The Umbrella Documentation Hub

Welcome to the Umbrella documentation hub. Here you'll find access to all of our Cisco Umbrella user guides.

Get Started    

Appendix A – Updates

New virtual appliance (VAs) software versions become available automatically and are usually applied without any user intervention required. However, to ensure the high availability of DNS services, you must have two VAs running for automatic upgrades to take place.

Both the connector and the VA are capable of automatic updates. To download updates, these components require access to the following URLs:

  • 443 (TCP) to
  • 443 (TCP) to

If you would like to find out more about upcoming versions, including release notes, see Service Updates. Click Follow to receive update notifications.

As an administrator, you can schedule the time period within which automatic upgrades occur. So lesson disruptions to services, we recommend that you schedule updates to occur during non-business hours.


In order for new versions to be automatically installed on the VAs we require that a minimum of two VAs be installed.

Performing an "in-place" manual upgrade of a VA results in up to 15 minutes of downtime during which you will not be able to perform DNS queries on the network and effectively will not have internet service.

Before you begin, you must have two VAs in place so that there is no downtime or interruption in service during the upgrade process.

How the Upgrade Process Takes Place

To ensure that VAs are updated in an orderly manner, the upgrade for the VA is controlled by commands from the Umbrella API that the VA is connected to. This means you cannot decide which VA is upgraded automatically. If you wish to upgrade a particular VA first, do this manually. See Manual Upgrade of a Virtual Appliance.

Logic is built-in to our API to prevent two VAs at a single site from upgrading at once or upgrading when one of the VAs is in an error state. The following checks are performed:

  1. The API checks if there is only a single VA for the site. If there is only one VA, the API does not offer a command to autoupgrade.
  2. If there is a secondary VA for the site but it is in an ERROR state, then the first VA will not autoupgrade.
  3. The API checks to see if a second VA for that site is already upgrading and if it is in a mid-upgrade state it will not autoupgrade during that window of time. If we have ordered a VA to upgrade and have not heard back that it has complete, this qualifies as mid-upgrade state.
  4. If all the prerequisite checks have been met, the VA is upgraded.

Configure Automatic Upgrade of Virtual Appliances

Your VA's version can be seen in your Umbrella dashboard.

  1. Navigate to Deployments > Configuration > Sites and Active Directory.
  1. Under Version note the versions of the VA and AD Connectors.
  1. Click Settings and then the Auto-Update tab.
  1. Under Virtual Appliance Auto-Update, choose a Day and a Time Range within which your auto-updates will occur.
  2. Click Set to save the date and time range. Auto-update is enabled.
    Note: The Set button is unavailable until you choose a day and time range.

Manual Upgrade of a Virtual Appliance

The upgrade of a VA results in the loss of DNS service for the duration of the upgrade. We highly recommend that you perform upgrades during non-business hours, or preferably, that a second VA for this site is deployed to automate the process of upgrades without introducing VA downtime.

  1. Navigate to Deployments > Configuration > Sites and Active Directory.
  1. Under Version note the versions of the VA. If a VA is out of date, Umbrella displays a yellow triangle alert.
  1. Click the alert to start the upgrade process.
  1. Click Upgrade.

Configure Anycast < Appendix A – Updates > Appendix B – Sizing Guide

Updated 4 months ago

Appendix A – Updates

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.