A number of advanced settings for both the Umbrella roaming client and the Cisco Umbrella Roaming Security module can be configured.
- Navigate to Deployments > Core Identities > Roaming Computers, click Settings and then select a tab and options on that tab
- Disable DNS Redirection On an Umbrella Protected Networks—Disables the DNS-based protection applied by the roaming client while on a network protected by Umbrella. This includes the intelligent proxy as it is a DNS-based redirect. IP Layer enforcement is not affected. Relies on the protection of the network for all features except IP Layer Enforcement. To trigger this setting, network registration and the network must be the higher policy (not same, but higher) and the local DNS server egress network must be the same network registration as straight out from the computer to 126.96.36.199. Having the network be in the same org will not trigger disabling of DNS redirection. See Add IP Layer Enforcement and Roaming Client: Enable/Disable Protected Network feature.
- Active Directory—Enables identity support for roaming computers. Identity support is an enhancement to the Umbrella roaming client or the AnyConnect Umbrella roaming security module that provides Active Directory user and group identity-based policies, in addition to user and private LAN IP reporting. See Identity Support for the Roaming Client.
- VPN Compatibility Mode—The Cisco Umbrella roaming client works with most VPN software; however, certain AnyConnect and other VPN profiles may not resolve local DNS correctly on a VPN connection with Windows 10 due to the elimination of the system DNS binding order. The local LAN may bind above the VPN, failing to resolve local DNS over the tunnel. Select this setting to apply the legacy binding order behavior. For more information, see Windows 10: DNS Binding Order.
- IPv6 DNS Redirection—Provides DNS protection through redirection to Umbrella resolvers for IPv6.
- Allow IP Layer Enforcement—Provides protection against threats that bypass DNS lookups. IP Layer enforcement must be enabled for DNS policies to which the roaming computer is added.
- Respect AnyConnect Trusted Network Detection—Trusted Network Detection (TND) is configured in the AnyConnect VPN Client profile. Enabling this setting disables the roaming module whenever TND indicates the current network is trusted.
Note: For tunnels, this functionality is only supported for full tunnels. It does not work for full tunnels with dynamic split tunneling.
- Disable Umbrella Module on AnyConnect Full-tunnel VPN—When enabled, your roaming module is automatically disabled if a full-tunnel AnyConnect VPN session is active.
- Auto-update—When enabled, AnyConnect is automatically updated, except when active VPN is detected. This updates the entire AnyConnect client, including the roaming security module.
- IPv6 DNS Redirection—Provides DNS protection through redirection to Umbrella resolvers for IPv6. This setting is separate from the same tilted setting listed under Umbrella Roaming Client Settings.
Note: The minimum required version of AnyConnect is 4.8mr2.
- Allow IP Layer Enforcement—Provides protection against threats that bypass DNS lookups. IP Layer enforcement must be enabled for DNS policies.
Updated 5 months ago