topic Re: Umbrella proxying in Cloud Security

Umbrella proxying

skywalker_007 — Tue, 16 Feb 2021 11:37:56 GMT

Hello ,

I have an ASA cluster in AWS .

I have the roaming client on all my any connect users.

I am seeing a strange behaviour . Wheneevrr users are connected to any connect , umbrella is proxing many websites which it is not when users are not on anyconnect.

Like gitlab etc .

Is it normal or how to make both work same

Re: Umbrella proxying

Rob Ingram — Tue, 16 Feb 2021 11:49:49 GMT

@skywalker_007

Do you have a different policy rule for "Roaming Computers" compared to when they are not connected? If there are different policies with different rules that could explain it. Which license do you have?

Re: Umbrella proxying

skywalker_007 — Tue, 16 Feb 2021 11:54:26 GMT

Hi @Rob Ingram we have dns advantage.

You mean different security rule in umbrella or ASAv ?

Re: Umbrella proxying

Rob Ingram — Tue, 16 Feb 2021 11:59:24 GMT

Yes, Umbrella policy.

Re: Umbrella proxying

skywalker_007 — Tue, 16 Feb 2021 16:31:55 GMT

Hi Rob,

There is no difference except we block some extra categories like gamble , lottery etc.

Does this make difference ?

Re: Umbrella proxying

skywalker_007 — Wed, 17 Feb 2021 08:40:03 GMT

@Rob Ingram Not able to figure out why there is a difference

Re: Umbrella proxying

skywalker_007 — Wed, 17 Feb 2021 16:01:59 GMT

Anyone ? We have two policies - one is vpn and other is default .

In vpn policy , we are blocking more like gambling etc .

But some websites are being proxies while connected to vpn but not when not connected.

This is a strange behaviour . Don't think so related to policy.

Could be because of intelligent proxy or certificate ?

Or chaining ?

When connected to ASAv , the request goes to asa in AWS cloud .but we have already added the public IP of asa as known ip in umbrella.

The issue is proxying

Re: Umbrella proxying

skywalker_007 — Wed, 17 Feb 2021 17:01:59 GMT

as we are using full tunnel , can we enable the below option on umbrella

Disable umbrella module on Anyconnect full tunnel vpn

Re: Umbrella proxying

ameliascotts80938 — Tue, 13 Apr 2021 12:25:21 GMT

The intelligent proxy is the ability for Umbrella to intercept and proxy requests for malicious files embedded within certain so-called "grey" domains. Some websites, especially those with large user communities or the ability to upload and share files, have content that most users want to access while also posing a risk because of the possibility of hosting malware. Administrators don't want to block access to the whole "grey" domain for everyone but they also don't want your users to access files that could harm their computers or compromise company data.

https://docs.umbrella.com/deployment-umbrella/docs/what-is-the-intelligent-proxy