom.
And to decide that, we would go down to Policies.
And let's click on All Policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's click on All Policies.
And here's the custom policy we made in a previous video.
So if we click on our custom policy,
notice right here it says, applied to 0 identities,
meaning this policy doesn't apply to anybody yet.
And it won't apply to anything until we
specify that it should apply to one or more identities.
So if we click on Our Custom Policy,
this will give us a nice ability to see where we could
apply this specific policy.
So under identities affected, 0.
That's how we left it.
Previously, if we click on Enable,
now it's going to ask us, OK, great.
Do you want to apply this to certain AD groups, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Do you want to apply this to certain AD groups,
or AD users, or AD computers, or networks?
So if you click on Networks, for example,
it then will give you a list of all the networks.
So on my identity for networks, I only have one.
And that's why we have just one showing up here.
If we go back to All Identities, under Roaming Computers,
I have exactly one, because I installed a client
on Bob's computer.
So we click on Roaming Computers.
It will give us a list of all the computers
that have checked in, because they have the client.
And then we could select them from here.
Or we could go back to All Identities,
and just check the box here for all roaming computers.
And that adds it to the list over here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that adds it to the list over here.
So this is the moment of linking an identity, like a roaming
computer, or a subnet, or a network,
with an associated policy.
So now once we click on Set and Return,
it's going to apply the policy called Our Custom
Policy with all the devices in the category of roaming
computers.
And so we'll click on Set and Return.
So now under Identity Affected, we have 1.
And we'll click on Save.
And that will apply that policy.
Now, another thing to be aware of
is that we just applied that.
We'd also want to make sure that our clients have
gotten that update.
So we just changed that policy right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we just changed that policy right here.
We can see how long ago we had a synchronization of that
with the client.
So here it's showing us the last sync with that client.
So if we expand that real quick and scroll down, see right here
it says, last active policy is the default policy.
So there will be a resync here in a little bit of time.
And when it does, it should show the current information
regarding the active policy associated with that client.
So now we've associated the roaming computers
with our custom policy.
So as soon as the dust settles, it all
synchronizes, any traffic that's being
sent by those clients regarding DNS requests WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sent by those clients regarding DNS requests
and so forth, all of our components of our policy
that we've implemented should now
be enforced on that roaming client.
So here on Bob's computer, let me go ahead and bring up
a command prompt.
And let me go ahead and do it with privileges
so we can flush the cache.
So we'll say, ipconfig slash flushdns.
I could also use a dash there.
That would also work.
Let's do an ipconfig dash all.
And right here, check this out.
It says 127.0.0.1.
That's because I installed the Umbrella client.
And the control for those DNS requests
is being handled by the Umbrella client. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is being handled by the Umbrella client.
So let's go ahead and open up a browser.
And let's go out to google.com.
That's not being restricted by our policy.
Ooh!
So right here it's saying, the certificate authority
is invalid.
So if we click here and click on the certificate,
yeah, look at that.
Here's the challenge right here.
This is going to happen to everybody, by the way,
because what's happening is Cisco Umbrella and the SSL
decryption, and also the SSL pages that they're serving us,
they're signed by their own certificate authority.
And if our browsers don't trust that certificate authority, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if our browsers don't trust that certificate authority,
we're not going to trust the certificates, including
resigned certificates that are coming back from the internet
if SSL decryption is enabled.
So because that's a real problem and almost everyone
is going to see it when they're implementing Umbrella
like this, let me walk you through in the next video
exactly how we can install the trusted certificate so that we
won't have that problem.
And then we can proceed with the testing.
So I'll see you, my friend, in the very next video, when we'll
solve the trusted CA problem.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.