Cisco umbrella detection

[skywalker_007]

Hi,

As umbrella is dns security ,if someone access the malicious website by ip address and not the name , will umbrella detect/prevent  it ?

Also ,if someone uses a client like command line , filezilla to do ftp  etc ,will umbrella prvenet it.

The client machine has roaming client installed

[Rob Ingram]

@skywalker_007 

Yes, IP Layer Enforcement with the Umbrella Roaming Security client or AnyConnect Roaming Security Module.

https://docs.umbrella.com/deployment-umbrella/docs/6-adding-ip-layer-enforcementz

[skywalker_007]

Ok thanks @Rob Ingram .

We have a customer with 5 different brnach office and a central location where ASAv is installed . any connect is used as client vpn.

Customer has purchased umbrella advantage .

With this can we still see the actual ip addrss of client machine sitting in the office . 

For example I have a user with IP address 10.1.1.1 sitting in head office , can we see this ip on umbrella or is it only the public IP addrrss of ASAv ?

There is no VA

[Rob Ingram]

If you have the anyconnect roaming client, then yes the private IP address (i.e. 10.1.1.1) will be reported in the umbrella dashboard.

[skywalker_007]

Even if user is sitting in office and not connected to ASAv via anyconnect , the connection from.user machine having anyconnect (with roaming security module ) shows the actual ip address of the client and we can have different policies based on the internal ip address?

Here we are not talking about identities for which we need VA.

The goal is to have different policies based on Internal Ip address scheme

[Rob Ingram · Accepted solution]

Important: Policy cannot be set/enforced on the LAN IP returned by the roaming client. The inclusion of LAN IP is only for visibility and reporting purposes. By comparison, only with a VA and a ‘site’ and an ‘internal network’ identity can policy be enforced on LAN IP.

[skywalker_007]

Ok understood. Thanks @Rob Ingram 

So VA is necessary for internal ip policy enforcement.

Thanks you for quick response.