Introduction
This document describes the meaning of Unprotected and Unencrypted states in the Umbrella Roaming Client and how to troubleshoot them.
Unprotected and Unencrypted States
When the Umbrella Roaming Client is in Unprotected or Unencrypted mode, the tray icon (Windows) or menu bar (OS X) displays a yellow state. The status shows as both Unprotected and Unencrypted.
Communication Requirements
To provide security and content filtering, the Umbrella Roaming Client must communicate with Umbrella using both UDP and TCP on the provided ports and destinations, in addition to the HTTP destinations listed in the Roaming Client Prerequisites article:
| Port |
Protocol |
IPv4 |
IPv6 |
| 53 |
UDP |
208.67.222.222, 208.67.220.220 |
2620:119:53::53, 2620:119:35::35 |
| 53 |
TCP |
208.67.222.222, 208.67.220.220 |
2620:119:53::53, 2620:119:35::35 |
| 443 |
UDP |
208.67.222.222, 208.67.220.220 |
2620:119:53::53, 2620:119:35::35 |
| 443 |
TCP |
208.67.222.222, 208.67.220.220 |
2620:119:53::53, 2620:119:35::35 |
The Umbrella Roaming Client is unable to protect the computer if both of these conditions exist:
- The computer is behind a connection that does not allow third-party DNS requests.
- The computer is behind a connection that has a default deny outbound firewall policy.
When these conditions are met, the Umbrella Roaming Client restores the DHCP-delegated DNS servers to the network connection properties and continues testing until it can contact Umbrella DNS servers and resume providing security and content filtering. During periods where communication with Umbrella DNS servers is not possible, policy enforcement and reporting are not available.
Testing Network Connectivity
To verify if the network allows communication with Umbrella DNS servers, manually perform a DNS query. If the network blocks queries, the output is:
$ nslookup opendns.com 208.67.222.222
;; connection timed out; no servers could be reached
If the test succeeds but the Umbrella Roaming Client still reports "Unprotected/Unencrypted," open a support ticket and provide the results of a Diagnostic Test. A successful query appears as:
$ nslookup opendns.com 208.67.222.222
Server: 208.67.222.222
Address: 208.67.222.222#53
Non-authoritative answer:
Name: opendns.com
Unencrypted State Only
If the Umbrella Roaming Client displays Unencrypted, it cannot communicate over port 443/UDP. Allowing this port through your firewall is recommended for security, but the client continues to function without encrypted DNS queries. For further details, refer to the Roaming Client Prerequisites article.
Feedback