Deploy the Chromebook Client

The Cisco Security for Chromebook client allows you to enable DNS layer protection for Chromebook users.

Table of Contents

• DNS Layer Protection
• Deploy Cisco Security for Chromebook client
  • Umbrella Dashboard
  • Google Admin Console
    • Configure Default Template
    • Configure Managed Guest Session Template

DNS Layer Protection

For DNS layer protection, DoH (DNS over HTTPS) is used to send DNS queries to Umbrella resolvers. These DNS queries are sent using DoH templates, which capture the Chromebook identities. The Chromebook identities are hashed using a Salt value that you configure. Once the Salt is configured on the Umbrella console, you can copy the DoH templates, configure the Enterprise Policy on Google Admin Console and propagate the DoH templates to the Chromebooks.

Deploy Cisco Security for Chromebook Client

The Cisco Security for Chromebook client is deployed using the Umbrella dashboard and the Google Admin Console. Use the Umbrella Dashboard to configure the Salt value, get the URL for the DoH templates, and download the JSON file. Use the Google Admin Console to deploy the Cisco Security for Chromebook client. The configuration and deployment procedures take, approximately, 30 minutes.

Umbrella Dashboard

1. Navigate to Deployments > Core Identities > Chromebook Users and click Configure.

2. To enable DoH protection you need to configure the Salt value. To configure the Salt value, click Configure in the Define Salt row.

3. Enter the Salt value. The Salt value can be between 8 and 32 characters and can be a combination of letters and/or numbers. Special characters are not allowed.

📘

Note

The Salt value cannot be changed once it is saved and confirmed. You will need to raise a support ticket with Umbrella to change the Salt value.

4. Once the Salt value is configured, two DoH templates are created. The first template is the default template, which is used for all Managed Chromebooks. The second template is the Managed guest session template, which is used only for Managed guest session devices. Copy and save the configured Salt value and the DoH template URLs. They will be required later when deploying the Cisco Security for Chromebook client from the Google Admin console.

5. Click Configure and download the Chromebook Client Configuration file. Save this file to a known location.

Google Admin Console

You can configure the default and the managed guest session DoH templates using the Google Admin console.

Configure Default Template

1. Log into the Google Admin console.
2. Navigate to Devices > Chrome > Settings > Users & browser settings.
3. Cisco Security for Chromebook is in the process of transitioning from Manifest V2 to Manifest V3 for Chrome Extensions. In the meantime, Google recommends that you use the Manifest V2 Extensions Availability policy to ensure continued functioning of Manifest V2 extensions.
   To enable availability of Manifest V2 extensions:
   Filter settings for Manifest. The Manifest V2 Extension Availability setting is displayed.

4. Select the parent organizational unit on which you want to enable the Manifest V2 extension availability policy. Click Manifest V2 extension availability.
5. In the Configuration drop-down list, choose Enable manifest V2 extensions.

5. Filter settings for DNS. The DNS settings are displayed.

6. Select DNS-over-HTTPS and configure it to Enable DNS-over-HTTPS with insecure fallback.

7. Return to the Users & Browser Settings page. Select DNS-over-HTTPS with Identifiers.

8. Enter the URL of the Default DoH template and the Salt value copied from the Umbrella Dashboard in the earlier steps. Click Save.

📘

Note

The Salt value entered here should be the same as the Salt value entered in the Umbrella dashboard.

9. From Apps & Extensions, navigate to Users & browsers > Organizational Units.
10. Expand Organizational Units and choose the organization into which you want to deploy the Cisco Umbrella Unified Chromebook client.
11. Click the + (Expand) icon and choose Add from Chrome Web Store.

12. In the Chrome Web Store, navigate to Extensions and search for the Cisco Security Chromebook client extension using the ID jgnjaoilojahgagddnkeankieagghabk.

13. Click Select. The extension is added to the selected organization unit.
14. Copy the JSON file that you downloaded and paste it into the Policy for Extensions section.

📘

Note

The JSON configuration parameters, googleDirectoryService and vaIPs apply only to the Cisco Umbrella Chromebook client and not to the Cisco Security for Chromebook client.

📘

Important

If you have deployed the Cisco Umbrella Chromebook client, Block or Uninstall the Umbrella Chromebook App and Extension before you deploy the Cisco Security for Chromebook client.

15. Choose Force Install and then click Save.
    The Cisco Security for Chromebook client extension is installed. Force Install ensures that Chromebook users in the selected Organization Unit cannot remove or disable the extension.

16. Check if the Cisco Security for Chromebook Client is installed on the Chromebooks and if the old Umbrella Chromebook Client (App and Extension) is blocked.

17. Open the URL https://policy-debug.checkumbrella.com and verify if the device is being protected by Umbrella. For DNS customers, the message displayed is “You are protected by Cisco Umbrella DNS!”

It may take Google up to eight hours to push the Chrome extension to all your Chromebooks. After the client is installed in a Chromebook, allow a few hours for Chromebook traffic to begin appearing in your Umbrella dashboard.

📘

Note

Chromebooks must be connected and logged in.

Configure Managed Guest Session Template

1. Log into the Google Admin console.
2. Navigate to Devices > Chrome > Settings > Managed guest session settings.
3. Cisco Security for Chromebook is in the process of transitioning from Manifest V2 to Manifest V3 for Chrome Extensions. In the meantime, Google recommends that you use the Manifest V2 Extensions Availability policy to ensure continued functioning of Manifest V2 extensions.
   To enable availability of Manifest V2 extensions:
   Filter settings for Manifest. The Manifest V2 Extension Availability setting is displayed.

4. Select the parent organizational unit on which you want to enable the Manifest V2 extension availability policy. From the Configuration drop-down menu, select Enable Manifest V2 extensions.

5. Filter settings for DNS. The DNS settings are displayed.

6. Select DNS-over-HTTPS and configure it to Enable DNS-over-HTTPS with insecure fallback.

7. Return to the Managed guest session settings. Select DNS-over-HTTPS with Identifiers.

8. Enter the URL of the Managed Guest Session DoH template and the Salt value copied from the Umbrella Dashboard. Click Save.

9. From Apps & Extensions navigate to Managed Guest Session > Organizational Units.
10. Expand Organizational Units and choose the organization into which you want to deploy the Cisco Security for Chromebook client.
11. Click the + (Expand) icon and choose Add from Chrome Web Store.

12. In the Chrome Web Store, navigate to Extensions and search for the Cisco Security for Chromebook client extension using the ID jgnjaoilojahgagddnkeankieagghabk.

13. Click Select. The extension is added to the selected organization unit.
14. Change the publicSession value to true in the JSON file that you downloaded. Copy the JSON file and paste it into the Policy for Extensions section.

📘

Important

Ensure that you set the value of publicSession to true before copying the JSON file to the Policy for Extensions section.

15. Choose Force Install and then click Save.
    The Cisco Security for Chromebook client extension is installed. Force Install ensures that Chromebook users in the selected Organization Unit cannot remove or disable the extension.

📘

Important

If you have deployed the Cisco Umbrella Chromebook client, Block or Uninstall the Umbrella Chromebook App and Extension before you deploy the Cisco Security for Chromebook client.

16. Check if the Cisco Security for Chromebook client is installed on the Chromebooks and if the old Umbrella Chromebook Client (App and Extension) is blocked.
17. Open the URL https://policy-debug.checkumbrella.com and verify if the device is being protected by Umbrella. For DNS customers, the message displayed is “You are protected by Cisco Umbrella DNS!”

It may take Google up to eight hours to push the Chrome extension to all your Chromebooks. After the client is installed in a Chromebook, allow a few hours for Chromebook traffic to begin appearing in your Umbrella dashboard.

📘

Note

Chromebooks must be connected and logged in.

---

Integrate Google Workspace Identities > Deploy the Chromebook Client > Verify and Debug