Umbrella and UTM URL filtering

[techno.it]

I have a UTM firewalls at the internet edge. All the web traffic from LAN is sent to the firewall using transparent and explicit modes.

Now we are evaluating Cisco umbrella with two virtual appliances.

For explicit mode user we would need to set the DNS on firewall to VA IPs and VAs are goint to send all DNS request to umbrella servers.

For transparent mode users, clients will send requests to internal DNS servers, then forward to VAs.

I understand recommend setup is to configure the DNS clients with VAs IP. But in my case, changing the DNS on clients is not possible now, perhaps it will be changed later.

Having said that, how do URL filtering categories are going to be handled when Cisco Umbrella and UTM are working in conjunction to each other.

Would love to have inputs.

[techno.it]

Any expert opinion please?

[adamwin]

The VAs aren't going to offer much benefit if you can't change the DNS settings on the clients. If the DNS queries have to hit another device first, the source IP of the clients will be hidden by the time the query is forwarded to the VA.

You're better off registering your egress IP address for the network and not using the VAs.