ISE Integration with Umbrella

[robinwhi]

Hello

I am interested to know if ISE can be used to control policy within Umbrella. Umbrella can hold profiles for different user groups for, say, corporate and guest users. If a guest user connects via a WLC can ISE provide the profile details to Umbrella so that their DNS access is limited to a subsection of URL destinations?

Thanks

Rob

[Jason Kunst]

No current integration that I know of but will double check

please reach out to umbrella team for this enhancement

[robinwhi]

Looks like Umbrella relies on the WLC providing the group information to it, so that it confirms which profile a user is in, but I guess ISE can not populate this on the WLC?

[Jason Kunst · Accepted solution]

I am not aware of this integration or what group you’re referring to

The best way for this to work is for umbrella to be able to consume pxgrid information for a scalable group tag to use in its policy

Please reach out to Umbrella team to work with ISE team

I am currently checking with our product managers

[Jason Kunst]

I also reached out to our PM enoy to see if something like this exists.

[Craig Hyps]

We are working with Umbrella team but nothing which can be discussed at this time in public forum.  We do work indirectly today via RADIUS and pxGrid.  For example, users can be authorized to WLC and WLC integrate role assignments to Umbrella.  Similarly, ISR can receive Passive/Active identity via pxGrid and communicate that for Umbrella integration.

Craig

[r_wideman]

Craig, Do you have any updates for this?  I do have ISE and WLC (8.5) and would like to see deeper integration.

[hslai]

I would suggest to check out materials such as Cisco Umbrella WLAN Integration Guide - Cisco

[riwakefi]

The Radius and WLC route seems to only work if you're pointing users to the cloud DNS IP addresses 208.67.220.220 & 208.67.222.222, or forcing them to the cloud IPs using FORCED mode. Most of my customers are going the local Umbrella VA route and there doesn't appear to be a way to "tell" the WLC that the local VAs the users are hitting are actually Umbrella servers. We're still testing this, but not looking good so far...

https://docs.umbrella.com/deployment-umbrella/docs/6-local-dns-forwarding