Servers with Static IP - Umbrella protection

[dianawinskymartin]

We are using Umbrella SIG with a tunnel from the firewall, and we want to protect our servers with static IPs using Umbrella SIG without relying on roaming clients. However, we cannot change the DNS to Umbrella’s DNS because we have a local DNS setup. Is there another way to protect these servers with Umbrella?

[howe]

Yes - you can forward your local resolvers to Umbrella for public DNS queries, or you can use a virtual appliance (VA). The VA can be configured to pass local DNS queries to your local DNS server, and public DNS queries to the Umbrella resolvers. The advantage of the VA is that the internal IP is exposed in the reports and can be used to apply specific policies to IP address or subnets as required with internal networks. 

[dianawinskymartin]

If I use VA, does that mean I can create a policy for specific static IPs of servers? That's option 1

If I forward my local resolvers to Umbrella for public DNS queries, may I not see the internal IP for a particular server? And for the creation of its policy is by network or tunnel?

[edusalaz]

You are correct, for a deployment with VA, the VA will forward the internal IP of the DNS query to the Umbrella cloud, so you can create an internal network on the Umbrella portal and use it as an identity to apply policies for traffic coming from the VA.

If you use the local DNS with the forwarders option, you will not see the internal IP of the DNS queries, so to apply a policy you will use the network identity.

If you are forwarding the DNS directly to the internet using you public ip, you can register that public ip as a Network identity in the Umbrella portal.

If you are sending the DNS traffic to Umbrella using a VPN tunnel, you can register the Peer IP address (Public IP use by the tunnel on you side to Umbrella) of the tunnel as a network identity and use it to apply the DNS policies.

[dianawinskymartin]

Our setup was traffic pass through the tunnel, we dont have network identity registered because it encompasses the tunnel. We created tunnel from the fw to umbrella sig. 

[dianawinskymartin]

What will be the source of it  or the identity?