Contents

Introduction

Unprotected and Unencrypted States

Communication Requirements

Testing Network Connectivity

Unencrypted State Only

Introduction

This document describes the meaning of Unprotected and Unencrypted states in the Umbrella Roaming Client and how to troubleshoot them.

Unprotected and Unencrypted States

When the Umbrella Roaming Client is in Unprotected or Unencrypted mode, the tray icon (Windows) or menu bar (OS X) displays a yellow state. The status shows as both Unprotected and Unencrypted.

Communication Requirements

To provide security and content filtering, the Umbrella Roaming Client must communicate with Umbrella using both UDP and TCP on the provided ports and destinations, in addition to the HTTP destinations listed in the Roaming Client Prerequisites article:

Port

Protocol

IPv4

IPv6

53

UDP

208.67.222.222, 208.67.220.220

2620:119:53::53, 2620:119:35::35

53

TCP

208.67.222.222, 208.67.220.220

2620:119:53::53, 2620:119:35::35

443

UDP

208.67.222.222, 208.67.220.220

2620:119:53::53, 2620:119:35::35

443

TCP

208.67.222.222, 208.67.220.220

2620:119:53::53, 2620:119:35::35

The Umbrella Roaming Client is unable to protect the computer if both of these conditions exist:

- The computer is behind a connection that does not allow third-party DNS requests.

- The computer is behind a connection that has a default deny outbound firewall policy.

When these conditions are met, the Umbrella Roaming Client restores the DHCP-delegated DNS servers to the network connection properties and continues testing until it can contact Umbrella DNS servers and resume providing security and content filtering. During periods where communication with Umbrella DNS servers is not possible, policy enforcement and reporting are not available.

Testing Network Connectivity

To verify if the network allows communication with Umbrella DNS servers, manually perform a DNS query. If the network blocks queries, the output is:

$ nslookup opendns.com 208.67.222.222

;; connection timed out; no servers could be reached

If the test succeeds but the Umbrella Roaming Client still reports "Unprotected/Unencrypted," open a support ticket and provide the results of a Diagnostic Test. A successful query appears as:

$ nslookup opendns.com 208.67.222.222

Server: 208.67.222.222

Address: 208.67.222.222#53

Non-authoritative answer:

Name: opendns.com

Unencrypted State Only

If the Umbrella Roaming Client displays Unencrypted, it cannot communicate over port 443/UDP. Allowing this port through your firewall is recommended for security, but the client continues to function without encrypted DNS queries. For further details, refer to the Roaming Client Prerequisites article.