Umbrella SWG with DNS protection - is this possible?

[PacketSpartan]

HI All, We're looking to deploy Umbrella with a IPsec tunnel from our DC to Umbrella.  

We'll either use a PBR based routing or  PAC file to route 80/443 traffic into this tunnel, this will provide SWG protection for 80/443. 

How do we provide DNS-based security to the above setup?

1. Would it be possible to route DNS (53) traffic via the IPsec Tunnel, alongside 80/443
2. If we point our DNS server (win) to Umbrella for external lookups, will this provide granular logs in the activity search with private IPs (We already have our ADs linked to umbrella) 

[diebarra · Accepted solution]

Hello!

DNS is supported within the tunnel for both Umbrella and non-Umbrella resolvers. To get visibility for users and internal IPs though you would need to deploy the virtual appliances.

Your windows servers under the network settings would have the DNS servers configured to be the VA, then the VA will automatically redirect to Umbrella or internal resolvers based on your dashboard "Internal Domain" list.

[PacketSpartan]

Thank you diebarra, it makes sense 
We need to have the VA's to have full visibility of the internal IPs 

So the 80/443 will go down the IPSec tunnel for SWG, the DNS traffic will hit the VAs and it will send it out to Umbrella (direct breakout if we dont want to use the tunnel). Our Windows DNS servers will also have its DNS pointed towards The VAs, which in return will forward it to the Umbrella cloud.