Hello fellow geeks. We are setting up Cisco Umbrella for our school district this year and have run into a snag.
We have the VA's and Connectors set up. It is pulling in all of our AD groups and users as it should. I have set up different policies and block/allow lists based on our user groups. When I run the policy tester against those AD groups it shows the correct policy is applied. In general Umbrella is working and filtering traffic.
My problem is that I still have to add Allowed websites to the Global Allow list for access to happen no matter what other Destination List is applied to the policy.
For example I have an Admin policy created. In that policy we have AD admin user group added in for the Identity and an Admin Allow/block list created and applied to the Admin Policy.
If I add an allowed site to the Admin Allow List the site will not go through even when the policy tester reads it should. I can only get the site to work if I add it in to the Global list. This will be an issue as we don't want everyone to access every site we may need to allow.
Can anyone shed some light on what I might be doing wrong with the Destination List enforcement?
UPDATE: We have this working properly now.
