Dual NIC on windows client breaks Cisco Umbrella SIG

[upllopyeret]

Hi All

We've been testing if it's possible to break Umbrella on a Windows clients, and what we've found out is that if there's multiple NICs available, it's possible to disconnect the first NIC and then pass traffic on the second NIC to bypass Umbrella. No admin creds needs, just physical disconnects.

I can't find any documentation on Umbrella and dual NICs on a client, and how to prevent this.

Any thoughts?

[Ken Stieers]

Replied to your reddit post too...

Newer builds use TND to catch that. Upgrade to 5.1.4.74 or later.
Release Notes for Cisco Secure Client (including AnyConnect), Release 5.1 - Cisco<>

Ken