Cisco Umbrella Integration: Настройка и руководство пользователя (EN)

Restrictions for Cisco Umbrella Integration

Configuring Cisco Umbrella Integration The Cisco Umbrella Integration feature enables cloud-based security service by inspecting the Domain Name System (DNS) query that is sent to the DNS server through the device. The security administrator configures policies on the Cisco Umbrella portal to either allow or deny traffic towards the fully qualified domain name (FQDN). The Cisco switch acts as a DNS forwarder on the network edge, transparently intercepts DNS traffic, and forwards the DNS queries to the Cisco Umbrella portal.

Prerequisites for Cisco Umbrella Integration, on page 1 Restrictions for Cisco Umbrella Integration , on page 1 Information About Cisco Umbrella Integration, on page 2 How to Configure Cisco Umbrella Integration, on page 8 Configuration Examples for Cisco Umbrella Integration, on page 13 Verifying the Cisco Umbrella Integration Configuration, on page 14 Troubleshooting Cisco Umbrella Integration, on page 15 Additional References for Cisco Umbrella Integration, on page 16 Feature History for Cisco Umbrella Integration , on page 16 Prerequisites for Cisco Umbrella Integration • Cisco Umbrella subscription license must be available.

Go to https://umbrella.cisco.com/products/packages and click Request a quote to get the license. • Communication for device registration to the Umbrella server is through HTTPS. This requires a root certificate to be installed on the device. You can download the certificate using this link: https://www.digicert.com/CACerts/DigiCertSHA2SecureServerCA.crt . • Get the API key, organization ID, and secret key or the token from the Cisco Umbrella registration server. You can download the certificate using this link: https://letsencrypt.org/certs/isrgrootx1.pem . Restrictions for Cisco Umbrella Integration • Cisco Umbrella Integration does not work in the following scenarios:

• If an application or host uses IP address instead of DNS to query domain names. • If a client is connected to a web proxy and does not send DNS query to resolve the server address. Configuring Cisco Umbrella Integration 1

Стр. 1

Cloud-Based Security Service Using Cisco Umbrella Integration

• If DNS queries are generated by a Cisco Catalyst device. • If DNS queries are sent over TCP. • If DNS queries have record types other than address mapping and text. • DNSv6 queries are not supported. • DNS64 and DNS46 extensions are not supported. • Extended DNS conveys only the IPv4 address of the host, and not the IPv6 address. • Network Address Translation (NAT) is not supported on interfaces that has Cisco Umbrella enabled on it. • The umbrella in and umbrella out commands cannot be configured on the same interface. Both these commands are not supported on the management interface and can be configured on a port basis only. • DNS packet fragmentation is not supported.

• QinQ and Security Group Tag (SGT) packets are not supported. • For Cisco Umbrella Active Directory Integration, if an interface does not have the umbrella in command enabled before a user is successfully authenticated, the username information is not sent with the DNS queries, and the default global policy may apply to such DNS queries. • Cisco Umbrella registration and redirection can take place only on global virtual routing and forwarding (VRF). Connecting to the Umbrella server through any other VRF is not supported. • Cisco Umbrella configuration commands can be configured only on L2, L3 physical ports, and switch virtual interfaces (SVIs).

The commands cannot be configured on other interfaces such as port channels. Information About Cisco Umbrella Integration The following sections provide details about the Cisco Umbrella Integration feature. Benefits of Cisco Umbrella Integration Cisco Umbrella Integration provides security and policy enforcement at the DNS level. It enables the administrator to split the DNS traffic and directly send some of the DNS traffic to a specific DNS server that is located within the enterprise network. This helps the administrator to bypass the Cisco Umbrella Integration.

Cloud-Based Security Service Using Cisco Umbrella Integration The Cisco Umbrella Integration feature provides cloud-based security service by inspecting the DNS query that is sent to the DNS server through a Cisco device. When a host initiates the traffic and sends a DNS query, the Cisco Umbrella Connector in the device intercepts and inspects the DNS query. The Umbrella Connector is a component in the Cisco device that intercepts DNS traffic and redirects it to the Cisco Umbrella cloud for security inspection and policy application.

The Umbrella cloud is a cloud-based security service that inspects the queries received from Umbrella Connectors, and based on the Fully Qualified Domain Name (FQDN), determines if the content provider IP addresses should be provided or not in the response. Configuring Cisco Umbrella Integration Information About Cisco Umbrella Integration Configuring Cisco Umbrella Integration 2

Стр. 2

Cloud-Based Security Service Using Cisco Umbrella Integration

If the DNS query is for a local domain, the query is forwarded without changing the DNS packet to the DNS server in the enterprise network. The Cisco Umbrella Resolver inspects the DNS queries that are sent from an external domain. An extended DNS record that includes the device identifier information, organization ID, client IP address, and client username (in hashed form) is added to the query and sent to the Umbrella Resolver. Based on all this information, the Umbrella Cloud applies different policies to the DNS query.

The Cisco Umbrella Active Directory Connector retrieves and uploads user and group information mapping at regular intervals from the on-premises active directory to the Umbrella Resolver. On receiving DNS packets, the Umbrella Cloud applies the appropriate policy based on the preuploaded record of all the users and groups in the Umbrella Resolver. For more information on how to install the Cisco Umbrella Active Directory Connector, see the Active Directory Setup Guide . Note • Cisco Umbrella Active Directory Integration is configured by default if the Umbrella Connector is enabled on the device, and it does not need any additional commands to work.

• The Umbrella Connector automatically gets the username from the port-based authentication process and adds the username to every DNS query sent out by a user. For more information about port-based authentication process, see the chapter Configuring IEEE 802.1x Port-Based Authentication . Cisco Identity Services Engine (ISE) is a security policy management platform that provides secure access to network resources. Cisco ISE support is mandatory for the Cisco Umbrella Active Directory Connector to work. For more information on how this integration works, see Active Directory Integration with Cisco ISE 2.x .

The Umbrella Integration Cloud might take one of the following actions based on the policies configured on the portal and the reputation of the DNS FQDN: • Blocked list action: If the FQDN is found to be malicious or blocked by the customized enterprise security policy, the IP address of the Umbrella Cloud's blocked landing page is returned in the DNS response. • Allowed list action: If the FQDN is found to be nonmalicious, the IP address of the content provider is returned in the DNS response. • Greylist action: If the FQDN is found to be suspicious, the intelligent proxy unicast IP addresses are returned in the DNS response.

The following figure displays the traffic flow between the Umbrella Connector and the Umbrella Cloud: Configuring Cisco Umbrella Integration Cloud-Based Security Service Using Cisco Umbrella Integration Configuring Cisco Umbrella Integration 3

Стр. 3

Cloud-Based Security Service Using Cisco Umbrella Integration

Figure 1: Cloud-Based Security Service Using Cisco Umbrella Integration When the DNS response is received, the device forwards the response back to the host. The host extracts the IP address from the response, and sends the HTTP or HTTPS requests to this IP address. A hash of the username is sent in the DNS query as part of the EDNS record to the Umbrella servers. The following figure displays the traffic flow between the Umbrella Connector, Cisco Identity Services Engine, the Umbrella Active Directory Connector, and the Umbrella Cloud: Configuring Cisco Umbrella Integration Cloud-Based Security Service Using Cisco Umbrella Integration Configuring Cisco Umbrella Integration 4

Стр. 4