Filter Content with Public Session Support (Managed Guest Session Support)

Chromebooks in public session mode can use Umbrella to filter malicious and inappropriate internet content using Public Session Support (Managed Guest Session Support).

Note: Public Session Support is also called Managed Guest Session Support by Google. The terms are used interchangeably in this document.

Table of Contents

• Prerequisites
• Enable a Public Session (Managed Guest Session)
• Update the Cisco Umbrella Configuration File
• Install Umbrella Chromebook Client in Your Public Session (Managed Guest Session)
• Monitor Public Sessions (Managed Guest Sessions) in Umbrella
• Create Policy for Chromebooks in Public Session Mode (Managed Guest Mode)

Prerequisites

• G Suite administrator account in order to log into admin.google.com.
• G Suite administration account must have Google Enterprise licenses equal to the number of Chromebooks running in public session.
• A valid Cisco Umbrella license. See Cisco Umbrella Packages.
• Chromebooks running Chrome OS v55 or later.
• Port 53 UDP must be accessible to 208.67.220.220 and 208.67.222.222
• The site https://registration.polaris.qq.opendns.com must be accessible.
• Umbrella Chromebook client version 1.3.0 or later.

Enable a Public Session (Managed Guest Session)

1. Enroll Chromebooks with your G Suite organization. See Enroll Chrome OS devices.
2. Create a public session (or managed guest session) for the enrolled ChromeOS device. See Managed guest session devices.
3. Move one or more ChromeOS devices into the Organization Unit (OU) that has managed guest session settings applied.

Update the Cisco Umbrella Configuration File

1. Navigate to Deployments > Core Identities > Chromebook Users and click Download.

2. Click Download and download the JSON file.
   Note: Save this file to a known location. The regToken value listed in this file is required during the installation of the Cisco Umbrella Chromebook client application.

3. Edit the configuration file to add the public session flag.

{
    "organizationInfo": {
        "Value": {
            "organizationId": 1234567,
            "regToken": "abcdefghijklmnop9876ABCDEFGHIJLL"
        }
    },
    "publicSession": {
        "Value": true
    }
}

4. Save the modified Umbrella Chromebook config file.

Install Umbrella Chromebook Client in Your Public Session (Managed Guest Session)

1. Log into https://admin.google.com.
2. Navigate to Device management > Chrome Management > Apps & Extensions.
3. Click App Management.

4. Select UCC Extension.
5. Click Managed guest sessions and then click the + icon.

6. Enter the Cisco Chromebook client app ID in the search box.

7. Select an organizational unit to apply the settings to and then enable Force install.

8. Click Save. The Umbrella Chromebook client extension deployment is deployed.
9. Repeat the previous steps, but select Umbrella Chromebook client app in step 4.
10. Upload the config file you previously downloaded and modified.
11. Click Save.

Monitor Public Sessions (Managed Guest Sessions) in Umbrella

When a Chromebook in public session mode is registered with Umbrella, DNS queries from the device appear in the Activity Search. The serial number of the Chromebook is used as its identifier in Umbrella. You can find the serial number for a Chromebook on the back of the device.

1. Navigate to Deployments > Core Identities > Chromebook Users.
   View the Chromebooks in public session mode from the Activity Search report.

Create Policy for Chromebooks in Public Session Mode (Managed Guest Mode)

Create a policy and add specific Chromebooks in public session mode to that policy.

1. Navigate to Policies > Management > All Policies and select Chromebooks.
2. Click Set & Return.

Enable Trusted Network Detection < Filter Content with Public Session Support > Remove Umbrella Chromebook Client Software