Introduction

The Umbrella roaming client is a very lightweight DNS client that runs on your Windows or macOS computers. It is not a VPN client or a local anti-virus engine. It allows Umbrella security and policy-based protection, including our intelligent proxy, to be enforced no matter the network to which you are connected. Whether you're at the office, your hotel, a coffee shop, or using a mobile hotspot, the Umbrella roaming client enforces policies set by you in Umbrella. It includes the ability to deliver granular policy enforcement and reporting information about the specific computer identity or even the logged-in Active Directory user.

For more information about the roaming client, see Secure remote workers with the Cisco Umbrella roaming client and the Umbrella Roaming Client Knowledge Base.

Table of Contents

• How the Roaming Client Works
• Benefits of the Umbrella Roaming Client
• VPN Support
• Antivirus and Endpoint Security Software Support

How Does It Work?

On Windows, the Umbrella roaming client binds to 127.0.0.1:53 (localhost for IPv4) and [::1]:53 (localhost for IPv6) and sets itself as the exclusive DNS server on every network connection on your computer, ensuring that all DNS requests are directed to the closest Umbrella data center, while gracefully handling local network resources using internal domains. For the macOS, the Umbrella roaming client binds only to 127.0.0.1:53 (localhost for IPv4).

The DNS queries sent through Umbrella are encrypted, authenticated, and subjected to security and content filtering as dictated by your organization's administrator. If the computer attempts to reach a domain name that either Umbrella or your organization's administrator considers unsafe, the computer's browser gets directed to a safe block page.

Depending on the network environment that your computer is in, the Umbrella roaming client gracefully decides between several states under which it can operate.

It’s important to know that the Umbrella roaming client does not store cached DNS records or responses. The Umbrella roaming client respects TTLs as set by the domain's DNS properties just as the computer (without the Umbrella roaming client) normally would.

Benefits of the Umbrella Roaming Client

With our traditional network-based service, or with most traditional appliance-based network perimeter gateways, there are two limitations that are overcome with the Umbrella roaming client:

• Roaming / Off-network—If a laptop leaves the office and is not using a full-tunnel VPN at all times (which can be slow), the laptop is unprotected from threats and undesirable content while roaming outside of the network.
• Granular Reporting and Filtering—With only network-based service, all the DNS traffic visible in your Umbrella reports come from a single network identity. The Umbrella roaming client provides computer-level granularity that is specified in policies that you set up in Umbrella. Not only can you enforce different security and content filtering settings on a per-computer basis, but you also see computer-level reports.
• User Identity Support—Identity support is an enhancement to the roaming client that provides Active Directory user and group identity-based policies, in addition to user and private LAN IP reporting. For more information, see Identity Support for the Roaming Client.

VPN Support

The Umbrella roaming client works with most split-tunnel and full-tunnel VPNs.

For information about special considerations that are required for support of Cisco split-tunnel VPNs, see Umbrella Roaming Client (standalone): Compatibility Guide for Software and VPNs.

For a list of VPNs clients that are not compatible with the Umbrella roaming client, see Incompatible VPN Clients.

Antivirus and Endpoint Security Software Support

The Umbrella roaming client's only function is to handle DNS requests, so third-party security software should not interfere with the Umbrella roaming client. All the heavy processing is accomplished within the Umbrella data centers and in the cloud; thus, you are not subject to the slowness associated with traditional anti-virus software.

Introduction to the Umbrella Roaming Client > Prerequisites