Cisco Secure Firewall supports DNS integration with Cisco Umbrella. This integration enables the firewall to redirect DNS queries to Umbrella and allows Umbrella to apply DNS-based security policies.

Table of Contents

• Prerequisites
• Configure the Umbrella Connection
• Create and Manage Umbrella DNS Policies

Prerequisites

• Cisco Secure Firewall Management Center (FMC) running version 7.2 or above.
• FMC-managed Cisco Firepower Threat Defense (FTD) firewall running version 6.6 or above.
• FMC able to resolve and connect to api.opendns.com over port 443 for initial registration.
• FTD access over TCP and UDP on port 53 (DNS) to 208.67.220.220 and 208.67.222.222—the Cisco Umbrella public DNS resolvers.
• The Umbrella root certificate installed on the FTD devices.
• FMC Base license with ‘export-control’ functionality allowed.

Limitations

• Rollback of Umbrella configuration is not supported.

Configure the Umbrella Connection

To configure the Umbrella Connection, refer to the Cisco Secure Firewall Management Center Administration Guide.

Create and Manage Umbrella DNS Policies

To create and manage Umbrella DNS policies, refer to the Cisco Secure Firewall Management Center Device Configuration Guide.