topic Re: Cisco Umbrella in Endpoint Security

Cisco Umbrella

LovejitSingh1313 — Fri, 22 Jan 2021 22:02:12 GMT

What is Cisco Umbrella, How it can enhance Security of Endpoint/Network?

Thanks

Re: Cisco Umbrella

balaji.bandi — Fri, 22 Jan 2021 23:13:07 GMT

https://umbrella.cisco.com/why-umbrella/top-reasons-to-trial

Re: Cisco Umbrella

Mohammed al Baqari — Sun, 24 Jan 2021 11:44:46 GMT

Hi,

In short its DNS security which can enhance web security of the endpoint by
inspecting DNS queries and apply security filtering policies to block or
allow the DNS query.

There are advanced packages which can provide Secure Web Gateway, i.e. web
proxy in cloud, CASB for cloud apps, File inspection in cloud, etc.

Here are the different flavors.

https://umbrella.cisco.com/products/umbrella-enterprise-security-packages

***** please remember to rate useful posts

Re: Cisco Umbrella

LovejitSingh1313 — Mon, 25 Jan 2021 02:45:50 GMT

Hello @balaji.bandi @Mohammed al Baqari @Richard Burts @Marvin Rhoads @Marius Gunnerud @Rob Ingram

I totally understand the concept that Cisco Umbrella provides DNS security and did not resolve anything to blacklisted servers and it can also provide cloud base Web Filtering.

How we can configure that?

I can think setting up root DNS server on local DNS to forward all DNS requests to umbrella. Is it correct ?

Also how we can forward all Web (HTTP/HTTPS) traffic to Umbrella, what needs to be done on local Firewall to accomplish that ?

What benefits does Roaming client else then enforcing DNS server to OPENDNS?

What benefits Umbrella AD Connector provide?

Thanks

Re: Cisco Umbrella

Mohammed al Baqari — Mon, 25 Jan 2021 06:12:20 GMT

Hi,

How we can configure it?

It depends on your deployment whether you are using it on 4k routers,
roaming client, vManager, etc.

This guide for roaming clients and virtual appliances.

https://docs.umbrella.com/deployment-umbrella/docs/3-deployment-guidelines

This is the integration guide for all supported integrations (WLC,
9200/9300, ASA, DNAC, etc)

https://docs.umbrella.com/hardware-integrations/docs/integration-for-isr-4k-and-isr-1100-security-configuration-guide

To forward HTTP and HTTPS traffic, you need to have the license
(Advantage or SIG) as I shared earlier in the post. In addition, follow the
guides to configure integration and traffic forwarding to Umbrella Cloud.
You need to work closely with Cisco on this to make sure that you are
forwarding it to the closet tower for better user performance. You don't
want users in Beijing to forward to US (that is very poor performance).

Look at the license comparison link, it has all the required features
assigned with each license package. You can have web filtering and content
inspection, file inspection, API integration, CASB (still in early stages),
etc.

Here is the licensing link again.

https://umbrella.cisco.com/products/umbrella-enterprise-security-packages

**** please remember to rate useful posts

Re: Cisco Umbrella

Marvin Rhoads — Mon, 25 Jan 2021 08:37:37 GMT

Using Umbrella without licensing is possible but you only get the bare minimum - DNS services plus blocking the worst of the worst lookups.

If you want any policy creation and enforcement as well as reporting then you need Umbrella licenses. As @Mohammed al Baqari mentioned they are available in several tiers - from basic DNS security up through cloud-based firewall (SIG) as well as API-based integration with other products (Cisco and other vendors).

Re: Cisco Umbrella

balaji.bandi — Mon, 25 Jan 2021 11:04:11 GMT

There is many different way to look each product and what you looking, umbrella tech team more helpofull, if you can reach local partner, they can install for you demonstrate, so you see and belive and explore the option and question can be clarifed.

with umbrella you get many advanced features of security and integrate with exiting kit.