Guides
ProductDeveloperPartnerPersonal
ProductDeveloperPartnerPersonal

Other Configurations

Suggest Edits

Table of Contents

Configure Rate Limiting

Umbrella virtual appliances (VAs) support the rate-limiting of DNS queries on a per-IP basis. This can be used to prevent any single endpoint from attempting to flood the VA with DNS queries and causing a Denial-of-Service on the VA.

CommandDescriptionNotes
config va per-ip-rate-limit enable <pps> <burst>Enable Rate-limitingRate-limiting is off by default. <pps>—Number of packets accepted per second from each individual IP. Supported values are 10 to 100,000.<burst>—Packet burst rate.
config va per-ip-rate-limit disableDisable Rate-limiting
config va showCheck Status and Packet Drops

Configure NTP Servers

By default, Umbrella VAs use Ubuntu NTP servers (ntp.ubuntu.com) as their time servers.

You can configure VAs to use other NTP servers.

CommandDescription
config ntp add <serverIP1> <serverIP2> …Add NTP servers to the VA
config ntp remove <serverIP1> …Remove NTP servers
config ntp showView VA's Current NTP Servers

Configure Umbrella Resolvers

By default, the VA is configured to use the standard Umbrella resolvers (208.67.220.220 and 208.67.222.222).

You can change the Umbrella resolvers used by the VA.

CommandDescriptionNotes
config va resolvers globalUse standard Umbrella resolvers (208.67.220.220 and 208.67.222.222).
config va resolvers alternateUse alternate Umbrella resolvers (208.67.222.220 and 208.67.220.222).Use this option if your ISP blocks traffic to the standard Umbrella resolvers.
config va resolvers global-v6Use standard IPv6 Umbrella resolvers (2620:119:35::35 and 2620:119:53::53).
config va resolvers USUse the US-only Umbrella resolvers (208.67.221.76 and 208.67.223.76).
config va resolvers US-v6Use the US-only IPv6 Umbrella resolvers (2620:119:17::76 and 2620:119:76::76).

👍

When the Umbrella IPv6 resolvers are configured, only DNS queries are sent over IPv6. HTTPS traffic to other endpoints (api.opendns.com, disthost.umbrella.com, and s.tunnels.ironport.com) is sent over IPv4 only.

Configure DNSSEC Support

Cisco Umbrella supports DNSSEC by performing validation on queries sent from Umbrella resolvers to upstream authorities.

If your endpoints are making DNS queries with the DNSSEC OK (DO) bit to the VA, the default behavior of the VA is to turn off this bit before forwarding the query to Umbrella or the local DNS server.

CommandDescriptionNotes
config va dnssec enableConfigure the VA to preserve the DO bit when forwarding the DNS query to Umbrella and/or the local DNS server.Preserves any DNSSEC Security Resource Records in the DNS response to the endpoint.
config va dnssec disableDisable the above configuration.

Configure Logging to Remote Syslog Server

Umbrella VAs can forward logs to a remote syslog server. Forwarding of logs related to internal DNS queries, logs on upgrades and reboots of the VA, and admin audit logs is supported.

  1. Configure the destination (remote syslog server) on the VA with the following command:
    config logexport destination server-ip-address:port udp

Supported Values for

  • TCP, UDP, and TLS are supported protocols.
  • If no value is specified, TCP is the default.
  • If the protocol value is TCP or UDP and a port is not specified, 514 is assigned as the default port.
  • If the protocol value is TLS and a port is not specified, 6514 is taken as the default port.
  • IPv6 addresses are not supported as destination IPs for this command.
    Example: config logexport destination <10.26.02.82:514> udp

To forward the logs over a TLS-encrypted session, first create the certificates for client (VA) and server (remote syslog server). The certificates can be self-signed or signed by a Root certificate authority (CA). Add the key and certificate to the VA using the following commands:
config logexport key <copy the contents from keyForClientCert.pem file> config logexport cert <copy the contents from ClientCert.pem file> config logexport ca <copy the contents from selfsignedCA.pem|chainCertCA.pem file>

The CA configured in the last command should be the CA used to sign the server certificate.

  1. Configure the forwarding of logs on the VA.

Command

Description

Log Format

config logexport enable internaldns

All internal DNS queries sent to the internal DNS server are logged at the syslog server. Logs include the date and time, the internal domain being queried and the private IP, hostname and username of the source endpoint that made the query.

Note that the hostname and username of the source endpoint will not be available if AD integration is not configured for the VA.

Format for Internal DNS queries:

  • Date
  • Time
  • Hostname ("forwarder")
  • VA Label:"InternalDNS"
  • Internal IP of source
  • User AD identity of source (if a user identity is mapped to this IP else "NULL")
  • Host AD identity of source (if a host identity is mapped to this IP else "NULL")
  • Internal Domain being queried

config logexport enable health

Reboots and upgrades of the VA are logged at the syslog server.

Format for VA boot:

  • Date
  • Time
  • Hostname ("forwarder")
  • VA Label:"Health"
    "VA started"

Format for VA upgrade:

  • Date
  • Time
  • Hostname ("forwarder")
  • VA Label:"Health"
  • "VA downloaded version <x.y.z>" or "VA upgraded to version <x.y.z>"

config logexport enable admin

Admin audit log (logins by admin users and config commands run on the VA are logged at the syslog server).

Format for User Login to VA:

  • Date
  • Time
  • Hostname ("forwarder")
  • VA Label:"Audit-Auth"
    "SSH login from as <vmadmin/vmuser> succeeded/failed" or "Console login as <vmadmin/vmuser> succeeded/failed"

Format for Configuration change:

  • Date
  • Time
  • Hostname ("forwarder")
  • VA Label:"AuditLog-Config" "Command executed"
config logexport enable allEnables logging of internaldns, health and admin logs at the syslog server.
  1. To check the status of the log forwarding, use the following command:
    config logexport status

Turn Off the Logging

To turn off logging, use the following command:
config logexport disable <feature>

The feature parameter can take the value of “internaldns”, “health”, “audit” or “all”.
Example: config logexport disable all

Configure Dual-NIC Support on the VA

👍

NIC Terminology

Throughout this section, the terms NIC, network interface, and network adapter are used interchangeably.

The Umbrella VA supports a dual-NIC configuration. This dual-NIC configuration is intended to enable DMZ deployment of a VA for traffic segregation with one network interface being used for outbound communication and the other network interface used for internal communication.

Dual-NIC support has only been qualified on virtual appliances (VA) running on Hyper-V and VMware. There is no change to existing behavior if the VA is deployed with a single NIC. Configuring more than two NICs on the VA is not supported.

Note: IPv6 addresses cannot be configured for network adapters when using the dual-NIC configuration.

Configure an Existing VA to Support Dual-NIC

  1. Open your existing VA in your preferred hypervisor’s console or SSH to the VA.
  2. Run the command config va show.
    Ensure that the IP configured here is the IP that will be used for internal communication. This is the IP that your endpoints will use for DNS resolution.
    Tip: Note the MAC address of the existing network adapter before adding a secondary network adapter.
  3. Shut down the VA and add a second network adapter using your hypervisor console.
    This is the network adapter you will be using for your outbound communication. This should be of the same driver type as your primary network adapter.
    Note: Some platforms may not permit the addition of a second network adapter after the VA has been created.
  4. Turn the VA on, enter the Configuration mode from the console or through SSH, and run the command config va show. This command returns the name of the second adapter.
    Note: Adding a second adapter when the VA is powered on may result in the adapter not being detected or the corruption of the existing configuration. The VA needs to be compulsorily shut down before adding the second adapter.
  5. For the secondary adapter, assign the IP, netmask, and gateway parameters to be used for outbound (Internet) communication. Enter: config va interface <*interface name*> <*ip address*> <*netmask*> <*gateway*>.
    Verify against the MAC address of the respective adapters to ensure that the IP addresses are not misconfigured.
    Note: You cannot direct DNS requests to the IP configured on the secondary adapter because incoming DNS traffic will be blocked on this IP.
  6. Once you have saved changes, enable traffic segregation. Enter: config va dmz enable
    Static routes are configured for the IP on the secondary adapter to all Umbrella destinations required for the proper functioning of the VA. Configuring additional static routes is currently not supported.

Deploy a New VA to Support Dual-NIC DMZ Mode

You can deploy a new VA with dual-NIC support. The configuration steps are similar to configuring an upgraded VA. You can add the secondary adapter to the VM using the hypervisor console, before powering on the VM. Both adapters should be of the same driver type.

  1. Enter configuration mode on the VA and retrieve the name of both adapters. Enter: config va show
  2. Configure the primary adapter and then the secondary adapter. Enter config va interface <*interface name*> <*ip address*> <*netmask*> <*gateway*>
    Ensure that the primary adapter is configured with the IP that you wish to use for internal communication and that the secondary adapter is configured with the IP to be used for internet-bound communication.
  3. Once both adapters are configured, enable traffic segregation. Enter: config va dmz enable

Configure Anycast

The Umbrella virtual appliance (VA) enables the use of Anycast DNS addressing within an enterprise.

The advantage of using Anycast is that all your endpoints can use the same DNS IP address irrespective of the site to which they belong. Configuring an Anycast IP address on the VA adds resiliency for DNS resolution.

The VA currently supports enabling Anycast using the BGP protocol. This requires support for BGP on the VA’s neighboring router, or any router that is reachable from the VA within 255 hops.

You can configure up to 4 routers running BGP as BGP peers for the VA.

Two VAs in different branches can also be configured with the same Anycast IP address, ensuring resiliency across branches. However, if AD integration is required, these VAs must be in the same Umbrella site, since the AD Connector propagates IP-AD user mappings only to VAs in its Umbrella site.

Only IPv4 addresses can be configured as an Anycast address on the VA.

Configure Anycast over BGP on the VA

  1. Enter the Configuration Mode on the VA.
  2. Enable Anycast support on the VA. Enter config anycast bgp <options>
    Command returns an ASN for the VA.
    Options are:
    • enable <anycast_ip> <bgp_info>—Enable the anycast mode
      • <anycast_ip>—Anycast IP address
      • <bgp_info>—ASN:IPAddress:Hop count of the BGP router to publish. If a hop count is not specified, a default value of 255 is assumed, therefore, the router can be up to 255 hops away.
    • add <ASN:Router IP:Hop count>—Use this command to specify an additional router as a BGP peer for the VA. A maximum of 4 peers can be configured.
    • delete —Use this command to remove a BGP peer for the VA.
    • stats—Show statistics around the Anycast configuration
    • summary—Show summarized list of all BGP peers for this VA
    • disable—Disable anycast mode
    • status—Show status of anycast
    • test—test Anycast connectivity
    • help—Display this usage information
  3. Validate status. Enter config anycast bgp status
  4. On the router, add the VA’s ASN from step 2 as the neighbor of the router.

Example:
In the following configuration, the VA needs to be configured with Anycast IP 192.168.1.22, the BGP router’s ASN is 7105, and IP address is 10.1.0.1.

Configure Load Balancing

Umbrella VAs can be load balanced behind a load balancer that meets the following requirements:

  • The load balancer is able to inject the source IP address of the client making the query in the EDNS Client Subnet (ECS) field of the DNS request sent to the VA.
  • The DNS response from the virtual appliance routes through the load balancer so the response to the client comes from the address of the load balancer.

This feature has specifically been qualified with the F5 BIGIP-LTM 16.1.1 version, where the F5 can inject the endpoint source IP in DNS requests that it forwards to VAs in the load balancing pool. Refer to F5 documentation on ECS injection in DNS requests when forwarding these requests to a DNS server pool.

The VA will not accept DNS requests with the ECS option from any endpoint by default. To allow the VA to accept DNS requests with the ECS option from load balancers, the load balancer IP has to be added to the VA configuration using the following commands:

  • Add a load balancer—config loadbalancer add <server-ip/prefix>
  • Remove a load balancer—config loadbalancer remove <server-ip/prefix>

Note: A maximum of 8 load balancers can be added to a VA and only a single load balancer can be added or removed at a time.

Configure Identity Association Timeouts

The config admap command can be used to configure identity association timeouts as well as viewing or clearing the AD Mapping. As this time, it is possible only to clear clear out the mappings of an individual IP address.

Example commands:

  • config admap view <ip address>
  • config admap clear <ip address>
  • config admap set-user-timeout 28800 (This would set it for 8hours)
  • config admap set-host-timeout 28800 (This would set it for 8 hours)
  • config admap show-timeout

Troubleshoot Virtual Appliances > Other Configurations

Updated 5 months ago