The Cisco SD-WAN Umbrella Integration feature provides cloud-based security service by inspecting the DNS query that is sent to the DNS server through the device. When a host initiates the traffic and sends a DNS query, the Umbrella Connector in the device intercepts and inspects the DNS query. If the DNS query is for a local domain, it forwards the query without changing the DNS packet to the DNS server in the enterprise network. If it is for an external domain, it adds an Extended DNS (EDNS) record to the query and sends it to Umbrella Resolver. An EDNS record includes the device identifier information, organization ID and client IP. Based on this information, Umbrella Cloud applies different policies to the DNS query.

The Umbrella Integration cloud, based on the policies configured on the portal and the reputation of the DNS Fully Qualified Domain Name (FQDN) may take one of the following actions:

• If FQDN is found to be malicious or blocked by the customized Enterprise Security policy, then the IP address of the Umbrella Cloud's blocked landing page is returned in the DNS response. This is called a blocked list action at Umbrella Cloud.

• If FQDN is found to be non-malicious, then the IP address of the content provider is returned in the DNS response. This is called a allowed list action at Umbrella Cloud.

• If the FQDN is suspicious, then the intelligent proxy unicast IP addresses are returned in the DNS response. This is referred to as grey list action at Umbrella Cloud.

When the DNS response is received, the device forwards the response back to the host. The host will extract the IP address from the response and send the HTTP / HTTPS requests to this IP.

Note: The intelligent proxy option has to be enabled in the Umbrella dashboard for the Umbrella Resolver to return the intelligent proxy unicast IP addresses in the DNS response when an attempt is made to access the domains in the grey list.

Handling HTTP and HTTPs Traffic

With Cisco SD-WAN Umbrella Integration, HTTP and HTTPs client requests are handled in the following ways:

• If the Fully Qualified Domain Name (FQDN) in the DNS query is malicious (falls under blocked domains), Umbrella Cloud returns the IP address of the blocked landing page in the DNS response. When the HTTP client sends a request to this IP, Umbrella Cloud displays a page that informs the user that the requested page was blocked and the reason for blocking the page.

• If the FQDN in the DNS query is non-malicious (falls under allowedlisted domains), Umbrella Cloud returns the IP address of the content provider. The HTTP client sends the request to this IP address and gets the desired content.

• If the FQDN in the DNS query falls under grey-listed domains, Umbrella Resolver returns the unicast IP addresses of intelligent proxy in the DNS response. All HTTP traffic from the host to the grey domain gets proxied through the intelligent proxy and undergo URL filtering.

One potential limitation in using intelligent proxy unicast IP addresses is the probability of the datacenter going down when the client is trying to send the traffic to the intelligent proxy unicast IP address. This is a scenario where a client has completed DNS resolution for a domain which falls under grey-listed domain and client’s HTTP/(S) traffic is being sent to one of the obtained intelligent proxy unicast IP address. If that datacenter is down, then the client has no way of knowing it.

The Umbrella Connector does not act on the HTTP and HTTPS traffic. The connector does not redirect any web traffic or alter any HTTP/(S) packets.

Encrypting the DNS Packet

The DNS packet sent from the device to Umbrella Integration server must be encrypted if the EDNS information in the packet contains information such as user IDs, internal network IP addresses, and so on. When the DNS response is sent back from the DNS server, device decrypts the packet and forwards it to the host. You can encrypt DNS packets only when the DNScrypt feature is enabled on the device.

The device uses the following Anycast recursive Umbrella Integration servers:

• 208.67.222.222

• 208.67.220.220

• 2620:119:53::53

• 2620:119:35::35

• If an application or host uses IP address directly instead of DNS to query domain names, policy enforcement is not applied.

• When the client is connected to a web proxy, the DNS query does not pass through the device. In this case, the connector does not detect any DNS request and the connection to the web server bypasses any policy from the Umbrella portal.

• When the Umbrella Integration policy blocks a DNS query, the client is redirected to a Umbrella block page. HTTPS servers provide these block pages and the IP address range of these block pages is defined by the Umbrella portal.

• The type A, AAAA, and TXT queries are the only records that are redirected. Other types of query bypasses the connector. Umbrella Connector maintains a list of IP address that is known for malicious traffic. When the Umbrella roaming client detects the destination of packets to those addresses, it forwards those addresses to Umbrella cloud for further inspection.

• Only the IPv4 address of the host is conveyed in the EDNS option.

• A maximum of 64 local domains can be configured under bypass list, and the allowed domain name length is 100 characters.

Before you configure the Umbrella Integration feature, ensure that the following are met:

• The device has a security K9 license to enable Umbrella Integration.

• The device runs on the SD-WAN IOS XE 16.10 software image or later.

• SD-WAN Umbrella subscription license is available.

• The device is set as the default DNS server gateway and needs to ensure that the DNS traffic goes through the device.

To configure Umbrella API token:

1. In Cisco vManage NMS, select the Configuration > Security tab > Custom Options on the right side to configure the Umbrella API.

2. Select Umbrella API Token.

   

3. Enter token number in the Umbrella Token field.

   Note	Must be exactly 40 hexadecimal.

4. Click Save Changesto configure the Umbrella API Token. 

To define Domain-List, use the vManage security configuration wizard:

1. In Cisco vManage NMS, select the Configuration > Security tab > Custom Options in the right side.

   

2. Click on Lists in the Custom Options drop-down.

3. Select Domain from the left pane.

4. Click on New Domain List to create a new domain list or select the domain name and click on pencil icon on the right side for the existing list.

5. Enter the Domain List Name,  Add Domain and click Add to create the list.

To configure umbrella through DNS Security:

1. In Cisco vManage NMS, select the Configuration > Security tab in the left side panel.

   

2. Click Add Security Policy. The Add Security Policy wizard appears.

   

3. The Add Security Policy configuration wizard opens, and various use-case scenarios display.

4. In Add Security Policy, select Direct Internet Access.

5. Click Proceed to add an Umbrella DNS Security policy in the wizard.

6. In the Add Security Policy wizard, select DNS Security tab to create a new DNS Security policy.

   

7. Click the Add DNS Security Policy drop-down and select from the following options:

   • Create New - A DNS Security - Policy Rule Configuration wizard appears and continue with Step 8.

   • Copy from Existing - A Copy from Existing DNS Security Policy wizard appears. Select a Policy from the drop-down and enter Policy Name and copy the policy to a device.

   

8. If you are creating a new policy using Create New, a DNS Security - Policy Rule Configuration wizard appears.

   

9. Enter a policy name in the Policy Name field.

10. The Umbrella Registration Status displays the status about the API Token configuration.

11. Click on Manage Umbrella Registration to add a token.

    

12. Select Match All VPN option if you need to keep the same configuration for all the available VPNs and continue with Step 13.

    Or select Custom VPN Configuration if you need to add target VPNs to your policy. A Target VPNs wizard appears.

    

13. To add target VPNs, click Target VPNs in the Add DNS Security Policy wizard.

    

14. Click Save Changes to add the VPN.

15. Select the domain bypass from the Local Domain Bypass List drop-down as shown.

    

16. Configure the DNS Server IP from the following options:

    • Umbrella Default

    • Custom DNS

17. Click on the Advanced tab to enable or disable the DNSCrypt. By default, the DNSCrypt is enabled.

18. Click Save DNS Security Policy to configure DNS Security policy. The Configuration > Security screen is then displayed, and the DNS Policy list table includes the newly created DNS Security Policy.

    

To apply DNS Umbrella Policy:

1. In vManage NMS, select the Configuration > Templates screen.

   

2. In the Device tab, select From Feature Template from the Create Template drop-down,.

3. From the Device Model drop-down, select one of the IOS XE devices.

4. Click the Additional Templates tab. The screen scrolls to the Additional Templates section.

   

5. From the Security Policy drop-down, select the name of the Umbrella DNS Security Policy you configured in the above procedure.

6. Click Create to apply Umbrella policy to a device.

You can monitor the registered VPNs, DNSCrypt status, packet counts for required timestamps on a umbrella configured router using the following steps.

To monitor the status of Umbrella DNS Configuration on IOS XE device:

1. From the Monitor > Network screen, select an IOS XE device.

   

2. In the left panel, under Security Monitoring, select Umbrella DNS Re-direct tab. The Umbrella DNS Re-direct wizard displays showing how many packets are redirected to configured DNS server.

   

3. Click on Local Domain Bypass to monitor the packet counts showing how many packets are bypassed to DNS server.

   

Configure the Umbrella Connector

Communication for device registration to the Cisco Umbrella server is via HTTPS. This requires a DigiCert root certificate which is auto installed on the router by default.

To configure Umbrella Connector:

• Get the API token from the Umbrella portal.

• Define VRFs and each VRF can has two options: DNS resolver and enabling local domain list.

  • Umbrella registration is done per VRF only if DNS resolver is configured as Umbrella.

  • Local domain bypass list is global and each VRF can enable or disable the local domain bypass list. If enabled, the DNS packet will be matched against the local domain list.

• Umbrella is a Direct Internet Access (DIA) feature, so NAT configuration is mandatory.

Sample configuration:

Device# config-transaction
    Device(config)# parameter-map type umbrella global
    Device(config-profile)#?    
    parameter-map commands:
          dnscrypt          Enable DNSCrypt
          exit              Exit from parameter-map
          local-domain      Local domain processing
          no                Negative or set default values of a command
          public-key        DNSCrypt provider public key
          registration-vrf  Cloud facing vrf
          resolver          Anycast address
          token             Config umbrella token
          udp-timeout       Config timeout value for UDP sessions
          vrf               Configure VRF

Per-VRF options are provided under VRF option:
Device(config)# parameter-map type umbrella global
Device(config-profile)#vrf 9
Device(config-profile-vrf)#?
vrf options:
    dns-resolver        DNS resolver address
    exit                Exit from vrf sub mode
    match-local-domain  Match local-domain list(if configured)
    no                  Negate a command or set its defaults

 parameter-map type regex dns_bypass
 pattern www.cisco.com
 pattern .*amazon.com
 pattern .*.salesforce.com
!
parameter-map type umbrella global
token 648BF6139C379DCCFFBA637FD1E22755001CE241
local-domain dns_bypass
dnscrypt udp-timeout 5
vrf 9
      dns-resolver 8.8.8.8
      match-local-domain 
vrf 19
      dns-resolver 8.8.8.8
      no match-local-domain
 vrf 29
      dns-resolver umbrella
      match-local-domain
 vrf 39
      dns-resolver umbrella
      no match-local-domain
!

The following table captures the per VRF DNS packet behavior:

Note	The VRFs must be preconfigured. For example, the VRFs 9,19, 29, 39 are preconfigured in the above example.

Sample NAT config for DIA internet connectivity:

ip access-list extended dia-nat-acl
10 permit ip any any
ip nat inside source list dia-nat-acl interface <WAN-facing-Interface> overload
“ip nat outside” MUST be configured under <WAN-facing-Interface>

Device# config-transaction
Device(config)# parameter-map type regex dns_bypass
Device(config)# pattern www.cisco.com
Device(config)# pattern .*amazon.com
Device(config)# pattern .*.salesforce.com

Device# show sdwan umbrella dnscrypt
    DNSCrypt: Enabled
       Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79
   Certificate Update Status:
     Last Successfull Attempt: 08:46:32 IST May 21 2018
  Certificate Details:
           Certificate Magic     : DNSC
           Major Version         : 0x0001
           Minor Version         : 0x0000
           Query Magic           : 0x714E7A696D657555
           Serial Number         : 1517943461
           Start  Time           : 1517943461 (00:27:41 IST Feb 7 2018)
           End Time              : 1549479461 (00:27:41 IST Feb 7 2019)
           Server Public Key     : 240B:11B7:AD02:FAC0:6285:1E88:6EAA:44E7:AE5B:AD2F:921F:9577:514D:E226:D552:6836
           Client Secret Key Hash: 8A97:BBD0:A8BE:0263:F07B:72CB:BB21:330B:D47C:7373:B8C8:5F96:9F07:FEC6:BBFE:95D0
           Client Public key     : 0622:C8B4:4C46:2F95:D917:85D4:CB91:5BCE:78C0:F623:AFE5:38BC:EF08:8B6C:BB40:E844
           NM key Hash           : 88FC:7825:5B58:B767:32B5:B36F:A454:775C:711E:B58D:EE6C:1E5A:3BCA:F371:4285:5E3A
When disabled:
Device# show umbrella dnscrypt
       DNSCrypt: Not enabled
       Public-key: NONE

Sample configuration steps for dns-resolver and match-local-domain-to-bypass per vrf:
Router(config)# vrf definition 1
Router(config-vrf)# address-family ipv4
Router(config-ipv4)# exit-address-family 
Router(config-vrf)# commitCommit complete.
Router(config-vrf)# exit
Router(config)# parameter-map type umbrella global 
Router(config-profile)# ?
Possible completions:
    dnscrypt             
    local-domain         
    public-key
    registration-vrf
    resolver             
    token                
    udp-timeout
    vrf
Router(config-profile)# vrf ?
This line doesn't have a valid range expression
Possible completions:
    <name:string, min: 1 chars, max: 32 chars>  1
Router(config-profile)# vrf 1
Router(config-profile-vrf)# ?
Possible completions:  
    dns-resolver                     
    match-local-domain-to-bypass  
Router(config-profile-vrf)# dns-resolver umbrella
Router(config-profile-vrf)# match-local-domain-to-bypass 
Router(config-profile-vrf)# commit
Commit complete.
Router(config-profile-vrf)# end
Router(config)# vrf definition 2
Router(config-vrf)# address-family ipv4
Router(config-ipv4)# exit-address-family
Router(config-vrf)# commitCommit complete.
Router(config-vrf)# exit
Router(config)# parameter-map type umbrella global            
Router(config-profile)# vrf 2
Router(config-profile-vrf)# dns-resolver 8.8.8.8
Router(config-profile-vrf)# no match-local-domain-to-bypass
Router(config-profile-vrf)# commit
Commit complete.
Router(config-profile-vrf)# end 
Router#sh umbrella config 

Umbrella Configuration
========================   
Token: AAC1A2555C11B2B798FFF3AF27C2FB8F001CB7B2   
OrganizationID: 1882034   
Local Domain Regex parameter-map name: NONE
DNSCrypt: Enabled   
Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79   
UDP Timeout: 5 seconds   
Resolver address:       
    1. 208.67.220.220
    2. 208.67.222.222       
    3. 2620:119:53::53       
    4. 2620:119:35::35
Registration VRF: default   
VRF List:       
1. VRF 1 (ID: 1)           
    DNS-Resolver: umbrella               
    Match local-domain-to-bypass: Yes       
2. VRF 2 (ID: 3)           
    DNS-Resolver: 8.8.8.8           
    Match local-domain-to-bypass: No

Device# show umbrella config 
Umbrella Configuration  
========================
  Token: 648BF6139C379DCCFFBA637FD1E22755001CE241
  OrganizationID: 1892929
  Local Domain Regex parameter-map name: dns_bypass
  DNSCrypt: Enabled   
  Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79   
  UDP Timeout: 5 seconds   
  Resolver address:       
      1. 208.67.220.220       
      2. 208.67.222.222       
      3. 2620:119:53::53       
      4. 2620:119:35::35   
  Registration VRF: default   
  VRF List:       
      1. VRF 9 (ID: 4)           
          DNS-Resolver: 8.8.8.8           
          Match local-domain: Yes       
      2. VRF 19 (ID: 1)           
          DNS-Resolver: 8.8.8.8           
          Match local-domain: No       
      3. VRF 29 (ID: 2)           
          DNS-Resolver: umbrella           
          Match local-domain: Yes       
      4. VRF 39 (ID: 3)           
          DNS-Resolver: umbrella           
          Match local-domain: No
The output of VRF will have name and ID. The ID here is VRF ID:
Device# show vrf detail | inc VRF Id
VRF 19 (VRF Id = 1); default RD <not set>; default VPNID <not set>
VRF 29 (VRF Id = 2); default RD <not set>; default VPNID <not set>
VRF 39 (VRF Id = 3); default RD <not set>; default VPNID <not set>
VRF 9 (VRF Id = 4); default RD <not set>; default VPNID <not set>

When DNSCrypt is disabled:
Device# show umbrella config
Umbrella Configuration
======================== 
    Token: 648BF6139C379DCCFFBA637FD1E22755001CE241
    OrganizationID: 1892929
    Local Domain Regex parameter-map name: dns_bypass
    DNSCrypt: Not enabled   
    Public-key: NONE   
    UDP Timeout: 5 seconds   
    Resolver address:       
        1. 208.67.220.220       
        2. 208.67.222.222       
        3. 2620:119:53::53       
        4. 2620:119:35::35   
 Registration VRF: default   
 VRF List:       
     1. VRF 9 (ID: 4)           
         DNS-Resolver: 8.8.8.8           
         Match local-domain: Yes       
     2. VRF 19 (ID: 1)           
         DNS-Resolver: 8.8.8.8           
         Match local-domain: No       
     3. VRF 29 (ID: 2)           
         DNS-Resolver: umbrella           
         Match local-domain: Yes       
    4. VRF 39 (ID: 3)           
        DNS-Resolver: umbrella           
        Match local-domain: No    

Device# show sdwan umbrella device-registration
Device registration details
VRF        Tag     Status        Device-id29                      
vpn29      200     SUCCESS     010a9b2b0d5cb21f39                      
vpn39      200     SUCCESS     010a1a2e1989da19

The following example displays the device registration information in detail:
Device# show umbrella deviceid detailed
Device registration details  
1.29      
    Tag               : vpn29      
    Device-id         : 010a9b2b0d5cb21f      
    Description       : Device Id recieved successfully      
    WAN interface     : None 

2.39      
    Tag               : vpn39      
    Device-id         : 010a1a2e1989da19      
    Description       : De
    vice Id recieved successfully      
    WAN interface     : None

secure-internet-gateway
umbrella org-id <umbrella org id>
umbrella api-key <api key>
umbrella api-secret "<secret key>"
 
sdwan
interface Tunnel100001
  tunnel-options tunnel-set secure-internet-gateway-umbrella tunnel-dc-preference primary-dc source-interface GigabitEthernet0/0/0
  exit
  interface Tunnel100002
  tunnel-options tunnel-set secure-internet-gateway-umbrella tunnel-dc-preference secondary-dc source-interface GigabitEthernet0/0/0
  exit
 
service sig vrf global
  ha-pairs
   interface-pair Tunnel100001 active-interface-weight 1 Tunnel100002 backup-interface-weight1
 
vrf definition <vrf#>
address-family ipv4
exit-address-family
 
interface Loopback<some value>
no shutdown
  vrf forwarding <vrf#>
ip address <IP Address> <mask>
exit
 
interface Tunnel100001
 no shutdown
  ip unnumbered GigabitEthernet0/0/0
  no ip clear-dont-fragment
  ip tcp adjust-mss 1300
  ip mtu 1400
  tunnel source GigabitEthernet<#/#/#>
  tunnel destination dynamic
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile if-ipsec1-ipsec-profile
  tunnel vrf multiplexing
  tunnel route-via GigabitEthernet<###> mandatory
exit
interface Tunnel100002
  no shutdown
  ip unnumbered GigabitEthernet0/0/0
  no ip clear-dont-fragment
  ip tcp adjust-mss 1300
  ip mtu 1400
  tunnel source GigabitEthernet<#/#/#>
  tunnel destination dynamic
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile if-ipsec2-ipsec-profile
  tunnel vrf multiplexing
  tunnel route-via GigabitEthernet<###> mandatory
exit
 
crypto ikev2 policy policy1-global
  proposal p1-global
 
crypto ikev2 profile if-ipsec1-ikev2-profile
  no config-exchange request
  dpd 10 3 on-demand
  dynamic
  lifetime 86400
 
crypto ikev2 profile if-ipsec2-ikev2-profile
  no config-exchange request
 dpd 10 3 on-demand
  dynamic
  lifetime 86400

crypto ikev2 proposal p1-global
  encryption aes-cbc-128 aes-cbc-256
  group 14 15 16
  integrity sha1 sha256 sha384 sha512
 
crypto ipsec transform-set if-ipsec1-ikev2-transform esp-gcm 256
 
crypto ipsec transform-set if-ipsec2-ikev2-transform esp-gcm 256
 
crypto ipsec profile if-ipsec1-ipsec-profile
  set ikev2-profile if-ipsec1-ikev2-profile
  set transform-set if-ipsec1-ikev2-transform
  set security-association lifetime kilobytes disable
  set security-association lifetime seconds 3600
  set security-association replay window-size 512
 
crypto ipsec profile if-ipsec2-ipsec-profile
  set ikev2-profile if-ipsec2-ikev2-profile
  set transform-set if-ipsec2-ikev2-transform
  set security-association lifetime kilobytes disable
  set security-association lifetime seconds 3600
  set security-association replay window-size 512