Cisco Umbrella

[LovejitSingh1313]

What is Cisco Umbrella, How it can enhance Security of Endpoint/Network?

Thanks

[balaji.bandi]

https://umbrella.cisco.com/why-umbrella/top-reasons-to-trial

[Mohammed al Baqari]

Hi,

In short its DNS security which can enhance web security of the endpoint by
inspecting DNS queries and apply security filtering policies to block or
allow the DNS query.

There are advanced packages which can provide Secure Web Gateway, i.e. web
proxy in cloud, CASB for cloud apps, File inspection in cloud, etc.

Here are the different flavors.

https://umbrella.cisco.com/products/umbrella-enterprise-security-packages

***** please remember to rate useful posts

[LovejitSingh1313]

Hello @balaji.bandi  @Mohammed al Baqari  @Richard Burts   @Marvin Rhoads  @Marius Gunnerud @Rob Ingram 

I totally understand the concept that Cisco Umbrella provides DNS security and did not resolve anything to blacklisted servers and it can also provide cloud base Web Filtering.

How we can configure that? 

I can think setting up root DNS server on local DNS to forward all DNS requests to umbrella. Is it correct ?

 Also how we can forward all Web (HTTP/HTTPS) traffic to Umbrella, what needs to be done on local Firewall to accomplish that ?

What benefits does Roaming client else then enforcing DNS server to OPENDNS?

What benefits Umbrella AD Connector provide?

Thanks 

[Mohammed al Baqari · Accepted solution]

Hi,

How we can configure it?

It depends on your deployment whether you are using it on 4k routers,
roaming client, vManager, etc.

This guide for roaming clients and virtual appliances.

https://docs.umbrella.com/deployment-umbrella/docs/3-deployment-guidelines

This is the integration guide for all supported integrations (WLC,
9200/9300, ASA, DNAC, etc)

https://docs.umbrella.com/hardware-integrations/docs/integration-for-isr-4k-and-isr-1100-security-configuration-guide

To forward HTTP and HTTPS traffic, you need to have the license
(Advantage or SIG) as I shared earlier in the post. In addition, follow the
guides to configure integration and traffic forwarding to Umbrella Cloud.
You need to work closely with Cisco on this to make sure that you are
forwarding it to the closet tower for better user performance. You don't
want users in Beijing to forward to US (that is very poor performance).

Look at the license comparison link, it has all the required features
assigned with each license package. You can have web filtering and content
inspection, file inspection, API integration, CASB (still in early stages),
etc.

Here is the licensing link again.

https://umbrella.cisco.com/products/umbrella-enterprise-security-packages

**** please remember to rate useful posts

[balaji.bandi · Accepted solution]

There is many different way to look each product and what you looking, umbrella tech team more helpofull, if you can reach local partner, they can install for you demonstrate, so you see and belive and explore the option and question can be clarifed.

with umbrella  you get many advanced features of security and integrate with exiting kit.

[Marvin Rhoads · Accepted solution]

Using Umbrella without licensing is possible but you only get the bare minimum - DNS services plus blocking the worst of the worst lookups.

If you want any policy creation and enforcement as well as reporting then you need Umbrella licenses. As @Mohammed al Baqari mentioned they are available in several tiers - from basic DNS security up through cloud-based firewall (SIG) as well as API-based integration with other products (Cisco and other vendors).