In the previous video, we had the remote client all set up.
It was great.
We were going to test the Umbrella
services to make sure the filtering and the policy
was being applied.
And then we got this message, wah, wah, wah,
the certificate isn't being trusted,
the sign of the certificate that was coming through.
So what I'd like to do in this video is walk you through--
I left the screen right where it was.
And I'd like to walk you through the solution to implementing
a trusted CA certificate on the computer.
And that way whenever our computers
receive a certificate that's signed by the Umbrella CA
Services, they can trust it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Services, they can trust it.
So here's where we left off.
And here's how we would solve it.
First of all, we'd want to get the certificate
that we currently don't trust.
If we click here on the triangle and look at certificate,
here it's showing us this is Cisco Umbrella Secondary SubCA
lax-SG.
And if we want to look at the details of that,
we see all the details about that certificate
that currently my browser, this browser doesn't trust.
So to fix that, what we would do is go get the certificate.
So in the Umbrella dashboard, if we expand deployments,
and then we go down under Configuration, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we go down under Configuration,
there's an option here for Root Certificate.
If we click on that, we can download that certificate.
And then we can deploy that to our client.
So you can do it manually, which I'll walk you
through here in just a moment, or we could do it
through group policy, which would be a more efficient way
to push that out to thousands of devices.
So I'm going to go ahead and download this certificate down
to Bob's computer, and then we can go ahead and install it.
So back here on Bob's computer-- let me go ahead
and verify I have that certificate downloaded
in the Downloads folder.
There it is right there, the Cisco_Umbrella_Root_CA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There it is right there, the Cisco_Umbrella_Root_CA.
So if we want to install that as a trusted CA,
there's several ways of doing it.
We could type in certificate.
And we can install that per user, or per computer,
and another way of doing it is just click on the certificate,
and saying, please, install it.
In fact, let's do that.
Let's go back to our file system.
And we'll get the Cisco_Umbrella_Root_CA.
We'll double-click on it.
And it says, hey, what do you want to do?
I'm going to open it.
And then I'm going to go ahead and install it.
So we'll click on Install Certificate.
I'll do it for the current user. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll do it for the current user.
We'll click on Next.
And then I am going to specify where I want this to go.
And I want this to be in the Trusted Root Certificate Store
right there.
So click on that.
Click on OK.
I guess I better press Next there.
And now we'll click on Finish.
And now we'll get a message, hopefully,
saying it's installed.
Survey says, yay, OK.
And it asks me do I want to install this.
And I'm going to say yes.
Boom.
It's done.
So now that that's done, let's close all those windows.
I'll close the browser.
I'll open the browser again. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll open the browser again.
And let's go to google.com.
So now we're going to google.com.
And I didn't get a message.
Let's just go click on the lock.
And click on the certificate, which it says is valid.
And here it's-- great.
It's a certificate issued to google.com.
And it shows that it's issued by or signed by the Cisco Umbrella
Secondary Sub-- blah, blah, blah, the CA server
that we now trust, because we just added it to this computer.
So that's an important step.
Now let's go ahead and continue to test our policy.
One of the things that we said we didn't want to do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
One of the things that we said we didn't want to do
was have a user be able to go to alcohol-related websites.
That was one of the categories.
In fact, I think that was the only category.
Let's take a peek real quick.
So if we go back to Policies, expand that,
and go to All Policies, and click on our custom policy
that we made right here.
And we look at Content Settings Applied,
alcohol will be blocked.
All right, that's great.
I just wanted to confirm we had that in our policy.
And this policy is applied to roaming computers, specifically
Bob's roaming computer.
And he's the only one we currently have. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And he's the only one we currently have.
So if we search for alcohol--
so the Google search is working.
But if we actually tried to go to a alcohol website,
let's just go to one--
let's go to this right here, www--
I've tested this before--
liquor.com.
So boom!
It's being blocked.
And this message, which is HTTPS is coming back
from opendns.com.
This is our Block page.
And if we tried that again, let's
go back and let's just grab another site.
And I'll go to the second page here.
Let's go to missionliquor.com. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go to missionliquor.com.
And boom!
That's great, fantastic.
And it's blocking as it should.
And if we try to go somewhere else, let's go to ebay.com.
And we're not blocking that.
We're not blocking social media, so Facebook should work.
Fantastic.
And the other one-- oh, yeah, there was one other one
that we did block.
We did block one URL.
And that was www.acme.com.
Sure enough, that was part of our policy.
And to confirm that, if we go back to our policy,
and we go to our destination list, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we go to our destination list,
that's where we specified that.
We'll click on Edit.
There's our custom destination list.
And that custom destination list,
if we go over here to destination lists,
we can take a look at the details.
So here are the details of our custom destination
list, which is filtering on www.acme.com.
So our policy is working.
And as a final test, if we went somewhere else,
like CBTNuggets.com--
and this site works.
So there's a lot of benefits of using Umbrella with a license
and a policy, because we're now enforcing
that policy on our devices, or subnets, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that policy on our devices, or subnets,
or networks where we specify that policy should be enforced.
Now, another great feature in addition
to enforcing our policy is the ability after the fact
to see what the heck happened with reporting, and some really
cool tools for investigation as well that
are built into Umbrella.
And this we'll take a look at in the next video.
So I'll see you there in just a minute.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.