topic Re: Unable to remove Umbrella DNS from Inspection in FMC in Network Security

Unable to remove Umbrella DNS from Inspection in FMC

Michael Bartholomæussen — Fri, 15 Sep 2023 09:33:31 GMT

Hi All,

I need to remove our Umbrella DNS policy from the Inspection part of a Acces Control Policy.

Setting the Umbrella policy to "None", the deployment fails.

I'm only able to apply a different policy, but not remove it entirely.

FMC >> vpn-addr-assign local
FMC >> policy-map type inspect dns preset_dns_map
FMC >> parameters
FMC >> no umbrella device-id 010a05988689d935
dk-dc-transit-ftd-dc01 >> [error] :
no umbrella device-id 010a05988689d935
^
ERROR: % Invalid input detected at '^' marker.
Config Error -- no umbrella device-id 010a05988689d9

Cheers

Re: Unable to remove Umbrella DNS from Inspection in FMC

Marius Gunnerud — Fri, 15 Sep 2023 10:10:43 GMT

Hmm strange. What version FMC are you using?

You could try to create a new Umbrella DNS policy, select it and deploy, and then once that is completed, try selecting None again.

Re: Unable to remove Umbrella DNS from Inspection in FMC

Michael Bartholomæussen — Fri, 15 Sep 2023 10:32:10 GMT

I tried to apply a new policy, with the default, but the Umbrella connector is still there, so it routes the quires to Umbrella Cloud

Version 7.3.1 (build 19)

Model

Secure Firewall Management Center for VMware

Serial Number

None

Snort Version

2.9.21 (Build 1000)

Snort3 Version

3.1.36.100 (Build 2)

Rule Pack Version

2890

Module Pack Version

3266

LSP Version

lsp-rel-20230912-1032

VDB Version

build 371 (2023-09-01 16:01:22)

Rule Update Version

2023-09-12-001-vrt

Geolocation Update Version

Country Code: 2023-08-17-100, IP: 2023-08-17-100

Cisco Firepower Extensible Operating System (FX-OS) 2.13.0 (build 1022)

Re: Unable to remove Umbrella DNS from Inspection in FMC

Michael Bartholomæussen — Sat, 16 Sep 2023 12:53:01 GMT

UPDATE:

We spend some more time troubleshooting this issue, and discovered that everytime a new Domain bypass is created on the Umbrella Policy, an additional line "domain local bypass" is added to the "Global Umbrella" CMD. These no validation on this in the FMC GUI, and the value in the GUI cannot be "BLANK". We added "none" to the bypass list, and "none" was listed as a domain to be bypassed.

With Flexconfig we managed to remove the bypass config from the LINA code. We also tried to remove "umbrella device-id 010a05988689d9352" with Flexconfig but it failed. We did notice additional whitespace in the commandlet in the configuration.

Re: Unable to remove Umbrella DNS from Inspection in FMC

mmcphee — Wed, 04 Oct 2023 19:32:21 GMT

I am having the exact same issues - cdFMC is on version 7.4, while the 2110 is on 7.3.1. Unable to resolve via Flexconfig and cdFMC.

Re: Unable to remove Umbrella DNS from Inspection in FMC

ste.ant — Mon, 25 Mar 2024 13:23:47 GMT

I'm running FMC and FTD 1150 at 7.2.5.1 and I am experiencing the same issue.

Re: Unable to remove Umbrella DNS from Inspection in FMC

Michael Bartholomæussen — Tue, 26 Mar 2024 10:02:11 GMT

We had the issue resolved via a TAC case, unfortunately!

Re: Unable to remove Umbrella DNS from Inspection in FMC

bill.whelan — Fri, 02 Aug 2024 18:31:38 GMT

I ran into the same issue when attempting to removing the Umbrella connector feature while troubleshooting DNS issues that some Anyconnect users were experiencing. Just curious what was the underlying issue that led you to try and remove it.

Re: Unable to remove Umbrella DNS from Inspection in FMC

ste.ant — Fri, 02 Aug 2024 19:04:08 GMT

Hi, I had to involve TAC, they connected to my FTD devices and removed the Umbrella config using a process that a Cisco customer can not.

Re: Unable to remove Umbrella DNS from Inspection in FMC

danjaxdulin5 — Mon, 03 Feb 2025 17:14:27 GMT

I'm having the same issue.

Do you recall the process that TAC used? or the TAC case number so that I can share with my TAC who doesn't know how to remove it?

Re: Unable to remove Umbrella DNS from Inspection in FMC

bill.whelan — Mon, 03 Feb 2025 18:27:50 GMT

After upgrading to 7.4.x we were able to remove the Umbrella integration and re-deploy with no issues.

If upgrading is not an option you might try using the "LinaConfig" tool to remove the Umbrella config from FTD CLI, removing the relevant Umbrella config in the FMC and re-deploying.

Re: Unable to remove Umbrella DNS from Inspection in FMC

bill.whelan — Mon, 03 Feb 2025 23:17:18 GMT

After upgrading to 7.4.x we were able to remove the Umbrella integration
and re-deploy with no issues.
If upgrading is not an option you might try using the "LinaConfig" tool to
remove the Umbrella config from FTD CLI, removing the relevant Umbrella
config in the FMC and re-deploying.

Re: Unable to remove Umbrella DNS from Inspection in FMC

Marvin Rhoads — Tue, 04 Feb 2025 13:09:32 GMT

Indeed. This is caused by the following bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi79393

It is fixed in, among others, 9.20(2.22) and later.

FTD 7.2.9 will also fix it: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/720/threat-defense-release-notes-72.html

The LINA code bundled in FTD 7.4.2 is 9.20(2.32). Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/threat-defense-compatibility.html#id_67425