Before you configure the Cisco Umbrella Integration feature on the Cisco 8100 Series Secure Routers, ensure that the following are met:

• The Cisco 8100 Series Secure Routers has a security K9 license to enable Cisco Umbrella Integration.

• Cisco Umbrella subscription license is available.

• The DNS traffic passed through the Cisco 8100 Series Secure Routers.

• Communication for device registration to the Cisco Umbrella server is through HTTPS. This requires a root certificate to be installed on the router. To download this certificate directly from a link instead of pasting it in, you can find the certificate here: https://www.digicert.com/CACerts/DigiCertSHA2SecureServerCA.crt

• If an application or host uses IP address directly instead of DNS to query domain names, policy enforcement is not applied.

• When the client is connected to a web proxy, the DNS query does not pass through the Cisco device. In this case, the connector does not detect any DNS request and the connection to the web server bypasses any policy from the Cisco Umbrella portal.

• When the Cisco Umbrella Integration policy blocks a DNS query, the client is redirected to a Cisco Umbrella block page. HTTPS servers provide these block pages and the IP address range of these block pages is defined by the Cisco Umbrella portal.

• User authentication and identity is not supported in this release.

• The type A, AAAA, and TXT queries are the only records that are redirected. Other types of query bypasses the connector. Cisco Umbrella Connector maintains a list of IP address that is known for malicious traffic. When the Cisco Umbrella roaming client detects the destination of packets to those addresses, it forwards those addresses to Cisco Umbrella cloud for further inspection.

• Only the IPv4 address of the host is conveyed in the EDNS option.

• A maximum of 64 local domains can be configured, and the allowed domain name length is 100 characters.

The Cisco Umbrella Integration feature provides cloud-based security service by inspecting the DNS query that is sent to the DNS server through Cisco 8100 Series Secure Routers. When a host initiates the traffic and sends a DNS query, the Cisco Umbrella Connector in Cisco 8100 Series Secure Routers intercepts and inspects the DNS query. If the DNS query is for a local domain, it forwards the query without changing the DNS packet to the DNS server in the enterprise network. If it is for an external domain, it adds an Extended DNS (EDNS) record to the query and sends it to Cisco Umbrella Resolver. An EDNS record includes the device identifier information, organization ID and client IP. Based on this information, Cisco Umbrella Cloud applies different policies to the DNS query.

The DNS packet sent from the Cisco 8100 Series Secure Routers to Cisco Umbrella Integration server must be encrypted if the EDNS information in the packet contains information such as user IDs, internal network IP addresses, and so on. When the DNS response is sent back from the DNS server, Cisco 8100 Series Secure Routers decrypts the packet and forwards it to the host.

You can encrypt DNS packets only when the DNScrypt feature is enabled on the Cisco 8100 Series Secure Routers.

Cisco 8100 Series Secure Routers uses the following Anycast recursive Cisco Umbrella Integration servers:

• 208.67.222.222

• 208.67.220.220

• 2620:119:53::53

• 2620:119:35::35

The Figure 1 describes the Cisco Umbrella Integration topology.

Cisco Umbrella integration provides security and policy enforcement at DNS level. It enables the administrator to split the DNS traffic and directly send some of the desired DNS traffic to a specific DNS server (DNS server located within the enterprise network). This helps the administrator to bypass the Cisco Umbrella integration.

Troubleshoot issues that are related to enabling Cisco Umbrella integration feature using these commands:

• debug umbrella device-registration

• debug umbrella config

• debug umbrella dnscrypt

Depending on the OS, run either of these two commands from the client device:

• The nslookup -type=txt debug.umbrella.com command from the command prompt of the Windows machine

• The nslookup -type=txt debug.umbrella.com command from the terminal window or shell of the Linux machine

nslookup -type=txt debug.opendns.com 192.0.2.1
Server:         192.0.2.2
Address:        192.0.2.3

Non-authoritative answer:
debug.opendns.com       text = "server r6.mum1"
debug.opendns.com       text = "device 010A826AAABB6C3D"
debug.opendns.com       text = "organization id 1892929"
debug.opendns.com       text = "remoteip 172.16.0.1"
debug.opendns.com       text = "flags 436 0 6040 39FF000000000000000"
debug.opendns.com       text = "originid 119211936"
debug.opendns.com       text = "orgid 1892929"
debug.opendns.com       text = "orgflags 3"
debug.opendns.com       text = "actype 0"
debug.opendns.com       text = "bundle 365396"
debug.opendns.com       text = "source 172.31.255.254:36914"
debug.opendns.com       text = "dnscrypt enabled (713156774457306E)"

When you deploy the Cisco Umbrella Integration feature:

• If you use the multiple EDNS options, DNS packets containing EDNS (DNSSEC) will not pass through the device. For assistance, contact Cisco Technical Support.

• If the WAN interface is down for more than 30 minutes, the device may reload with an exception. Disable the DNScrypt to stop this exception. For assistance, contact Cisco Technical Support .

This example shows how to enable Cisco Umbrella integration on Cisco 8100 Series Secure Routers: