Cisco Umbrella - Virtual Appliance blocking internal queries

[Jaywoo]

I have a certificate-based device that is attempting to query an internal web server.  The device is on DHCP and using the Umbrella VAs for DNS.  When we point the device statically to the internal DNS servers, the request successfully goes through.  What would cause the VAs to block an internal request?  Is there any way to troubleshoot this from within one of the VAs?  Their CLI seems pretty limited.

[Rob Ingram]

Hi,

Is it only this 1 device that is unable to query that webserver when using the VA as the DNS server?

Is the domain of the webserver defined as a "domain" within the Umbrella Cloud dashboard? Therefore all queries for that internal domain would be forwarded to your internal DNS server rather than be resolved by the Umbrella cloud DNS servers.

HTH

[Jaywoo]

Correct, only that 1 device. The domain is defined as well. I tried to perform some nslookups from the VAs but was only able to query our local DNS servers. As forwarders, shouldn't the VAs have the ability to lookup other hostnames?

[Rob Ingram]

You can use the "dig" command on the VA CLI.

Also run nslookup on the endpoint device and see what the output is.

You could also run a packet capture from the client end (between the client and the VA) and see what the output is.

HTH

[AlfredWilliams16140]

My organization is considering Cisco's Umbrella. We are a smaller organization at about 1000 employees spread across about 40 branches. We currently back-haul our branch traffic, but are in the process of migrating to a split-tunnel approach.

VidMate TeaTV Shareit