Step 1

In the Umbrella dashboard, choose Admin > API Keys > Legacy Keys.

Step 2

Obtain the Organization ID from the URL: dashboard.umbrella.com/o/[Organization ID]/#/admin/apikeys

Step 3

Click Umbrella Network Devices.

1. If the Key and Secret are not available or known, click Refresh to generate a key and secret pair.

2. Copy the Key and paste it in the Network Device Key field in the management center Umbrella Connection Details page.

3. Copy the Secret and paste it in the Network Device Secret in the management center Umbrella Connection Details page.

Step 4

Click Legacy Network Devices.

1. If the Key is not available or known, click Refresh to generate a key.

2. Copy the Key and paste it in the Legacy Network Device Token field in the management center Umbrella Connection Details page.

Step 1

In the management center, choose Integration > Other Integrations > Cloud Services > Cisco Umbrella Connection.

Step 2

Obtain the following details and add them to the General settings:

• Organization ID—A unique number that identifies your organization on Cisco Umbrella. Every Umbrella organization is a separate instance of Umbrella and has its own dashboard. Organizations are identified by their name and their organization ID (Org ID).

• Network Device Key—The key to fetch umbrella policy from Cisco Umbrella.

• Network Device Secret —The secret to fetch umbrella policy from Cisco Umbrella.

• Legacy Network Device Token —An Umbrella Legacy Network Devices API token is issued through the Cisco Umbrella dashboard. Umbrella requires the API token to register a network device.

Step 3

Under Advanced, configure the following optional settings:

Step 4

Click Test Connection—Test if the Cisco Umbrella Cloud is reachable from the management center. When you provide the required organization ID and network device details, the umbrella connection is created.

Step 5

Once the information has been added, click Save to save the connection details.

Step 1

In the management center, choose Policies > DNS. All existing DNS policies will be shown.

Step 2

Click Add DNS Policy > Umbrella DNS Policy.

Step 3

Enter a name and description for the policy, then click Save.

Step 1

Choose Policies > DNS.

Step 2

Click the Edit () icon on the DNS Policy to configure.

Step 3

Navigate to the correct rule, and click the Edit () icon again to edit the rule.

1. Umbrella Protection Policy: Choose a DNS policy from the DNS policies defined in the Umbrella Dashboard.

   

2. Bypass Domain: Specify which domains should bypass Cisco Umbrella and go directly to the DNS servers.

   For multiple domains, enter a comma-separated list. For example, you can configure a list of local domains that Umbrella DNS must not filter or evaluate.

3. DNSCrypt: Choose Yes or No from the drop-down list. This option encrypts the DNS requests and forwards them to the Umbrella cloud on UDP port 443. When a new rule is created, the default setting of the DNSCrypt is YES.

   If you enable this option, ensure that you provide the DNSCrypt Public Key in the Advanced section of the Cisco Umbrella Connection settings.

4. Idle Timeout: Specify the time interval to wait for a response from the Umbrella cloud, after which the management center disconnects from Umbrella. When a new rule is created, the default setting of the Idle Timeout is 00:02:00

   The format for Idle Timeout is (hh:mm:ss).

Step 1

Navigate to Policies > Access Control and select the Access Policy to edit.

Step 2

Select Security Intelligence.

Step 3

Under Umbrella DNS Policy, select the policy to be used for the Umbrella DNS Policy.

Step 4

Select Save to save all changes.

Step 1

On the management center menu bar, click Deploy and then select Deployment.

Step 2

Identify and choose the devices on which you want to deploy configuration changes.

• Search—Search for the device name, type, domain, group, or status in the search box.
• Expand—Click Expand Arrow () to view device-specific configuration changes to be deployed.

  By selecting the device check box, all the changes for the device, which are listed under the device, are pushed for deployment. However, you can use the Policy selection () to select individual policies or configurations to deploy while withholding the remaining changes without deploying them.

  Optionally, use Show or Hide Policy () to selectively view or hide the associated unmodified policies.

Step 3

(Optional) Click Estimate to get a rough estimate of the deployment duration.

Step 4

Click Deploy.

Step 5

If the system identifies errors or warnings in the changes to be deployed, it displays them in the Validation Messages window. To view complete details, click the arrow icon before the warnings or errors.

• Deploy—Continue deploying without resolving warning conditions. You cannot proceed if the system identifies errors.
• Close—Exit without deploying. Resolve the error and warning conditions, and attempt to deploy the configuration again.

Step 1

After the deployment is complete, validate the deployment in the management center.

Step 2

Select Deploy, then the Deployment History icon.

Step 3

Select the job associated with the Umbrella Connector.

Step 4

Select the Transcript Details () icon.

FMC >> strong-encryption-disable
FMC >> umbrella-global
FMC >> token umbrella_token
10.0.0.0 >> [info] : Please make sure all the Umbrella Connector prerequisites are satisfied:
1. DNS server is configured to resolve api.opendns.com 
2. Route to api.opendns.com is configured
3. Root certificate of Umbrella registration is installed 
4. Unit has a 3DES license
FMC >> local-domain-bypass “test.com"
FMC >> timeout edns hh:mm:ss
FMC >> exit
FMC >> policy-map type inspect dns preset_dns_map 
FMC >> parameters
FMC >> umbrella tag “Default Policy” 
FMC >> dnscrypt