Contents

Introduction

Overview

Allowing

Why is this necessary?

Ways to identify the domains

Introduction

This document describes allowing and blocking access to websites in Umbrella.

Overview

A common issue with blocking/allowing access to a site (www.example.newsite.com) in Cisco Umbrella is that additional domains need to be accounted for.

Allowing

Let us say that you want to allow "www.sfgate.com", and so you add "sfgate.com" to your allow list. However, after visiting the site, you find that only the text is showing. When this happens, there are domains needed by the domain that are still being blocked.

If you perform a HAR capture in the browser, it lists some of the domains as being called out after "www.sfgate.com" has successfully resolved. In this capture, you would view these DNS records:

fls.doubleclick.net

s.meebocdn.net

ww1.hdnux.com

ww2.hdnux.com

ww3.hdnux.com

ww4.hdnux.com

www.sfgate.com

www.zvents.com

ssl.gstatic.com

Why is this necessary?

For efficiency, almost all websites load content from other sources. This can include but is not limited to image resources, scripts, ads, and social media plugins. Because of this, Umbrella's settings might be blocking some of these resources, and elements of the page do not load properly or load without formatting.

To view this content, your settings must be updated to allow for the domains.

Note: If you are using Allow Only Mode, you almost always have to take these steps.

Ways to identify the domains

One easy way to find the domains required is to use Google Chrome's DNS prefetch tool which logs your queries.

Once the feature is turned on in your browser, you can visit the site you want to collect information about.

After the site has completely rendered (or all elements are downloaded), you can enter this into the URL bar in the browser:

chrome://predictors

Next, use CTRL+F to find the domain you are looking for.  This screenshot uses "www.bostonglobe.com" as an example.

These entries would be required to allow this site to render completely:

bostonglobe.com

c.o0bg.com

cdn.insights.gravity.com

metrics.boston.com

ping.chartbeat.net

rma-api.gravity.com

rmedia.boston.com

static.chartbeat.com

apis.google.com

ssl.gstatic.com

Other methods of identifying these domains include packet captures (collected by tools such as Wireshark), collecting HAR files, or using websites such as webpagetest.org.