Deploy Secure Client with Umbrella Protection on Android via Zero-Touch MDM

Introduction

This document describes how to deploy Cisco Secure Client with the Umbrella module on Android devices using zero-touch deployment.

Background Information

You can deploy Cisco Secure Client with the Umbrella module on Android devices using zero-touch deployment through MDM solutions such as Workspace One, Cisco Meraki, or Microsoft Intune. This process enables seamless DNS-layer protection for apps and browser traffic, ensures Always On VPN is enabled, and eliminates user intervention for VPN and SEULA acceptance.

Prerequisites

• Complete Android Enterprise Mobility Management (EMM) registration and device enrollment with work profile creation.
• The MDM app (Hub) must be visible under the work profile.
• Assign and install Cisco Secure Client only after publishing and installing the Always On VPN profile to Intelligent Hub.

Deployment Steps

A. Create the Always On VPN Profile

1. Navigate to Profiles:

   • Go toResources > Profiles & Baselines > Profiles.
   • ClickAddto create a new profile.

   

2. Profile Setup:

   • SelectAndroidas the platform.
   • Choose the requiredManagement Type.

   

3. Configure VPN Settings:

   • In the profile section, go toVPN Settingand clickAdd.
   • Fill in the required fields:
     • Connection Type:Cisco AnyConnect
     • Server:cisco://local
     • EnableAlways On VPNand configure other properties as needed.
     • EnablePer-App VPN Rules.
     • EnableSet Active.
   • ClickNext.

   

4. Assign Profile:

   • Leave the Smart Group empty.
   • Assign the profile to the necessary devices.
   • Select deployment values.
   • ClickSave & Publish.

B. Assign the Cisco Secure Client App

1. Add the App:

   • Go toResources > Native > Public.
   • AddCisco Secure Clientfrom the Play Store if not already available.

2. App Assignment:

   • Select the app and fill in required values.
   • In the assignment section, create a new assignment.

   

3. Configure Distribution:

   • Enter details in the Distribution section.

   

4. Enable Managed Access:

   • In theRestrictionstab, enableManaged Access.

   

5. Select Profile:

   • In theTunneloption, select the previously created profile ('Always On VPN') underAndroid (Custom DPC).

   

6. Application Configuration:

   • Enter application configuration details such asOrg IDandReg Tokenfrom the Android Config File downloaded from the Umbrella Dashboard.
   • EnableAccept SEULA For Usersto bypass manual SEULA acceptance.
   • EnableAlways On VPN Mode for Umbrella Protection Onlyfor seamless VPN management by Cisco Secure Client.
   • Block users from creating new VPN connections (leave the Host field empty).

   

7. Save and Publish:

   • Save changes and publish the Cisco Secure Client app.

   

8. Push the Umbrella Certificate:

   • For instructions, see: Push the Umbrella Certificate to Devices