Yes. Blocking websites is one of Cisco Umbrella’s main jobs. It can block sites because they are dangerous, because they fall into a category your organisation does not allow, or because an administrator has put them on a custom list. How precisely it can block depends on whether you use DNS-layer security alone or the full secure web gateway.
How blocking works at each layer
| Layer | How it blocks | Granularity |
|---|---|---|
| DNS-layer security | Instead of the real IP address, Umbrella answers the DNS query with the address of its block page. | Whole domain or subdomain only. |
| Selective proxy | Risky domains are routed through a proxy that can block specific URLs or malicious files. | URL level, for grey-listed domains only. |
| Secure web gateway | All web traffic is proxied and, with decryption, inspected in full. | Full URL, file type, application and tenant. |
What administrators can block
- Security categories: malware, phishing, command and control callbacks, cryptomining, newly seen domains, DNS tunnelling and more. These are usually enabled for everyone.
- Content categories: groupings such as adult content, gambling, games, social networking or streaming, often used by schools and regulated businesses.
- Destination lists: custom allow and block lists of domains, URLs or IP addresses.
- Applications: on SIG packages, specific cloud apps or app features, such as blocking uploads to personal file-sharing accounts.
Policies can differ by network, Active Directory group, user or device.
Limits of DNS-based blocking
DNS-layer blocking is fast and works for every port and protocol, but it has blind spots:
- It cannot block a single page on an allowed domain, such as one video on a video site, without the proxy.
- Users can bypass it with a different DNS server, browser DNS over HTTPS (DoH), a personal VPN or by typing an IP address directly.
To close those gaps, block outbound DNS (port 53) to anything other than Umbrella on your firewall, block known DoH resolvers, and deploy the Umbrella module in Cisco Secure Client on managed laptops so protection follows them off network.
Customising the block page
You can brand the block page, add a message explaining why the site is blocked, and create bypass codes or bypass users so that approved staff can reach a blocked site temporarily. For HTTPS sites, install the Cisco Umbrella root certificate on devices so the block page displays without browser certificate warnings.