Getting Started with DNS-layer Security

All right. Thank you for joining. Today is a webinar. We are going to discuss Cisco umbrella DNS layer security. Before we start with the presentation, we have a couple of housekeeping items. Any technical issues during the session, please use the chat feature.00:03Webex to alert the host or you can send an email to the team at cloud security CSM@cisco.com. Please any questions that you have during the Webex, use the Q and A session so we can keep an eye on it and and reply.00:23At the end of the session we will review broadly relevant Q and A verbally with the audience and finally the the session is gonna be recorded and you will receive the link via email. Today's agenda is a quick introduction.00:43We are going to check the packages for umbrella DNS.01:03Also, we are going to see where does umbrella fit in your environment. What are the identities that you can use for DNS? We are going to review the DNS policies and best practices and finally we have a demo for you.01:08So, Cisco Umbrella uses the internet infrastructure to enforce security and block malicious activity before air connection connection is ever established by delivering security free from the cloud.01:23By default three security categories are enabled malware command control and speeching, but you can also add more security categories for your organization, like.01:42DNS dynamic or, newly seen domains, e.g.. We will review all the other categories as well. So for your packages, we have essentials and advantage.01:57The main difference between these two are the let me see. So it's basically the proxy functionality. So even though this is a DNS layer, we provide a limited.02:16Proxy inspection for certain domains that we don't, we don't trust. They are like great domains. We also provide with this feature.02:33The option to block files based on the antiviters engine and malware defense, but everything else should be very similar in regards of features, so we are going to do.02:48DNS security protection malware, and also content filtering. So if your company has any policy based on, the websites that users can access on prem.03:05You can, you can enforce that as well So where does umbrella fit? It will start with DNS. So, domain name servers are the here, the heart of connecting every internet request.03:20Security in the DNS layer means blocking malicious domains.03:40And cloud applications before a connection is established, proceeds file execution and IP connection, and it's used by all the devices. So how you can implement umbrella? So we are going to talk.03:45Or discuss all of the deployment features that we have.04:05The 1st one is networks. So when you configure a network, you're creating an object in umbrella and your umbrella dashboard with your public IP. This is gonna be the easiest way to deploy umbrella because all you need to do is.04:09Basically configure your public IP in the dashboard, and then on the endpoint, on the endpoint adapter, what you are going to do is configure the umbrella public IP. So you are still start going to redirect traffic to umbrella.04:26And you are going to enforce your policy. So NO agent it's needed in this scenario. It is useful for, e.g., for guest users where you don't need to resolve any internal domain.04:42Points.05:02And all you need to do is basically configure your DHCP configuration to, to point your guest network to umbrella IPs. So it's gonna look basically like this. So you have your three endpoints, computers, laptops.05:03Amount devices, they are going to be, in case they need to resolve local DNS, right? They are going to be using your local DNS, but on your local DNS.05:23You will have the umbrella public IPs just for workers. So this is in case you need to resolve internal DNS domains. If it is a network, a guest network, you can directly send traffic to umbrella.05:42The downside with this deployment is that on the umbrella dashboard we are only going to have visibility for the public IP. At that point, we don't have any internal IP visibility, any user IP visibility or host name.05:59So that that's why it is useful for, for guest users because at the end of the day, you don't have any user information to provision for a guest user. Then we have like an upgrade from networks. We have network devices.06:17So network devices basically, it could be a Meraki device, wireless line controller or switch. We have a list of hardware that can be integrated through API. And this is going to provide you with internal IP visibility. You can.06:34Not enforce this on a policy?06:54But at least you have the visibility in the reports. Also you can create a policy based on a SSID or or a VLAN. Okay, then we have virtual appliance.06:57So virtual appliance is a lightweight machine running Linux.07:17That you need to deploy in pairs. This is going to replace your local DNS server in the adapter configuration. So instead of pointing your.07:22The Devices to your internal DNS server, you are going to point them to the virtual appliance. Then the virtual appliance is going to see if that request should be sent to your internal DNS server or it should be forwarded to the cloud.07:38And you can manage this list of domains through the, through the dashboard of course. Also another advantage with the virtual appliances that we don't have with networks or network devices is that you can be integrated with.07:55The on prem AD, which basically provides or maps internal IP visibility with user information.08:14This only works with the on prem ID, it doesn't work with Azure because we rely on the connector. You need to deploy a connector that's gonna start monitoring your lock events and the domain controllers. So it only works with on prem ID, it doesn't work.08:29Wait actually.08:49So this is how the virtual deployment looks like. As you can see instead of pointing your endpoints to your local server, they are pointing to the overlap virtual appliances. And then the virtual appliance is going to forward the request based on.08:50On the domain management list in the dashboard. If it is local, it goes to the local DNS server and if it is public or external, it goes to umbrella. So we can enforce your policy. And from.09:11This deployment or identity, we, we will see public IP, internal IP, and if it is integrated with Active directory, we will see the user visibility or user information.09:27And the last one is the roaming client. So the roaming client is a module in your secure client suite, it will protect users on prem.09:42And remote users, it will provide all the information possible, so it will provide public IP, internal IP, it can be integrated with on prem ID or Azure. So it will also provide you with.09:59User visibility, it will provide you with the host name, so it will provide you with all the identities possible. So what I usually recommend is to install the, the roaming client on every.10:17Device possible even if it is like a worst station though it's not leaving the, the office, so install the client on every single device possible and everything else that is not capable of having the agent installed.10:32Just protected through the virtual appliance like you know IoT devices, cameras, printers, everything else can be protected by your virtual appliance. And this is how the deployment looks like. So basically you install the.10:47If you already have any connect, you just add the new umbrella module and you need to deploy a JSON file so we can map your computer to your dashboard. And that's pretty much it. We will show you that in the demo, I think that is part of the demo.11:09But it's very straightforward. And the last thing that you need to do is to install the certificate, so umbrella has a root certificate that needs to be installed. Otherwise, when we present the block page.11:28We will or you will see a SSL error, so we have a question. Do we really need virtual appliances or is 2nd type of deployment? So, it will depend on your environment and your.11:43Where you, so you don't, you don't need the virtual appliance if.12:03You are not interested on protecting IoT devices or something like that. Or if you only want to protect users when they are remote at home, right? I have seen customers using Umbrella only when the user is.12:07At home or remote, and when they are at the office, they use, you know, their firewall or something like that. So it would depend on your scenario, but I I will let my colleagues.12:27Add more details on that or provide you with more documentation on that. Okay, so DNS policies, you can design.12:45Any number of DNS policies to protect your identities and manage access to destinations. When you create a policy, you choose which identity to add to a certain policy, then you order the policy listing to highest priority.13:01DNS policy 1st. Umbrella evaluates your policy to match an identity and destination using the order you set. If a match is not found, then we they are going to apply the default policy. So we are going to look to.13:18For identities. That's what we use to match the policy and we look from top to bottom. So what you want to do is basically use your default as your catch all or you can even create your own default. That's fine. So you need a catch all that's at the bottom.13:33And every exception that you need to create, it goes on top. So your should be the most restrictive policy, so not allowing access to, I don't know, e.g. Facebook, Netflix, something like that based on your policy companies.13:52So when the user is on prem, it will hit that policy. And if the user is the at home, e.g., and you want to allow access to those applications, you can create an exception on top when the user is at home.14:10It's not at the office let me see if I have any questions I'm confused. It's being deployed so.14:30So it will depend, let's say, and, and this example that I just gave is is another reason why you may want virtual appliances. So we have a way to turn off the agent when the user is on prem or at the office, and one of.14:50Those.15:09Options is the virtual appliance. So when the user is at home, it's gonna use the roaming agent. It's gonna match a, you know, a remote policy where it has more, more options in regards to applications they can access.15:10But when the user is on prem, the, the client is going to detect that he's behind a virtual appliance and it's gonna let the virtual appliance handle the requests. So it will match a office policy. So that is another reason why you may want to use a virtual appliance.15:31When you turn off the agent, if you don't have a virtual appliance, you will lose, you are going to lose the user visibility. So e.g., instead of.15:52Instead of using the virtual appliance to turn off the agent when the user is at the office, you can use a sub subdomain, an internal domain. So you are going to configure a domain that only can be resolved by your internal network.16:08And the agent is going to send a request. If it is resolved, then the agent knows that he's at the office. It's gonna turn off itself, and it's gonna let the network identity handle those requests.16:25So you are losing host name visibility, user visibility, internal IP visibility because you are letting the network identity handle that request. It's still gonna work, you're still protected through umbrella, but you are losing all that information. So that's another reason why you may want.16:40Which have a virtual appliance. I hope that makes sense. Let me know if you have more questions yet. So as I said, you can move your policies.17:00As you need, but we are going to match the very 1st one from top to bottom once we find find that identity. And if it is not found, we will match the default policy.17:20So how the policy evaluation works, with a policy, within a policy umbrella evaluates the following policy settings, starting with your policy allow destinations. So we are going to check destination lists.17:39Then we are going to check for the allow applications. If you have the advanced package, you have the intelligent proxy enabled. That's the next item they will check.17:55Then we were going to check for the security categories, the integrations, block list, then we check your destination for block destinations, destination list for block destinations.18:11If you have, again, the intelligent proxy enabled, we are going to match or blocked all the URLs that you created on the unknown domain list. Then we are going to check for botnet.18:30Again within the proxy enabled, we are going to check for any URL in the unknown domain list. Last, we are going to check for block applications, block content categories.18:46And then we are going to check for any antivirus that it's got by the engine. So that, that's pretty much the order. So that's why in case you need an exception or.19:01White listed domain because it's not categorized correctly, you can use the destination list and bypass all the other categories because this is the very 1st thing that we check.19:17As best practices, build your policies from bottom up. So as I said, your catch all should be the very last one and then on top you start creating your exceptions.19:37You utilize the top level groups of identities when possible. Organize your policy settings for use and catch all default policy. And then we have a quick demo.19:52If you don't have any questions, we can start the demo In this demo we are gonna go over deploying Cisco umbrella. So if you look.20:09Look over here on the left hand side of your Cisco Umbrella main dashboard. And you go under deployments, you're going to see that there are many options as far as deployment methods for Cisco umbrella. Due to time constraints, though, I am going to only discuss through the most commonly used deployment methods with umbrella.20:29So the 1st method that I'm going to demonstrate for you today is gonna be the quickest and easiest method to deploy umbrella, which is adding your public IP into your dashboard. But before I jump into that, I want to go over to the umbrella test page. So we have an umbrella test page.20:49It's welcome.umbrella.com, and if you go here and your network is not being protected by umbrella, you're gonna see there's a red banner that pops up. There's gonna be an X and it says oops, it lets you know that currently you're not being.21:07Covered by umbrella, and we're gonna go back to our dashboard, we're gonna go back under deployments and we're gonna go under core identities and then we're gonna choose networks.21:23Then you're gonna go to the top right hand corner and you're gonna go to the add icon and select that. Now you see here that we need to 1st start by pointing our network DNS to the servers.21:47We are using IPV four. So this is where we're going to add.22:31Umbrella's servers. So I'm gonna put in those IP addresses and we are gonna put in both of those.22:39All right, now as far as going in the umbrella dashboard, our 1st step after we have pointed our DNS request to Umbrella's anycast servers, we're going to name our networks, so we need to make sure that this is unique.23:07And an identifiable network name. So that way if you have multiple networks, we can easily and quickly identify them as soon as we go to this page.23:28For the purposes of this demo though, I'm not gonna be too terribly exciting I'm just gonna put in a demo one. Next after that we are gonna choose if we're using IPV four only IPV six only or a mixture of IPV four and IPV six for this demonstration, we are choosing ipv.23:40IPV four and then next we have our IPV four address that we're going to put in. So I want to say in order to apply your policies, the external IP address must be used here. So Umbrella will only detect the external public egress points. So by registering your IP, you are telling umbrella, where your network traffic is coming from.23:58Now you could choose multiple addresses if you need to add more than one, I just need one. So I'm doing/thirty two. And then we come down here and if you happen to have a dynamic IP address provided by your ISP, you will need to click on the dynamic IP address checkbox right here.24:26Also, you'll need to download the IP updater from our support articles which will automatically update the dashboard with your current IP address.24:46If you need additional information, you can always click here on the Learn more. But we are going to save this. Alright, so once you have a network.24:55Added, you're gonna see that it's gonna come with one of three statuses. So 1st we're gonna see that right here, our status is showing it is inactive. So.25:14Inactive doesn't mean the service isn't working. Just that we haven't received traffic within 24 h. The another status that could be showing right here is going to be active and that means we have received traffic within the last 24 h, and then the last option is verifying, which means Umbrella will need to verify the network manually. Now this.25:26Status is updated every three to 4 h, but.25:45Say that, you know, for whatever reason, you might possibly just not feel comfortable that it says inactive and that's perfectly fine and that's perfectly understandable. So what's the solution to make sure that, hey, I want to see that my network is being protected by umbrella like immediately even if it's showing inactive cause it just has.25:50The updated because we haven't gotten any traffic to come through.26:09That very 1st page showed you that welcome.umbrella.com. This time I'm just gonna open it in a new page. You're gonna go back to that and you'll see this green banner, it says welcome to umbrella versus what we saw before, which was the oops, and it was a red banner.26:14We see that now our, our network is being protected.26:34Okay, so what is the next method of deployment that we're gonna discuss today? We're gonna stay under deployments, of course, we're gonna go back under core identities and then we are going to go down to roaming computers. So we know that many devices are roaming and not and are not fixed to a network this day and day.26:45So this is where the roaming client is actually useful.27:07And we actually see, that this is already enabled, let's see if it's on here.27:15Because I don't see secure client.27:31So we have a lot of, computers this day and age, just leave off where I was discussing what where this comes, just some examples real quick of what would be an example of roaming computers and when we would use this. So a lot of times we have employees.27:55That are traveling, you know, they maybe going to see a customer, they might be going to a different, site for whatever reason and they have a work laptop and they're connecting to like, you know, maybe the, the hotel, maybe they're working in an air at an airport or on the airplane or going to a coffee shop.28:15You know, whatever the reason maybe, you know, a lot of times we're using, you know, bring your own devices has become, you know, major nowadays as well.28:35We want to make sure that these computers are still being protected, right? Even when they are not on our network. So that way, you know, they are safe for what they do or if they do connect again to our network. So this is when we're gonna use our roaming computers. So to do that, you're gonna go to the top right hand corner and you're gonna go to roaming clients.28:44Now you're gonna have two options. So we have our standalone, which is the Cisco umbrella roaming client right here, and you do have a choice between choosing to download it for Windows or Mac OS. I will not be demonstrating that for you today. And it is, as you see here, end of life as a.29:05Of April second of 2024, so obviously not the recommended amended path to go.29:24The recommended fact that we do suggest for you to choose is the Cisco secure client or what's upon a time in any connect. So we have a few methods of deployment. We are going to do the pre deployment package.29:31The and and this is just manually, you know, putting it on your computer versus, you know, using a, a head end deployment package. So I'm gonna click on the windows cause like Peter I'm using. The 1st step is the is.29:51The windows, so 1st step is I'm going to do this manually.30:11For the purposes of this demonstration. You see we downloaded a zip file, so we're gonna show that in the folder. We want to extract all.30:15Alright, so now we are going to install the cure client onto our computer, and when you decide to do this, you absolutely have to have.30:55Of course and any connect VPN and umbrella as well as diagnostic and reporting tools. If you want to add these other ones on, you can, but you do need to have at least these three selected.31:12We're going to accept that and just so you know, with.31:29With secure clients, it supports the secure web gateway, and even it even has the same DNS protection as like the standalone that I showed you before. Alright, so now I wanna show you.31:47Oh Secure client what that looks like. Alright, so we see here we've downloaded the secure client, and we see down here it has umbrella, right? And it says umbrella is inactive, the profile is missing. So if we go back.32:06We see there's a second step, and 2nd step is to download the module profile. So we select that to download. There we go. So as you see, this is a JSON file that is being downloaded, and it has all the org info that's needed.32:25When deploying the roaming security module from the Cisco secure client.32:44We're gonna show that in folder, and we're gonna actually copy this. We're gonna go to our local disk and then we're gonna choose program data. Now, for some reason if you do not happen to see this.32:50You just need to go into view and select hidden items, so if you see if I deselect it, it hides it, but if I select it, it'll show the program data file. So I'm gonna click on that, then I'm gonna click on Cisco.33:10We are under secure client umbrella, and I am going to paste that JSON file here alright then we see that we have an additional.33:27File that popped up, which is kind of indicator for me that I know that it should be good now, so we're gonna go back to that secure client and we see now that umbrella is active. So just kind of give you a little bit more insight, so the roaming security module that works within the Cisco secure client is an add on module, and it.33:47Uses the kernel to identify DNS requests and it redirects your DNS to umbrella, and it doesn't reconfigure the network stack. So, and this is all done while staying connected to, to the VPN with umbrella.34:06So the 3rd deployment method that I'm gonna demo for you today is Cisco umbrella's virtual appliance. So if you go over to deployments, instead of being under core identities, we're gonna go under site and Active directory. So this is a useful method of quickly deploying a whole network location. So if you see I've already got some going on, I have.34:25A couple sites, but the 1st thing we're gonna do is we're gonna go up into the top right hand corner. Let's pretend we haven't had anything yet. We're gonna go to download. Now you have the choice between VMware ESXi and hyper V for me, I am using ESXi, so I'm gonna download.34:46An OVA file and that that's what you're downloading right here is an OVA file.35:07Hi, right, so that's.35:26Open this in our file. Alright, so now let's go jump in.35:28To ESXi, so now we're gonna go over here and we are going to deploy from OVF template. We're gonna upload that file.35:49To the one from today. Next you want to name your virtual machine. Again.36:17You know.36:26You want to make sure that whatever you name it is, you know, uniquely identifiable. So when you're going in here and you're, if you have multiple, you know exactly which one it is. So don't just copy whatever I put in there. This is strictly for demonstration purposes.36:29Is, do what is best for for for you and for you to be able to quickly identify what this is.36:48And we have selected our compute resources. We're looking at our, our details.37:09Else, and then after that we need to select our storage.37:15So we're actually going to do a send provision and make sure you select the correct network.37:21All right, so now everything is deploying and now it's just basically the waiting game as we wait for everything to deploy at this time.37:41Alright, now that we see that the VA has VA has been deployed, we want to go and we want to turn, we want to power it on.37:54And while that's powering on, I want to go over here back to umbrella, and I want to show you something. So you are going to make sure, need to make sure you get this default password, that is right here.38:14Because you will need it once we end up logging into the virtual appliance, right? We are up and running.38:31Now when you 1st log in, if this is the screen that you get, this is you need to wait a little bit longer because this is not the screen that we are looking for, so it's still.38:53I'm getting ready for you, so give me, so just give it 1 s. All right, so this is a screen that we're actually looking for. So once this screen pops up, we're gonna hit control.39:05Will be.39:24There we go. So we are going into config mode and so we will say yes. Alright, so remember I told you to go back to Umbrella and get that password. And if you forget it's right back up.39:31For the download components.39:48Oh. You will type in that password a second time and then you will enter.39:52A new password. Oh, alright so now once we've gotten here, we need to put.40:08In a command and what we need to be, what we will be doing is adding the local DNS IP address.40:28So we will be putting the big local DNS ad oh.40:42Alright, so we have added it successfully. So now we are going to exit. All right, so everything is looking good from here. So now we want to go back to our dashboard.41:05Cancel out of here. We're going to refresh, alright, now once you've done this and you've refreshed, we are going to.41:24Change the site to our second site alright and so just like we saw with our.41:46Our network when we added our network, it's gonna take a second for everything to update. So, would you.42:05May not realize here is that so with your virtual appliances, you do need to have two per site for redundancy purposes, and once.42:14Umbrella has, you know, updated, these statuses are going to change. They'll change to green, and they'll look like my excuse me, my virtual appliances right here from my 1st site where they'll show green and that they're ready to go.42:29But yeah, that's the, that's all I've got today for you for our three methods of deployment, most commonly used methods of deployment for, for umbrella.42:48Okay, so here we have a couple of umbrella resources in case you need to contact support, the regular tag support doesn't handle umbrella tickets, we actually.43:11Use on the umbrella support which you can access or contact through support.umbrella.com. Also if you need some training you can visit learn.umbrella.com to see previous.43:31Webinars, documentation, case status, and for documentation you can visit dots.umbrella.com, let us know if you guys have any additional questions.43:48And thank you for showing today. Thank you Daniel. Really great content shared and it looks like we've got a lot of good engagement in Q and A, a lot of great questions submitted. At this time, this does conclude the presentation.44:06Portion of the webinar today. So if you don't have any remaining questions, you are more than welcome to exit. However, if you do have questions, please be sure to submit them at this time into the Q and A box. We will stay on a little bit longer to.44:26Finish answering those questions. And in addition.44:46When you exit today's session, you will receive a survey. We do appreciate and welcome your feedback. This is very helpful for us to continue to improve for future topics and future sessions.44:51Again, you're more than welcome to stay on and review questions that others have submitted if they maybe of interest to you, but you're also welcome to exit at this time. We're glad that you joined us today. We do hope to see you at a future session and again in the.45:07The Final moments together on this webinar, please be sure to access the question and answer box, which you can find by clicking on the three dots.45:27Located in the Webex console. There will be a menu that pops up. Go ahead, click on Q and A in that menu and submit your question for our technical panelists who are here on the line ready to help answer any final questions that you may have from today's session.45:40Again, we'll stay on for a few moments longer and we'll get those questions taken care of. Thank you.46:01