Understand Umbrella Roaming Client in Guest Protected Networks

Introduction

This document describes Umbrella Roaming Client behavior in guest protected networks.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on Cisco Umbrella Roaming Client.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Overview

This article discusses how a laptop with the Umbrella Roaming Client or AnyConnect with the Roaming Security Module behaves when under a guest protected network (in other words, when the laptop uses a network registered to another Umbrella organization).

Additional information: Umbrella Policy Selection Involving Multiple Organizations 

Behavior

In most cases when an Umbrella roaming client visits another organization or a guest protected network, the roaming client is set to remain active and can honor the policies of its home organization. However, there are caveats:

If the roaming client is part of its home organization default policy (with lower priority or policy number 0), the roaming client can then use the policy of the guest organization due to it being in a higher policy. For more information regarding policy precedence, please read the Umbrella documentation: Policy Precedence

Prevent Umbrella Roaming Client from Using Guest Organization Policy

To prevent the Umbrella roaming client from using the guest organization policy, it is necessary to create a new policy for the Umbrella roaming client that has higher priority than the default policy:

1. Log in to the Umbrella dashboard.

2. Select Policies >Management> All Policies.

3. in the All Policies screen, select Add (+ icon) to add a new policy.

360002286863

4. Select the Roaming Computer identity, then select Next.

.360002286066

5. Configure the rest of the policy settings as desired.

6. Save the new policy.