Cisco Umbrella works by sitting in the path of your DNS traffic, and optionally your web and network traffic, and checking each request against security intelligence and your policies before a connection is made. Because almost every internet connection starts with a DNS lookup, this lets Umbrella stop threats very early.
Step by step: a DNS request through Umbrella
- The device asks for a domain. A laptop sends a DNS query for example.com.
- The query goes to Umbrella. Your network or device is configured to use Umbrella’s resolvers: 208.67.222.222 and 208.67.220.220 for IPv4, or 2620:119:35::35 and 2620:119:53::53 for IPv6.
- Anycast routes it to the nearest data centre. The same IP addresses are announced from Cisco data centres worldwide, so the query lands at the closest one.
- Umbrella identifies who is asking. This could be the network’s public IP, an internal user via a virtual appliance, or a device running the Umbrella module in Cisco Secure Client.
- A policy decision is made. The domain is checked against security categories, content categories and destination lists for that identity.
- Umbrella answers. An allowed domain gets its real IP address. A blocked domain gets the IP address of the Umbrella block page. On DNS Advantage, a risky domain can be sent to the selective proxy for deeper URL and file inspection.
Ways to send traffic to Umbrella
| Method | Best for | Traffic covered |
|---|---|---|
| Router or DHCP DNS settings | Offices and guest Wi-Fi | DNS for the whole network |
| Virtual appliances | Networks with internal DNS and Active Directory | DNS, with per-user and internal IP visibility |
| Cisco Secure Client (Umbrella module) | Laptops and remote workers | DNS, and web traffic with SIG |
| IPsec tunnel | Branches and SD-WAN sites on SIG | Web and firewall traffic |
| PAC file or proxy chaining | Browser-only secure web gateway use | Web traffic |
What happens on the SIG packages
With SIG Essentials or SIG Advantage, web traffic is also sent to the secure web gateway. There it can be decrypted, scanned by antivirus and file analysis, checked against URL and application rules, and inspected by DLP. Non-web traffic from tunnelled sites passes through the cloud-delivered firewall, and on SIG Advantage through intrusion prevention as well.
Where the intelligence comes from
Umbrella’s verdicts combine Cisco Talos threat research with statistical models run over Umbrella’s global DNS traffic. These models are good at flagging newly registered, algorithmically generated or fast-changing domains used by malware and phishing.