Introduction to Cisco Umbrella

0:00Hello, and welcome to Introduction to Cisco Umbrella. In this skill, we're going to take a look at Cisco's cloud-based security offering, which is called Umbrella. We'll start by answering the question, "What is Umbrella?" and "How can it benefit our enterprise networks?" Then we'll take a look at the logic behind the traffic flow as Umbrella is trying to make a decision as to whether it should permit or deny specific traffic.

0:35Now all of this is part of what's called the SASE architecture. That is an architecture that Cisco has built Umbrella to fit into. So we'll see how the different components fall in from Cisco's perspective into the SASE architecture. Then we'll take a look at how to integrate this into SDWAN, because this is a feature that we're going to want to tie together with our SDWAN product. Finally, we'll wrap up with looking at how this integrates with cloud on-ramp for SaaS so that we can use this together with Umbrella to choose the best possible exit for applications from our network.

1:20So as you can hear, we have quite a bit to cover here, so let's go ahead and get started. I'll see you in the next video. [BLANK_AUDIO]

0:00So exciting news here, especially for those rainy days, Cisco has now joined other companies like Tots in making umbrellas. Wait, no, that's not right. No. Cisco now makes a product called Umbrella. Now joking aside, this is a cloud-based security product that we can use as a secure internet gateway for our SD-WAN environment when going out to cloud providers, particularly for features such as software as a service or SaaS.

0:38So let's spend just a moment getting acquainted with what Umbrella actually is and what features it brings to the table. So let's try to answer the question, what is Cisco Umbrella? Well, to start with, it is part of the Cisco Secure Access Service Edge or SaaS e. If you're not familiar with SaaSe, this is actually a term that was coined by a company called Gartner in 2019, and the way they define it is it's a network architecture that combines particularly security functions along with our WAN or wide area network capabilities and the goal is to support dynamic and secure access for the organization.

1:31And that's exactly what Cisco Umbrella does. Its job is to make it very difficult for attackers to gain access and infiltrate an organization. So of course, the real question comes in, how does it do that and how does this fit into our whole picture of connecting our Cisco devices into the cloud? Well it probably helps that Umbrella is itself a cloud delivered secure internet gateway or SIG.

2:06So what does all that really mean? Well what it means is we're going to provide our first line of defense. In other words, this is effectively going to be our firewall. And that is certainly one of its features. But it's a little bit more than that and we'll talk about that as we move through here. What's also cool is that this can actually protect users that are both inside and outside of the corporate network. It does this in several different ways.

2:37The first and of course probably the most important is it blocks any malicious internet destinations before a connection is established. So it actually prevents the connection from being established to begin with. It can do this by blocking unwanted domains, by blocking IP addresses that are known bad actors. So sites that you know are malicious or you don't want people to go to and it can even do it based on specific cloud applications.

3:11So there's a lot of different options here. Let's go ahead and take a look at some of its biggest key features. Basically how does it accomplish the things we just listed above? The first is probably its biggest feature, the DNS layer security. What exactly does that mean? Essentially it uses DNS. This is how it's actually preventing those connections from happening. If I don't resolve DNS requests to well known malicious sites, I can actually stop the traffic and of course if I stop it completely, that's going to stop it for all ports, protocols and again even direct to IP connections because we're not allowing the name lookup to begin with.

4:01Now the way we put Cisco umbrella in the middle of the path so to speak is we 're going to point the organization's DNS traffic to the Cisco umbrella global network. This then protects all your devices against threats because it's acting as your DNS server and this is how it's going to prevent those connections from occurring to begin with. Again, that's the final point here is that it actually blocks those requests to known malicious, unwanted or again bad acting domains and the key is before the connection is even established.

4:42So there's literally no chance for the bad actors to try to sneak in malicious traffic we never connect to begin with. So this is sort of that first layer of security. It also provides a secure web gateway. This is a pretty cool feature because it offers full visibility into all of the internet traffic across all your locations, your devices, your users, all of the devices in your SD WAN and really in your enterprise network because you're going to send all your traffic out to Cisco umbrella.

5:19And what's really cool about this feature is it's multi layered meaning it includes things like SSL inspection, URL filtering. It can even do sandboxing. So there's a lot of really cool features here. And again, we'll be digging into some of these more in the upcoming videos. This again is just our introduction. Now we already mentioned of course that this also includes a firewall. It's referred to as the CDFW or the cloud delivered firewall.

5:50This of course functions much like other firewalls where it will log and block all the traffic. And of course, like any other firewall, this can block based on the IP address, the port number, what protocols being used, and we can have rules to permit or deny any particular type of traffic we want. There's also a piece here called the cloud access security broker or CASB. Its job is to keep an eye on those SaaS applications specifically.

6:26Again it gives us visibility and control over those SaaS applications that we 're trying to access from inside of our enterprise. Another part of this feature is it helps manage and hopefully prevent the use of shadow IT. If you're not familiar with the term shadow IT, there's a definition given below this video for more complete answer. But essentially what it means is devices or cloud services that are being implemented by your users without necessarily the approval of the IT department.

7:02This is usually going to be for newer technologies that maybe your company hasn 't approved yet, but the users have decided that it's a cool feature and they want to use it. So again, maybe some sort of software as a service offering that you haven't approved yet, but your users have decided it would help them with their job and they just start using it. Well again, this can help discover that and manage, in other words, stop it from happening. So that's another pretty cool feature.

7:33There's another feature, interactive threat intelligence, which is Cisco umbrella investigate. And what this does is it gives us historical and real time view of different domains and IPs across the internet. And the cool thing is this allows us to predict, which is always an important feature, and prevent attacks. This is coming from insights. And what's really important about that is to understand where these insights are coming from.

8:06Since umbrella is a cloud service and it's being offered by Cisco, it can actually leverage Cisco's global network. And what does that give us an advantage of? Well, it gives us fast and reliable protection without sacrificing performance. The way it's able to do this is by using this global network to be more predictive and have a larger array of signatures of different types of attacks because it's using Cisco's global network, which of course has visibility into millions of different nodes and traffic types.

8:46And one final note here on the umbrella product, there are actually several different packages or bundles that are available for umbrella. There's a link down below to umbrella's product page so you can look at the different offerings and such that Cisco has with the umbrella product. So in this video, we jumped in and just got an introduction to Cisco's cloud based security offering umbrella. Now, over the next couple of videos, we'll spend some time digging into these features a little bit more and taking a closer look at how this fits into the rest of our model.

9:26Part of that is also going to be understanding how the traffic flow through the umbrella cloud offering actually works. So let's start by taking a look at that in the next video.

0:00So now that we've got a baseline knowledge down for Cisco umbrella, we know that it's far more than just the firewall. We know that it has several different components, including our DNS layer security, the secure web gateway, the cloud delivery firewall, which of course is still part of it. But the question then becomes, how does the traffic actually flow between these different components and make decisions as far as whether the traffic should be forwarded or not?

0:32Well, that's the purpose of this video. We're going to jump in and we're going to talk about how the traffic gets flowed logically between these different components and make the decision as to whether we're actually going to send the traffic or if it's going to be denied. So let's go ahead and take a look at that logical process. So of course, the very first thing that has to happen is the end user traffic has to actually get to umbrella umbrella. Umbrella of course can't do anything until the traffic arrives.

1:04Well, how's it going to do that? So it's going to do that through IP sec tunnels that are actually coming from the SD WAN devices that are connecting them to umbrella or through end point connectors, which are basically end workstations connecting directly into umbrella. Now once this traffic actually arrives at umbrella, umbrella has to identify it . And for the umbrella identities, we have several different things that can use for classification.

1:36It can classify based on the networks that the traffic is either coming from or going to. It can also identify traffic based on the users, so traffic coming from a particular user or from groups. So we don't have to do everything based on individual users. We can use groups. Once we've actually identified that traffic, that is then matched with destinations that the traffic is going to. Once that's determined, of course, we have to figure out what to do with the traffic.

2:11So we know what the traffic is. We know where the traffic's going. Then what we have to do is actually apply the proper policies. We have to look and see is this traffic supposed to be allowed or is it supposed to be denied? And this is sort of where the logic comes in, where we have to look at how the traffic is passed between the components. So let's take a closer look at that actual process. So as we mentioned in the previous video, the very first thing is we get a DNS request.

2:45This is where we hit our DNS layer security first. So of course, the first thing that has to happen is when we look at that identity and the destination, we have to figure out which DNS policy is going to actually apply. Then we're going to enforce the action either permit or deny that request. If we permit the request, we're going to send a DNS reply back to the requester . If we deny it, then we simply don't answer and the client can't initiate a connection because it has no name resolution.

3:20So if the action here is deny, that's essentially the end of the processing. However, if the action is to permit the traffic, the next thing we did was look to see if there's a firewall policy actually enabled. If there is, we're of course then going to route all of the permitted requests to the firewall. Once it gets to the firewall, of course, the firewall is going to do one of two things. That's sort of what firewalls do. First, it's either going to filter the request if we identify the traffic and see that it's going to be denied or we're going to forward that traffic and we forward it to the secure web gateway, which is the next component that the traffic is going to go to.

4:07And it's either going to use port 80 or port 443 depending on configuration. So to get to this point, the traffic has to be permitted by DNS layer security by the CDFW and then it gets passed to the secure web gateway. This is of course assuming that we have a web policy enabled as well. But if we do, it's going to go to that secure web gateway. Of course, it's going to receive that from either port 80 or port 443 one of the two.

4:41But either way, this traffic arrives at the secure web gateway, which just like the DNS policy and the firewall policy, we have to look at what the policy actions are. Once again, it's either going to be permit or deny. And just like our other policies, of course, if any of these are denied, that's the end of the process right there. The traffic is dropped. This whole thing stops and the client's been protected. However, if we have gotten to permit from the DNS request and we've gotten to permit from the firewall policy and we've gotten to permit from the web policy, the final step here is going to be actually allowing that traffic.

5:25And that traffic is then going to exit umbrella through network address translation or NAT. So as is common practice in most environments, we're of course going to be hiding the internal addresses behind an outside public address, which actually belongs to umbrella. So in this video, we just took a look at how the traffic flow logic works through the different components in Cisco umbrella. We saw how it first goes into our DNS layer security.

5:58And if that permits it, it then flows into the firewall. If it's permitted there, it then flows into the secure web gateway. And finally, if it's permitted by all three of those components, it then exits umbrella through the network address translation component. Now the next thing we want to look at is to take a closer look at that Saa architecture that we mentioned in the first video.

0:00So now that we've discussed the different umbrella components and how the traffic is passed between those components, let's focus in a little bit here on the Cisco Secure Access Service Edge or SASE architecture. This is important to understand, both from the standpoint of what is the architecture itself and how do the Cisco components fit into that architecture and then we 'll talk about the different advantages that the architecture brings to the enterprise network.

0:34So let's go ahead and jump in and take a closer look at the SASE architecture. So to begin, let's talk about how Cisco themselves actually define their architecture. And the way they describe it is it's combining our VPNs, our SD-WAN services, and our cloud-based security services into one common architecture. Of course, the cloud-based security services we're referring to here is umbrella.

1:07But before we actually get into all of the different Cisco components, let's talk about the SASE architecture itself. And this has been built around three major principles. We'll break these down one by one. The first one is the ability to connect. And connect, just like it sounds, is simply referring to connecting your networks to the various SAS applications out there on the web. Of course, connecting basically involves your networking.

1:39So this is going to be things like your LAN and WAN, SD-WAN itself, which of course is part of WAN. So remote access for remote users and ZTN or Zero Trust networking, all different ways that we can connect our enterprise out to these applications. Of course, we don't want to allow that connection to just happen without having control over it. So the second principle is to have control.

2:12And this is sort of right out of the definition for SASE, which is we want that control to be simplified and we're going to be doing it through policy enforcement. How? Well, we're going to do things like segmentation to keep traffic separate and isolated only with the components it needs to speak with. We already talked about DNS security. That's going to be part of this as well. Of course, the firewall. Also, the cloud access security broker.

2:44Remember we talked about that back during the introduction. This is what provides that visibility over SASE usage. And remember, it also helps stop that usage of shadow IT or unauthorized devices and services. This also includes the secure web gateway and possibly the use of encryption. All of this together, controlling what is allowed to talk to what in a very, very secure fashion using all of these different components.

3:18And our final principle is to converge. This is sort of going with this concept of combining here. The idea is we want to take our network and security, connect it all to a multi -cloud environment and be able to do it to a scale large enough to handle enterprise networks. Part of the simplification and advantage of this is being able to do this through a single vendor. Of course, in this instance, we're clearly talking about Cisco.

3:49We also want it to be able to be cloud managed. That's going to add to the simplification as well. We can do all of the management through a web interface, which we will see a little bit later. It's being offered as a service, of course, as a service from Cisco, but SaaC itself is offered as a cloud-based service. This is part of what allows umbrella to leverage Cisco's global network to get all of those different signatures and basically do its job in a much more effective manner because of the information available to umbrella.

4:25So here we did give some specific examples of each of these, however, understand that the three major principles are the connect, the control, and the convergence. So let's take a look at how Cisco implemented this into their architecture. Cisco's architecture actually has the following components. First, we have networking, which again is following right along with connecting . This is where we're going to include things such as SD-WAN, doing site-to-site VPNs, zero trust networking, four remote users, and various other components that connect all of this together.

5:05Also of course, we have the security component. And we've already talked about several of these pieces. Of course, we have the cloud-delivered firewall, we have intrusion prevention, we've spoken about our DNS security, the cloud access security gateway, the secure web gateway, and of course, many other components, some of which we've already talked about. And finally, visibility. We need to be able to see what's going on in our network. So part of the solution is going to be to offer end-to-end visibility, both into performance and security metrics.

5:42So we need to be able to see what's going on from the network perspective as well as security. We need to see if breaches are being attempted, if everything's being protected . We need to have reporting and metrics to be able to see what's happening. So to summarize some of the advantages here, what does SASE actually provide to the enterprise network? First, it provides a cloud networking and security stack that's actually delivered as a service in the cloud itself.

6:13Again, in this case, Umbrella being delivered by Cisco. And the other cool thing is this doesn't have to act as a replacement for more traditional enterprise-grade solutions for things like security and overall networking. It's going to work on top of those to add even more security to our network. So what are the things that it actually brings to the table that possibly we didn't have before? First, it establishes secure connections for accessing applications, data, and the internet for both remote workers, fixed locations, internet-facing devices, really any sort of workload that we have on our network.

6:59We also gain end-to-end observability to applications over any network or cloud . It also offers optimized performance to ensure the fastest, most reliable, and secure connection to the cloud. It also implements Zero Trust Network Access by verifying user identities and checking device health to secure application access on a per-session basis.

7:29And finally, it's going to increase your organization's agility. It leverages the cloud to simplify your infrastructure and to achieve scal ability, which is what's going to give us that agility. So overall, SASE brings a lot of things to the table. And again, Umbrella is Cisco's overall product family that fits into this architecture to be our secure internet gateway. So in this video, we simply talked about the SASE architecture, what it's meant to do, what it's meant to provide to the enterprise network, the advantages that it brings to the enterprise.

8:12And of course, we talked about some of the Cisco components that fit into this architecture as part of the Cisco Secure Access Service Edge. Next, let's take a look at how Umbrella, as a secure internet gateway, fits in to our SD WAN architecture. So let's take a look at how we bring these features together in SD WAN. [BLANK_AUDIO]

0:00So now that we've talked about what umbrella actually is, how it fits into Cisco's architecture, let's take a look at how we actually integrate this with SDWAN. Now depending on exactly your version of code, this can be either a little bit tricky or it can be really easy. So we're running fairly new code. We'll talk about the versions here in just a minute, but as long as you're running fairly modern code, this is going to be a very easy process.

0:32However, we still have to know how to do it. So let's go ahead and jump in. We'll take a look. So the way that we're going to be connecting SDWAN to our SASE, of course, specifically we're talking about umbrella, security on that gateway is we're going to be connecting using IP sec tunnels, the same way that we discussed in previous skills, how we would connect to any other gateway site that we're going to be using for our internet gateway.

1:04Now the cool thing is we actually support automatic tunneling to umbrella. However, in order to do this, we have to have V manage 20 dot five dot one or higher. Now remember in newer versions of code, it's actually SDWAN manager, but regardless of the name, we need to have at least version 20 dot five dot one or up. And for iOS X, it has to be 17 dot two dot one are.

1:37So as long as our code is newer than these, which in all honesty are a bit old at this point. So hopefully at the time you're watching this video, you have newer versions of code than this. The other cool thing is they added some other neat features in this code. First, it gives us a way to connect directly and easily to umbrella DNS security. So they added a quick, easy way to do that. And not only can we connect to umbrella, but they actually gave us the ability to support automatic tunneling also to Z scalar.

2:16Z scalar is another company that also offers S a S e services and they have the equivalent of a secure internet gateway along with several other products. But what's cool about this is Cisco added not just support for umbrella, but also for Z scalar. So you can actually use whichever one works best for your company. Now a couple cool features we support with these tunnels, we can actually configure a tracker to keep track if that interface is up or down so we can verify reach ability.

2:52And not that you necessarily need to, but just be aware, we already discussed the fact that these can be automatically configured tunnels, but you can manually configure them as well. And this would actually be required, of course, if you were using older versions of code. Now you can still do it on today's code, but we generally prefer to go with the automatic option these days since their systems already set up to do it. This integration also supports high availability.

3:22We do this very simply by configuring a pair of tunnels so that if one tunnel fails, the other one will hopefully keep operating. Some of the attributes of these tunnels by default, these support up to 250 meg abits per second and you can have up to 50 tunnels per customer. And of course, one advantage of having these multiple tunnels is we can either load share these with equal cost multipath thing.

3:54We can do that based on applications or we can just use them for failover like we mentioned up above with the high availability. And the final option, if 250 megabits per second is not enough, you can actually expand this capacity up to 500 megabits per second per tunnel. So now that we've talked about some of the attributes and features of these tunnels, let's jump into SD-WAN manager and take a look at where we would go to actually configure this.

4:28So starting off here on the monitor overview page of SD-WAN manager, where we 're going to go to configure this, we're going to go to configuration, then we're going to go to templates under templates, we're going to go to feature templates. Then what we're going to want to do is add a new template under the select device. Since we're going to create this for the catalyst 8000 V, I'm just going to type this in to sort of shorten the list up. And then we'll go ahead and choose that box.

5:00As soon as we tell it what device it's for, it's going to give us these choices of which template type we want to create. But if we scroll down here a bit to VPN, notice of course there's a bunch of different choices here for the templates, but notice the very first one, the Cisco secure internet gateway or the SIG. If we click on this one, it's going to tell us that in order to do this, we need to create a SIG credentials template.

5:32Now there's actually two ways is telling us that. First, there's this big banner that comes up right away at the top, telling us that we need the credentials template. Plus, there's a link right down here that we can click on to create it. Now we need this because notice that currently the SIG provider is set to be umbrella. But also remember we mentioned you can do Z scalar. If I click Z scalar here, it doesn't really change anything in that it still wants the credentials template. Now if we click generic, this doesn't actually use the credentials template because you're going to have to configure that down below.

6:08Now this isn't exactly what we're here to look at right now, but just be aware this is an option to look at umbrella. We need to click back on umbrella. And then we're going to have to create this template. Now I don't actually have this set up. So I'm just going to put in my organization ID. And then for the registration key and secret, I'm just going to put in some numbers for now. Obviously this isn't going to work. So at this point, we're of course not going to actually be able to connect out to umbrella. But let's just go ahead and say save.

6:40So even though that's not actually a valid credential, it doesn't know that. So it lets us come in here and see what the rest of this would look like. Now like most things in SD when at this point, we would have to give the template a name so we could call it something like umbrella, give it a description. And if we scroll down and look at the rest of these settings, this is where we can set up things like our tracker. We can actually add a tunnel configuration. This is where we can configure the high availability.

7:12And there's some advanced settings here at the bottom where we can configure the umbrella, primary and secondary data centers. So as you can see, there's not really a whole lot to configure here. But this is where we would go to configure our feature template for umbrella to be used as our secure internet gateway. So in this video, we talked about how we can tie umbrella into our SD WAN environment. And as we saw, it's as simple as going in and adding a new feature template for our device.

7:47And then we choose which type of secure internet gateway we want to connect to either umbrella or zscaler, or of course, there was also a generic option that we would have to completely configure on our own. Next, let's take a look at how we can tie all this together with on RAM for Saa S.

0:00Now that we've seen how we can use our feature templates to configure these tunnels out to a secure internet gateway such as either Umbrella or Zscaler or maybe another option, what happens if we want to provide some sort of load sharing here? What if we have a connection to both and we would like our applications to choose the best path to get out to that particular provider? Well, the good news is, in a previous skill, we've already looked at a feature that does exactly that.

0:36Cloud on RAM for SaaS. And we can use that here to also choose the best path to go out to the internet through a secure internet gateway. There's just one little thing we have to change and that's what we're going to talk about in this video. So let's go ahead and take a look at how we can combine these two features of connecting doors to secure internet gateway and still using Cloud on RAM for SaaS.

1:07So let's just get a couple things out of the way before we get into combining these services. One of the requirements for this to really work properly is the STWAN edge routers should be configured to send all of the user traffic over to the secure internet gateway. Now when you do that, that's of course going to include all that SaaS traffic. This is why we want to get Cloud on RAM for SaaS involved in the process.

1:38When we get it involved, we can then use that automatic path selection that we 've talked about previously to be able to choose the best gateway tunnel to forward that application traffic on. That's our goal here. And another advantage is these tunnels could then also be used by our branch offices if that turns out to be their best path. So again, the overall idea behind this design is first we're still using the secure internet gateway, so we're going to be getting secure access to our applications.

2:18So we're still getting all the advantages of using something like umbrella. But then we're going to get the best path performance because we're using Cloud on RAM for SaaS. So essentially what we're saying is we're going to get all of the benefits of Cloud on RAM for SaaS while still using our secure internet gateway providers. And again, that could be umbrella or Zscaler or one of the generic solutions.

2:52And there's really only one caveat to this because we've been over this conversation before talking about Cloud on RAM for SaaS. The caveat is how we're actually going to monitor this tunnel. In order for this to work, you're going to have to enable layer seven health checks on this tunnel. And the way we do that is to simply configure the tracker source address and a tunnel tracker.

3:24And where we configure that is in the security template or the feature template that we're using for our secure internet gateway. So let's just jump back over to SDWAN and take a look at where that actually gets configured in our feature template. So here we are in our feature template for the Cisco secure internet gateway. And what we need to do to complete this is first we need to put in a source IP address. So here in the source address, we'll put in one of our inside addresses that we want to use for the source.

3:59Then we click new tracker and here we have to provide some information. So first we have to give it some sort of a name. We could just call it something like tunnel one. And then you also have to provide some sort of an end point. And here is where you would put the API URL of the end point that you're trying to check with this tracker. So this is how we would enable those layer seven health checks. In this video, we talked about combining two of our really cool features.

4:33First using a secure internet gateway such as umbrella. And second using that together with cloud on ramp for SaaS to then dynamically choose the best path exit. Just remember, in order to do that, you do have to enable the layer seven health checks for the tunnel, which we do here with a tunnel tracker. So that covers everything that we need to discuss in this skill that leaves us with just the challenge.

5:04So go ahead and tackle that challenge. I'll see you in the solution video on the other side. [BLANK_AUDIO]

0:00In this challenge, we're asked to answer a series of questions to verify our understanding of the concepts of Cisco umbrella. So let's go ahead and get started. Here in our first question, what unique method does Cisco umbrella use to provide the first line of defense against threats on the internet? So let's go down through the answers here. The first one is behavioral analysis.

0:31This is not going to be a correct answer. Next is manual URL blocking, which although it can do that, that's not exactly a unique method for Cisco umbrella. Many other products do that. So I would say that's probably an incorrect answer. If nothing else is better, we can come back and change this DNS layer security. Now that is a unique method for Cisco umbrella. So that's probably a good answer, but let's verify the last one signature based anti virus.

1:05This is actually not a feature offered by Cisco umbrella. So this is going to leave our correct answer as DNS layer security. That is a feature that's available through Cisco umbrella. That's not a very common feature among security devices. Next question, which Cisco umbrella feature offers full visibility into internet activity across all locations and users. So going down our answers, first we have the secure web gateway.

1:38That actually sounds like a good answer. We know that's one of the components of umbrella and that it does in fact offer full visibility. But let's verify our other answers before we say that that's our correct answer . Next is VPN service. This is not going to be one of the answers as far as visibility into internet activity. Same with data loss protection. This is not something that's going to offer visibility and the intrusion prevention system.

2:09These are designed to stop certain types of attacks. And although they may offer some visibility, I don't think that's what we're looking for here. We're going to say that our best answer is going to be the secure web gateway because the way the question is worded, that is exactly what the secure web gateway does. Next question, how does Cisco umbrella enhance its threat intelligence? So our first answer is through partnerships with local ISPs only.

2:40That's not a correct answer. That is not how they get their intelligence utilizing a global network to analyze and learn from internet activity. That sounds like a good answer. But again, let's check the rest first by relying solely on user reported data. That would actually be a pretty poor way to do it. User provided data is often unreliable using historical data without real time analysis. Well, of course, historical data isn't necessarily bad, but we would want real time analysis.

3:17So in this case, again, our best answer is going to be utilizing a global network specifically Cisco's to analyze and learn from internet activity. And again, that's part of why umbrella is so powerful because Cisco being a large networking company sees a lot of traffic to build this threat intelligence off of. Final question, which deployment feature makes Cisco umbrella quick and easy to implement across an organization?

3:51So our first answer is manual configuration of each endpoint. Well, that would not make it quick and easy. So that's definitely not going to be a correct answer. The use of proprietary Cisco hardware. Well, this doesn't use any form of specific Cisco proprietary hardware. So that's not going to be correct. The need for complex onsite configurations. Well, when the question says quick and easy, somehow I don't think any answer with the word complex in it is going to be the correct answer.

4:25So clearly, we're going to be looking for the answer DNS redirection. As we stated at the beginning of the conversation about umbrella, all we have to do to implement this into our environment is to point our DNS servers to Cisco umbrella. That's the DNS redirection. So that concludes this quiz. If you find that you were unable to answer any of these questions, I would encourage you to go back and review those sections in the skill above.

4:55Otherwise, congratulations on completing introduction to Cisco umbrella. I hope this has been informative for you and I'd like to thank you for viewing. [BLANK_AUDIO]