Status, States, and Functionality

Table of Contents

• Status in the Umbrella Dashboard
• Roaming Computer Information
• Tray Icon Status
• Probes
• Advanced: Network Access per Service

The status of the Cisco Umbrella roaming client—which displays the current state of the Umbrella roaming client—is shown both in the Umbrella dashboard at Deployments > Core Identities > Roaming Computers and on the local machine through the roaming client's tray icon. For detailed descriptions, see Roaming Computer Information and Tray Icon Status.

The state that the Umbrella roaming client operates in depends on the current networking environment. This state determines how the Umbrella roaming client behaves and determines which Cisco Umbrella policy should be applied. The state of the Umbrella roaming client determines:

• Which Umbrella policy to enforce
• DNS settings
• If DNS encryption is possible.

Probes
Probes are frequent DNS requests performed by the Umbrella roaming client that acts as a health check and analysis of the networking environment. For more information, see Probes.

Status in the Umbrella Dashboard

1. Navigate to Deployments > Core Identities > Roaming Computers.
   Status is displayed for each deployed roaming client through an icon and adjacent status information.

2. Expand a roaming computer to review additional information. See also Roaming Computer Information.

3. Click Delete to remove the roaming client from the list of machines managed by your organization.
   When you delete an Umbrella roaming client from Umbrella while it's still installed on an end-user machine, depending on the version installed it will either re-register automatically or the user will lose all security features and internal domains functionality. To avoid this, Uninstall the Umbrella roaming client from the machine before deleting it from Umbrella. For more information, see Deleting the Umbrella Roaming Client from the Umbrella Dashboard.

Roaming Computer Information

The Roaming Computer page lists roaming computer information, including security status, for every roaming computer you add to Umbrella.

Tray Icon Status

As displayed through the tray icon on the device where the Umbrella roaming client is deployed, status is indicated through a colored dot that is added to the tray icon. Status is determined based on a series of DNS queries, which are used as tests to determine the correct state.

Note: The Tray icon can be set to "hidden" during installation.

Status Indicators

The roaming client icon without a dot indicates a healthy roaming client.

A colored dot on the roaming client icon indicates a possible issue with the roaming client.

For more information about which ports and protocols the Umbrella roaming client utilizes, see the Network Access section of Prerequisites.

Probes

Probes are frequent DNS requests performed by the Umbrella roaming client that acts as a health check and analysis of the networking environment. How the Cisco Umbrella roaming client operates depends on these probes, which determine the state of the Umbrella roaming client.

The probe types are:

• Encrypted
• Unencrypted
• Virtual Appliance + Protected Network

The probes are DNS queries sent to 208.67.222.222 / 208.67.220.220 / 2620:119:53::53 / 2620:119:35::35, and they specifically send TXT-type query for the domain debug.opendns.com. It's common to see many of these in your network or DNS logs. Probes run approximately every 10 seconds in order to sense changes in the network environment. In a typical networking environment, where two local DNS servers are present, the Umbrella roaming client sends:

• 1x Encrypted Probe
• 1x Unencrypted Probe
• 2x Virtual Appliance + Protected Network probes (one per local DNS server).

Encrypted Probe

Sends a DNS request to 208.67.222.222 / 208.67.220.220 / 2620:119:53::53 / 2620:119:35::35 over 443/UDP.

• Success—Response. We operate in the Encrypted state, unless the Virtual Appliance + Protected Network Probe also succeeds, in which case we switch to one of those states.
• Failure—No response. We attempt to operate in the Unencrypted state and send the Unencrypted Probe to verify.

Unencrypted Probe

Send a DNS request to 208.67.222.222 / 208.67.220.220 / 2620:119:53::53 / 2620:119:35::35 over 53/UDP.

• Success—Response. We operate in the Unencrypted state unless the Virtual Appliance + Protected Network Probe also succeeds, in which case we switch to one of those states.
• Failure—No response. We transition to the Open state.

Virtual Appliance + Protected Network Probe

Send a DNS request to the local DNS servers over 53/UDP.

• Success—Three local DNS servers are either a Virtual Appliance or Protected Network, and either the Encrypted or Unencrypted probe also succeeded. Operate in either Behind_VA or Protected Network states, respectively.
• Failure—The local DNS servers are neither a VA or a protected network. Do not operate in either Behind_VA or Protected Network states.

Advanced: Network Access per Service

If using protection measures (Endpoint Client Firewall / Antivirus) that require you to allow list network access on a per-executable (binary) basis, these are the processes to allow access:

Windows

• ERCService.exe
• ERCInterface.exe (if the GUI was installed)
• dnscryptproxy.exe (This is new as of version 3.0 of the Umbrella Roaming Client for Windows, and replaces dnscrypt-proxy)

macOS

• dns-updater

These executables perform the same network-based tasks:

• DNS lookups to internal domains
• Perform health checks as explained in our status and functionality article
• Communicate with our API (Updates, Sync status to dashboard)
• Communicate with our logging and diagnostics infrastructure.

Note: The Digicert domains resolve to various IP addresses based on CDN and are subject to change. Currently, these domains resolve to the following IPs: 

• 192.229.211.108
• 192.229.221.95
• 152.195.38.76
• 192.16.49.85
  The other IP addresses in the table above resolve to disthost.umbrella.com, api.opendns.com, and disthost.opendns.com.

dnscrypt-proxy

Perform encrypted and unencrypted DNS queries directly to Umbrella.

Advanced: How the Umbrella Roaming Client Changes States

When the computer is powered on, woken from hibernation, or if there is a new network connection established, the roaming client performs a series of tests to determine which state it should be in. Each test has a success result and a failure result. It performs the following actions, in order of execution.

Initial Resting Stage

If the roaming client does not detect any active network connections, it operates in the Waiting or Reserved state and waits for an active network connection before starting Stage 1.

Stage 1

The roaming client sends a normal EDNS request through each DHCP-delegated or static DNS server on every interface. If it detects that one of the DNS requests went through a VA, it's considered success and will operate in the Behind VA state. It does not detect any VAs, it's considered a failure and moves to Stage 2.

Stage 2

The roaming client sends a special encrypted EDNS request over 443/UDP to 208.67.222.222/208.67.220.220/2620:119:53::53/2620:119:35::35. If the requests receive a valid response, it's considered a success and the Umbrella roaming client will operate in the Encrypted state. If the requests time out or are rejected, it's considered a failure and moves on to Stage 3.

Stage 3

The roaming client sends a normal EDNS request over port 53/UDP to 208.67.222.222/208.67.220.220/2620:119:53::53/2620:119:35::35. If the requests receive a valid response, it's considered a success and the roaming client will operate in the Transparent state and send an additional test to determine if it should operate in the Protected Network state. If the requests time out or are rejected, it's considered a failure and moves on to Stage 4.

Stage 4

The roaming client has failed all tests, and reverts all the DNS settings to the original DHCP or static values and operates in the Open state. The transition to the Open state can take up to six seconds, so if a network has third-party DNS blocked, DNS resolution will not occur until the Umbrella roaming client can transition all the way to this state.

Unprotected Status (Yellow)

When the status (not state) of the roaming client is Unprotected, the roaming client tests all stages aggressively, so it may transition to a Protected state as soon as possible. This is designed to avoid the need to restart the Umbrella roaming client in situations wherein an administrator suddenly opens a firewall port or a user joins a public WiFi network and must authenticate or accept the WiFi network's Terms of Service. Within seconds of successful WiFi authentication or a change in the firewall, the roaming client will return to the Protected status and choose the appropriate state.

---

Identity Support for the Roaming Client < Status and Functionality > Virtual Appliances