topic Re: Cisco umbrella detection in Cloud Security

Cisco umbrella detection

skywalker_007 — Mon, 11 Jan 2021 22:20:35 GMT

Hi,

As umbrella is dns security ,if someone access the malicious website by ip address and not the name , will umbrella detect/prevent it ?

Also ,if someone uses a client like command line , filezilla to do ftp etc ,will umbrella prvenet it.

The client machine has roaming client installed

Re: Cisco umbrella detection

Rob Ingram — Mon, 11 Jan 2021 22:25:14 GMT

@skywalker_007

Yes, IP Layer Enforcement with the Umbrella Roaming Security client or AnyConnect Roaming Security Module.

https://docs.umbrella.com/deployment-umbrella/docs/6-adding-ip-layer-enforcementz

Re: Cisco umbrella detection

skywalker_007 — Mon, 11 Jan 2021 22:39:04 GMT

Ok thanks @Rob Ingram .

We have a customer with 5 different brnach office and a central location where ASAv is installed . any connect is used as client vpn.

Customer has purchased umbrella advantage .

With this can we still see the actual ip addrss of client machine sitting in the office .

For example I have a user with IP address 10.1.1.1 sitting in head office , can we see this ip on umbrella or is it only the public IP addrrss of ASAv ?

There is no VA

Re: Cisco umbrella detection

Rob Ingram — Mon, 11 Jan 2021 22:43:43 GMT

If you have the anyconnect roaming client, then yes the private IP address (i.e. 10.1.1.1) will be reported in the umbrella dashboard.

Re: Cisco umbrella detection

skywalker_007 — Mon, 11 Jan 2021 22:47:21 GMT

Even if user is sitting in office and not connected to ASAv via anyconnect , the connection from.user machine having anyconnect (with roaming security module ) shows the actual ip address of the client and we can have different policies based on the internal ip address?

Here we are not talking about identities for which we need VA.

The goal is to have different policies based on Internal Ip address scheme

Re: Cisco umbrella detection

Rob Ingram — Mon, 11 Jan 2021 22:54:29 GMT

Important: Policy cannot be set/enforced on the LAN IP returned by the roaming client. The inclusion of LAN IP is only for visibility and reporting purposes. By comparison, only with a VA and a ‘site’ and an ‘internal network’ identity can policy be enforced on LAN IP.

Re: Cisco umbrella detection

skywalker_007 — Mon, 11 Jan 2021 22:57:05 GMT

Ok understood. Thanks @Rob Ingram

So VA is necessary for internal ip policy enforcement.

Thanks you for quick response.