Review the required networking, port, and service configurations or settings. These must be commuted prior to onboarding your device to a Secure access organization.
Before initiating the onboarding process, please ensure that all components are running supported software versions. You can verify the latest available version of the Cisco Secure Client via the Cisco Secure Access – Connect - Internet Security download page.
Ensure your firewall allows these outbound and inbound connections for proper functioning of Secure Access components.
|
Component or Service |
Port and Protocol |
Source |
Destination |
Purpose or Notes |
|---|---|---|---|---|
|
AD Connector - Umbrella Cloud |
443/TCP |
AD Connector |
api.umbrella.com disthost.umbrella.com |
Initial registration, automatic updates. health status reporting. |
|
AD Connector - Certificate Validation |
80/TCP |
AD Connector |
ocsp.digicert.com crl3.digicert.com crl4.digicert.com commercial.ocsp.identrust.com validation.identrust. com |
Certificate revocation check (OCSP/ CRL validation). |
|
AD Connector - LDAP Sync |
389/TCP, 636/T CP |
AD Connector |
Domain - Controller/Domain |
LDAP syncing with Active Directory. |
|
AD Connector - RPC Communication (outbound) |
135/TCP 49152-65535/TCP |
AD Connector |
Domain - Controllers and Events Domain - Log Collector |
RPC communication to fetch. |
|
AD Connector - RPC Response (Inbound ) |
135/TCP |
Domain Controllers/Event Log Collector |
AD Connector |
RPC response for login event data |
|
AD Connector - Virtual Appliance Communication |
443/TCP |
AD Connector |
Virtual Appliances |
Send login events and IP addressing info. This is non-SSL by default. |
|
Roaming Client / Cisco Secure Client - DNS (Standard) |
53/UDP |
Client Machine |
208.67.222.222 208.67.220.220 2620:119:53::53 2620:119:35::35 |
DNS query resolution. This is standard unencrypted. |
|
Roaming Client / Cisco Secure Client - DNS (TCP) |
53/TCP |
Client Machine |
208.67.222.222 208.67.220.220 2620:119:53::53 2620:119:35::35 |
DNS query resolution . This is TCP fallback. |
|
Roaming Client / Cisco Secure Client - Encrypted DNS |
443/UDP |
Client Machine |
208.67.222.222 208.67.220.220 2620:119:53::53 2620:119:35::35 |
Encrypted DNS queries. This is optional, however it is automatic if port open). |
|
Roaming Client / Cisco Secure Client - API |
443/TCP |
Client Machine |
146.112.255.101 67.215.71.201 67.215.92.210 146.112.255.152/29 sync.hydra.opendns. com 2620:0:cc1:115::210 2a04:e4c7:ffff::20/1 25 |
Initial registration, version updates, status reporting, internal domains. |
|
Virtual Appliance - Umbrella Cloud |
443/TCP |
Virtual Appliance |
api.umbrella.com disthost.umbrella.com |
Core communication with Umbrella Cloud services. |
|
Virtual Appliance - DNS Queries |
53/UDP 53/T CP |
Client Machines (on protected network) |
Virtual Appliance IP |
DNS query forwarding to Umbrella. |
|
Virtual Appliance - Internal DNS |
53/UDP |
Virtual Appliance |
Local DNS Servers |
Forward internal DNS queries to corporate DNS. |
|
Virtual Appliance - AD Connector |
443/TCP |
Virtual Appliance |
AD Connector |
Receive login events and user or group information. |