• If an application or host uses IP address directly instead of DNS to query domain names, policy enforcement is not applied.

• When the client is connected to a web proxy, the DNS query does not pass through the Cisco 1000 Series ISR. In this case, the connector does not detect any DNS request and the connection to the web server bypasses any policy from the Cisco Umbrella portal.

• When the Cisco Umbrella Integration policy blocks a DNS query, the client is redirected to a Cisco Umbrella block page. HTTPS servers provide these block pages and the IP address range of these block pages is defined by the Cisco Umbrella portal.

• User authentication and identity is not supported in this release.

• The type A, AAAA, and TXT queries are the only records that are redirected. Other types of query bypasses the connector. Cisco Umbrella Connector maintains a list of IP address that is known for malicious traffic. When the Cisco Umbrella roaming client detects the destination of packets to those addresses, it forwards those addresses to Cisco Umbrella cloud for further inspection.

• Only the IPv4 address of the host is conveyed in the EDNS option.

Before you configure the Cisco Umbrella Integration feature on the Cisco 4000 Series ISR, ensure that the following are met:

• The Cisco 4000 Series ISR has a security K9 license to enable Cisco Umbrella Integration.

• The Cisco 4000 Series ISR runs the Cisco IOS XE Denali 16.3 software image or later.

• Cisco Umbrella subscription license is available.

• The Cisco 4000 Series ISR is set as the default DNS server gateway and needs to ensure that the DNS traffic goes through the Cisco 4000 Series ISR.

• Communication for device registration to the Cisco Umbrella server is via HTTPS. This requires a root certificate to be installed on the router. To download this certificate directly from a link instead of pasting it in, you can find the certificate here: https:/​/​www.digicert.com/​CACerts/​DigiCertSHA2SecureServerCA.crt.

The Cisco Umbrella Integration feature provides cloud-based security service by inspecting the DNS query that is sent to the DNS server through Cisco 4000 Series ISRs. When a host initiates the traffic and sends a DNS query, the Cisco Umbrella Connector in Cisco 4000 Series ISR intercepts and inspects the DNS query. If the DNS query is for a local domain, it forwards the query without changing the DNS packet to the DNS server in the enterprise network. If it is for an external domain, it adds an Extended DNS (EDNS) record to the query and sends it to Cisco Umbrella Resolver. An EDNS record includes the device identifier information, organization ID and client IP. Based on this information, Cisco Umbrella Cloud applies different policies to the DNS query.

The Umbrella Integration cloud, based on the policies configured on the portal and the reputation of the DNS Fully Qualified Domain Name (FQDN) may take one of the following actions:

• If FQDN is found to be malicious or blocked by the customized Enterprise Security policy, then the IP address of the Umbrella Cloud's blocked landing page is returned in the DNS response. This is called a blacked list action at Umbrella Cloud.

• If FQDN is found to be non-malicious, then the IP address of the content provider is returned in the DNS response. This is called a whitelist action at Umbrella Cloud.

• If the FQDN is suspicious, then the intelligent proxy unicast IP addresses are returned in the DNS response. This is referred to as grey list action at Umbrella cloud.

When the DNS response is received, the ISR forwards the response back to the host. The host will extract the IP address from the response and send the HTTP / HTTPS requests to this IP.

Note	The intelligent proxy option has to be enabled in the Umbrella dashboard for the Umbrella Resolver to return the intelligent proxy unicast IP addresses in the DNS response when an attempt is made to access the domains in the grey list.

The DNS packet sent from the Cisco 4000 Series ISR to Cisco Umbrella Integration server must be encrypted if the EDNS information in the packet contains information such as user IDs, internal network IP addresses, and so on. When the DNS response is sent back from the DNS server, Cisco 4000 Series ISR decrypts the packet and forwards it to the host.

You can encrypt DNS packets only when the DNScrypt feature is enabled on the Cisco 4000 Series ISR.

Cisco 4000 Series ISR uses the following Anycast recursive Cisco Umbrella Integration servers:

• 208.67.222.222

• 208.67.220.220

• 2620:119:53::53

• 2620:119:35::35

The Figure 1 describes the Cisco Umbrella Integration topology.

Figure 1. Cisco Umbrella Integration Topology

Cisco Umbrella Integration provides security and policy enforcement at DNS level. It enables the administrator to split the DNS traffic and directly send some of the desired DNS traffic to a specific DNS server (DNS server located within the enterprise network). This helps the administrator to bypass the Cisco Umbrella Integration.

To configure Cisco Umbrella Connector on the Cisco ASR 1000 platform:

• Get the API token from the Cisco Umbrella registration server.

• Have the root certificate establish the HTTPS connection with the Cisco Umbrella registration server. Import the root certificate of DigiCert given below into the device using the crypto pki trustpool import terminal command.

-----BEGIN CERTIFICATE-----
MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C
AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY
aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6
Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1
oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD
QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh
xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB
CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl
5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA
8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC
2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit
c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0
j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
-----END CERTIFICATE----- 

enable
configure terminal
parameter-map type umbrella global
	token AABBA59A0BDE1485C912AFE472952641001EEECC
		
exit

To register the Cisco Umbrella tag, perform these steps:

1. Configure the umbrella parameter map as shown in the previous section.

2. Configure umbrella out on the WAN interface:

   interface gigabitEthernet 0/0/1
    umbrella out 

3. Configure umbrella in on the LAN interface:

   interface gigabitEthernet 0/0/0.4
    umbrella in mydevice_tag 

   Note	For Cisco 4000 Series ISRs, the length of the hostname and umbrella tag should not exceed 49 characters.

4. After you configure umbrella in with a tag using the umbrella in mydevice_tag command, the Cisco 4000 Series ISR registers the tag to the Cisco Umbrella Integration portal.

5. The Cisco 4000 Series ISR initiates the registration process by resolving api.opendns.com. You need to have a name server (ip name-server x.x.x.x) and domain lookup (ip domain-lookup) configured on Cisco 4000 Series ISR to successfully resolve the FQDN.

   Note	You should configure the umbrella out command before you configure umbrella in command. Registration is successful only when the port 443 is in open state and allows the traffic to pass through the existing firewall.

You can identify the traffic to be bypassed using domain names. In the Cisco 4000 Series ISR, you can define these domains in the form of regular expressions. If the DNS query that is intercepted by the Cisco 4000 Series ISR matches one of the configured regular expressions, then the query is bypassed to the specified DNS server without redirecting to the Cisco Umbrella cloud. This sample configuration shows how to define a regex parameter-map with a desired domain name and regular expressions:

Device# configure terminal
Device(config)# parameter-map type regex dns_bypass
Device(config)# pattern www.fisco.com
Device(config)# pattern .*engineering.fisco.* 

Attach the regex param-map with the openDNS global configuration as shown below:

Device(config)# parameter-map type umbrella global
Device(config-profile)# token AADDD5FF6E510B28921A20C9B98EEEFF 
Device(config-profile)# local-domain dns_bypass

When you configure the device using the parameter-map type umbrella global command, the following values are auto-populated:

• DNSCrypt

• Resover IP

• Public-Key

We recommend that you change the above parameters only when you perform certain tests in the lab. These parameters are reserved for future use. If you modify these parameters, it can affect the normal functioning of the device.

Resolver

The following commands change the redirection of DNS packets from Cisco 4000 Series ISR to Cisco Umbrella cloud:

• resolver ipv4 1.1.1.1

• resolver ipv4 1.1.1.2

• resolver ipv6 1234::1

• resolver ipv6 2345::1

In this example, all the IPv4 DNS packets are redirected to 1.1.1.1 or 1.1.1.2 and IPv6 DNS packets are redirected to 1234::1 or 2345::1. You should remove the IP address to restore to the default values of the resolver. When you modify a resolver IP address, the following message is displayed:

User configured would overwrite defaults
Defaults are restored when no more user configured are present

With the default values of 208.67.222.222 and 208.67.220.220, all DNS packets are redirected to Cisco Umbrella Anycast resolvers. Cisco 4000 Series ISR uses the first default resolver IP address for all its redirection. When the Cisco 4000 Series ISR does not receive a response for three consecutive DNS queries, the Cisco 4000 Series ISR automatically switches to a different resolver IP address. This behavior remains the same for IPv6 resolver addresses.

Note	IPv6 redirection is deferred and all IPV6 DNS packets are not redirected to Cisco Umbrella Anycast servers.

Verify the Cisco Umbrella Connector configuration using the following commands:

Router# show umbrella config
Umbrella Configuration                                                             
==================                                                           
   Token:  AAC1A2555C11B2B798FFF3AF27C2FB8F001CB7B2 
   OrganizationID: 1882034                                 
   Local Domain Regex parameter-map name: NONE                                     
   DNSCrypt: Enabled                                                               
   Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79                                                                        
   UDP Timeout: 5 seconds                                                          
   Resolver address:                                                               
       1. 208.67.220.220                                                           
       2. 208.67.222.222                                                           
       3. 2620:119:53::53                                                          
       4. 2620:119:35::35                                                          
   Umbrella Interface Config:
       Number of interfaces with "opendns out" config: 1
         1. GigabitEthernet0/0/0                        
             Mode     :  OUT                            
             VRF      : global(Id: 0)                   
       Number of interfaces with "opendns in" config: 1 
         1. GigabitEthernet0/0/1                        
             Mode      : IN                              
             Tag       : test                            
             Device-id : 010a6aef0b443f0f
             VRF       : global(Id: 0)

Device# show umbrella deviceid
Device registration details
Interface Name          Tag       Status   Device-id
GigabitEthernet0/0/1     guest  200 SUCCESS 010a7ba73bd216d1


Device#show umbrella dnscrypt
    DNSCrypt: Enabled
Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79
Certificate Update Status:
Last Successful Attempt : 10:55:40 UTC Apr 14 2016
Last Failed Attempt : 10:55:10 UTC Apr 14 2016
Certificate Details:
Certificate Magic : DNSC
Major Version : 0x0001
Minor Version : 0x0000
Query Magic : 0x717744506545635A
Serial Number : 1435874751
Start Time : 1435874751 (22:05:51 UTC Jul 2 2015)
End Time : 1467410751 (22:05:51 UTC Jul 1 2016)
Server Public Key :
ABA1:F000:D394:8045:672D:73E0:EAE6:F181:19D0:2A62:3791:EFAD:B04E:40B7:B6F9:C40B
Client Secret Key Hash :
BBC3:409F:5CB5:C3F3:06BD:A385:78DA:4CED:62BC:3985:1C41:BCCE:1342:DF13:B71E:F4CF
Client Public key :
ECE2:8295:2157:6797:6BE2:C563:A5A9:C5FC:C20D:ADAF:EB3C:A1A2:C09A:40AD:CAEA:FF76
NM key Hash :
F9C2:2C2C:330A:1972:D484:4DD8:8E5C:71FF:6775:53A7:0344:5484:B78D:01B1:B938:E884

Device# show umbrella deviceid detailed
Device registration details
 1.GigabitEthernet0/0/1
      Tag               : guest
      Device-id         : 010a6aef0b443f0f
      Description       : Device Id received successfully
      WAN interface     : GigabitEthernet0/0/0
      WAN VRF used      : global(Id: 0)
 

Troubleshoot issues that are related to enabling Cisco Umbrella Integration feature using these commands:

• debug umbrella device-registration

• debug umbrella config

• debug umbrella dnscrypt

Depending on the OS, run either of these two commands from the client device:

• The nslookup -type=txt debug.umbrella.com command from the command prompt of the Windows machine

• The nslookup -type=txt debug.umbrella.com command from the terminal window or shell of the Linux machine

nslookup -type=txt debug.opendns.com 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
debug.opendns.com text = "server r6.mum1"
debug.opendns.com text = "device 010A826AAABB6C3D"
debug.opendns.com text = "organization id 1892929"
debug.opendns.com text = "remoteip 171.168.1.7"
debug.opendns.com text = "flags 436 0 6040 39FF000000000000000"
debug.opendns.com text = "originid 119211936"
debug.opendns.com text = "orgid 1892929"
debug.opendns.com text = "orgflags 3"
debug.opendns.com text = "actype 0"
debug.opendns.com text = "bundle 365396"
debug.opendns.com text = "source 72.163.220.18:36914"
debug.opendns.com text = "dnscrypt enabled (713156774457306E)"

This example shows how to enable Cisco Umbrella Integration on Cisco 4000 Series ISRs:

Device# configure terminal
Device# configure terminal
Device(config)# parameter-map type umbrella global
Device(config-profile)# dnscrypt
Device(config-profile)# token AABBA59A0BDE1485C912AFE472952641001EEECC
Device(config-if)# exit
Device(config)# interface GigabitEthernet 0/0/1
Device(config-if)# umbrella in guest
Device(config)# interface gigabitEthernet 0/0/0
Device(config-if)# umbrella out