ESA Communicating with Cisco Umbrella

[fabc1]

Hi all.

Recently, we noticed our ESA is communicating with Cisco Umbrella via TCP port 443.
Based on our information, we are not using Cisco Umbrella services in our environment.
Thus, we are wondering why. Is our ESA required to communicate with Cisco Umbrella to fetch security engine updates.

Is anyone have facing the similar situation? appreciate your feedback thanksss

[Ken Stieers · Accepted solution]

Firewall rules it needs are here:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa15-0/user_guide/b_ESA_Admin_Guide_15-0/b_ESA_Admin_Guide_12_1_appendix_0101111.html

What IPs are you seeing it connect to?
If it's the 146.112.x numbers, that's Talos stuff, which is registered to OpenDNS... which is now Umbrella...

https://search.arin.net/rdap/?query=146.112.62.0

[fabc1]

hi Ken,

ahh that explains. Thanks for answering this bro! hope u have a good day ahead xx