Hey everyone, Chris here with Cisco, and today we're gonna be taking a look at the upgrade process from Cisco Umbrella DNS to Cisco secure access. There's three main steps that we're gonna be taking. Number one, we're gonna create security cloud control and security sign on accounts. Number two, we're going to activate the upgrade made.00:00Manager in umbrella. And then finally number three, we're gonna migrate our traffic from Umbrella to secure access and then we're gonna close the umbrella account. The only thing that you need other than admin access to your umbrella account is a claim code. This claim code will be emailed to you after completing the upgrade trans.00:20Transaction, and with that, let's jump in.00:40Here we are in the umbrella dashboard and we have an account with some identities configured and traffic going out from those identities to the internet. We can also see that we have some policies configured. These are gonna be using AD groups as the identity source, so we'll be able to see not only how the AD information is migrated, but also how the poli.00:44Policies are migrated as well. Now if we go under licensing, we can see that this account has a DNS advantage license for a hundred and five users, and at the top we have an option to request an invitation to start the upgrade process. And when we request it, we can see the invitation has been sent to our email.01:03Checking our inbox, there's a message with the info that we need to attach our secure access account to security cloud control. So let's go ahead and do that. I don't already have a security cloud tenant, so I'm going to speed things up while I create a new one, in addition to creating a security sign on account. Security Cloud control provides a centralized control and ap.01:23AI driven insights across the Cisco security cloud.01:43It gives us a central interface to manage and integrate all of our Cisco security products while Cisco security sign on provides seamless authentication across those products. Now that we've created our account and activated MFA with Duo, we can access security cloud control and create our new organization. It's important to note that the name selected here.01:46Here will also be used for the secure access account, so choose the name appropriately.02:06Since secure access is a global platform, the region deployment won't be used for this migration, but it's still a good idea to select an appropriate region since this account can be used to deploy other Cisco security products as well. If we look under product subscriptions, we see our invitation to attach secure access. The instance ID will be.02:12Do the same as our existing umbrella organization ID.02:32And once we finish, we can see there is a card for secure access in our product list. With the product attached, we can claim the subscription using our claim code. As a reminder, this claim code will be emailed to you after the upgrade transaction is complete. During this process, it's important to select attach existing instance. Choosing Create New.02:36Instance will create a new secure access account that will need to be deactivated from the subscriptions page before you can apply the license to the correct account. Once we claim the subscription, it can take a few minutes to fully activate, so now is a good time to grab a cup of coffee.02:56After claiming the subscription, we can apply it to the secure access product instance, and now we're all set to migrate our umbrella configuration. Back on the umbrella dashboard, I'm going to refresh the page and a pop up will appear with the option to take us to the upgrade manager in addition to a new link being available in the menu bar.03:12We have three steps we need to take care of before starting the upgrade. The 1st one is to configure Umbrella to use security sign on for authentication. Since this is what security cloud control and secure access use, we need to have Umbrella use it as well. If you already use a SAML IDP for umbrella dashboard authentication, you can configure.03:31Security sign on to use that same IDP before completing this step.03:52For our account here, we're going to go ahead and choose configure SAML, and when the test configuration comes up, we can see that we're already logged into security cloud control and so we don't have to log in again. If we weren't already authenticated, we would just log in using our security cloud control credentials.03:57Back at the upgrade manager, the other two prerequisites are to upgrade some of our connectors and devices. Clicking start will walk you through that process, but since I know all of mine are already on the latest versions I'm gonna mark them as done and click next. Now we're ready to start the upgrade process that will.04:21To Migrate our configuration to secure access. Once clicking upgrade, it's important to stay on this page until the process has completed.04:41Closing the page means the process will have to start again from the beginning. With the upgrade complete, we can now open secure access and view our policy. Since secure access has a different policy structure than umbrella, there might be multiple rules per migrated policy, but the outcome of the policy engine will be the same.04:49Here we can see that our AD group has been migrated and is listed as the source for the rule. Digging in, we can see all of our users are visible in the Secure Access dashboard, as well as our DNS forwarders, which is what secure access calls the virtual appliances.05:10The important thing to note is that we've only migrated our configuration. All of our traffic is still being routed through umbrella. We can verify this by opening activity search and selecting Cisco Secure Access as the point of enforcement. No traffic is found.05:28But if we select umbrella, we can see all of our traffic. To migrate traffic, we'll return to the upgrade manager and click start on the redirect traffic step. For now we'll redirect our HQ site to secure access. From here we can freely move individual identities to and from secure access so that we.05:44Can migrate and test at whatever pace we need to.06:04Now let's generate some traffic. We're back in activity search and in addition to the HQ site, I also migrated our branch one router and then generated some traffic from both. If we select secure access as our point of enforcement, we can see traffic using secure access.06:07In addition to our other identities that are still using umbrella.06:27Once we've migrated all our traffic to secure access and our content, everything is working as expected, the last step is to close the umbrella account. On the upgrade manager, we have the option to complete upgrade and close umbrella. This is a one way action. Make sure you're comfortable with the upgrade, click close umbrella, and that's it.06:33That a start to finish look at upgrading from umbrella DNS to secure access.06:53
