Understand Known Limitations with CDFW/SL VPN Tunnel

Available Languages

Download Options

  • PDF     (4.1 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (80.3 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (64.9 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 28, 2025
Document ID:225314

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes known limitations with Cisco Umbrella cloud-delivered firewall (CDFW)/SL VPN tunnel.

    Overview

    Umbrella's cloud-delivered firewall (CDFW) provides firewall services without the need to deploy, maintain and upgrade physical or virtual appliances at each site. Umbrella’s CDFW also provides visibility and control for internet traffic across all branch offices. However, there are a few known limitations with CDFW.

    Explanation

    • IPSEC traffic over CDFW tunnel is not supported, but does support SSL/TLS tunnels over CDFW. SSL over IPSec is supported in CDFW, however, Umbrella forwards that to SWG and it drops that. Umbrella is planning to build a feature that allows admins to bypass SWG by Destination IP address.
    • Each tunnel is limited to approximately 250 Mbps throughput per tunnel.
    • IP Fragmentation is not supported with CDFW.
    • Using SWG PAC File with CDFW is not supported.
    • Only TCP, UDP and ICMP are supported. Others are dropped.*
      *traceroute in ICMP is not fully visible though the Umbrella infrastructure.
    • NAT does not support pin-holing or inbound (towards branch) ports. So Active FTP is not supported, only Passive FTP. There is no capability to statically open inbound ports either.
    • Only 1 child SA is supported today.
    • Path MTU Discovery (PMTUD) is not supported in the CDFW Tunnel.
    • Pings can be dropped if multiple devices are sending to the same destination.

    Revision History

    Revision Publish Date Comments
    1.0
    28-Oct-2025
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products