Most Cisco Umbrella problems come from how it interacts with the rest of the network: internal DNS, VPNs, TLS inspection and devices that try to bypass it. The table below covers the most frequent ones and their fixes.
Common issues and fixes
| Issue | Likely cause | Fix |
|---|---|---|
| Internal sites or servers stop resolving | Queries for internal domains are going to Umbrella’s public resolvers. | Add the domains to the Internal Domains list, or forward internal zones to your local DNS through virtual appliances. |
| Certificate warnings instead of the block page | The device does not trust the Cisco Umbrella root certificate. | Deploy the root CA to devices through Group Policy, Intune, Jamf or your MDM. |
| Apps break when the secure web gateway is on | The app uses certificate pinning or does not accept TLS interception. | Add its domains to the selective decryption list or as external domains. |
| Umbrella module shows as disabled or unprotected | A full-tunnel VPN, trusted network detection, a missing OrgInfo.json file or blocked connectivity to Umbrella. | Check the module’s status in Secure Client and confirm the OrgInfo.json file is deployed. |
| Module goes inactive behind a corporate firewall | The firewall is decrypting or blocking Umbrella’s own service domains. | Exclude the Umbrella, OpenDNS and certificate validation domains from TLS inspection. |
| Network identity shows “Inactive” | No DNS queries from that public IP in 24 hours, often because a dynamic IP changed. | Update the IP in the dashboard, use the dynamic IP updater, or protect the site with virtual appliances or Secure Client. |
| Users bypass filtering | Browser DNS over HTTPS, hard-coded DNS servers or personal VPNs. | Block outbound port 53 and known DoH resolvers at the firewall, and disable DoH by browser policy. |
| Legitimate new sites are blocked | The “newly seen domains” security category or a miscategorisation. | Use Activity Search to confirm, then allow the domain or request a recategorisation. |
Troubleshooting tools worth knowing
- welcome.umbrella.com confirms whether a device is using Umbrella.
- nslookup -type=txt debug.opendns.com returns details such as the Umbrella data centre and your organisation ID.
- Activity Search in the dashboard shows which policy and category applied to each request.
- The Umbrella diagnostic tool collects connectivity results to send to Cisco support.
Preventing issues in the first place
A staged rollout avoids most of these problems. Pilot DNS-layer security first, build your Internal Domains list, deploy the root certificate before enabling decryption, and test VPN scenarios before going wide.