Cisco Umbrella
What is Cisco Umbrella?
Cisco Umbrella is a cloud-based security product that enforces security and blocks malicious activity before a connection is even established. As this solution is cloud based, there is absolutely no need of hardware installation. Cisco Umbrella is a cloud-delivered service, Umbrella provides the visibility needed to protect internet access across all the locations for all types of users and across all network devices.
Cisco Umbrella solution offers following services:
- Provides protection from malware, ransomware, or phishing attempts from malicious or fraudulent websites
- Provides protection for roaming users and devices, irrespective of their location and without the need to be connected to an office network.
- Enforces organization’s acceptable use policy, using inbuild content categories, as well as custom defined blacklist and whitelist.
- Integrated with Cisco AMP and Anti-virus engines to provide advance signature-based inspection.
- Provides real time security activity, to identify compromised systems and targeted attacks.
How does Cisco Umbrella Work?
Cisco Umbrella uses DNS (Domain Name System), to forward requests from our network to the Cisco’s Umbrella DNS. Whenever any device sends DNS requests to Cisco Umbrella resolvers, these requests are then analysed to detect threats and anomalies. For example, if umbrella sees that a device is sending requests for known bad domains then it is most likely that the device is compromised.
- When any user tries to open any website, to reach that website, the client’s machine would need to know the IP address of the website, to get IP address of the website, the machine will send DNS query which will be sent to Cisco’s Umbrella DNS resolvers.
- Umbrella will analyse the request to determine whether the website domain that the user is trying to access is safe or not. If the domain is safe, then Umbrella responds back with the IP address of the domain.
- If the domain user trying to visit is not safe then based on the configured policy, umbrella will respond back with the IP address of its Block page.
Umbrella is very easy to configure and can easily secure corporate users by redirecting DNS requests to Umbrella. Additionally, umbrella solution can also be deployed with the lightweight Umbrella Roaming Client, or the Cisco AnyConnect with Umbrella Roaming Security module. These roaming clients and security modules can secure both home and remote users, connecting through public Wi-Fi, without the need to connect to the corporate VPN.
LAB 1: Setting Up Cisco Umbrella
The objective of this lab is to set up Cisco Umbrella account as well as remote client.
Task 1: Creating account for Cisco Umbrella
Step 1: Go to Google Chrome Browser and browse to https://www.temp-mail.org/en/ to get a corporate-like email Id & note down the email you get (copy it)
**Do not put the mail ID shown below, use the one generated on your Machine
Step 2: In New Tab (Press Ctrl + T),Go to https://umbrella.cisco.com/ and register for free trial with the corporate account you got in Step 1.
Step 3: Get the email verified and created a password.
Note: Create any password you like but for the Lab we are creating Password: Ubuntu@2021
Task 2: Login into Cisco Umbrella Dashboard
Step 1: Go to https://www.login.umbrella.com/ and login with the account & password, for now we will skip all the other options shown, we will just add the IP address & download the Umbrella Client.
Task 3: Add new network to Cisco Umbrella account
Step 1: Go to Deployments > Core Identities > Networks > Add >
We will check “the network has dynamic IP Addresses”, but if we have a Static IP, we can uncheck this option.
Task 4: Download & Install Cisco Umbrella Remote Client
Step 1: Go to Deployments > Roaming Computers
Since we want to connect our local Windows Machine to Cisco Umbrella, we can either download Cisco Umbrella Remote Client or AnyConnect Umbrella Roaming Security Module. We will be using Cisco Umbrella Remote Client.
Step 2: After installation verify if the Device is Synced with Cisco Umbrella
Step 2.1: On Windows Machine
Step 2.2: On Cisco Umbrella cloud
Go to Deployment > Core Identities > Roaming Computers
After installation we will now automatically see Our Machine in the Roaming Computers Option (on Cisco Umbrella Dashboard). From here on, the client will now securely transfer all DNS related queried to Cisco Umbrella Cloud.
Task 5: Install Certificate signed by Cisco Root Certificate Authority
Step 1: Download Certificate from Cisco Umbrella Cloud dashboard
Go to Deployment > Configuration > Root Certificate
LAB 2: Configure Umbrella Policy & Custom Block Page
The objective of this lab is to configure security policy on Cisco Umbrella, to block E-Commerce and Gambling websites.
Task 1: Check websites are accessible or not
Step 1: Go to Google Chrome and check that both websites are accessible (check in Incognito Mode), after checking close all Incognito Tabs
Step 2: Now go to new tab (press Ctrl + T) and go to https://www.poker.com
Step 3: Close all tabs of incognito mode.
Task 2: Create a Custom Block Page
Step 1: Login to Cisco Umbrella Dashboard
Step 2: Add a new block page appearance
Go to Policies > Policy Components > Block Page Appearance
Step 3: Go to Policies > Management > All Policies > Default Policy
We have just created a custom block page, we will now set the custom page as default so that it can be used whenever client visits restricted site
Task 3: Block E-Commerce & Gambling Websites
Step 1: Go to Policies > Management > All Policies > Default Policy
Task 4: Sync Windows with Cisco Umbrella Cloud
Step 1: Check Sync time on Windows Machine & on Cisco Umbrella Dashboard
Step 1.1: On Windows Machine,
Step 1.2: On Cisco Umbrella Dashboard, Go to Deployment > Core Identities > Roaming Computers
Step 2: Stop Cisco Umbrella Clienton Windows Machine, Clear DNS cache & again start the Client service
**NOTE: Automatic Sync between Windows Machine & Cisco Umbrella Cloud takes about 5-12 Minutes, so syncing may take time, we will still forcefully try to sync by restarting the Client Service after 5-12min.
Step 3: Check Sync time on both devices (it should show “synced: few minutes ago”)
Step 3.1: On Windows Machine,
**NOTE: if u are not able to see last connected: “less than a minute ago” & IPv4 DNS Status : “Protected” then u will need perform above step [step 2] again. And if still have same problem , restart your Windows machine
Step 3.2: On Cisco Umbrella Dashboard, Go to Deployment > Core Identities > Roaming Computers
Task 5: Check websites are accessible or not
Step 1: Go to Google Chrome and check that both websites “https://www.amazon.com/ and https://www.poker.com” are accessible or not (check in Incognito Mode), after checking both websites close all Incognito Tabs
**If both websites are still accessible then you need to go back Task 4: and redo Step 2, maybe the sync was not done successful between Windows Machine & Cisco Umbrella Cloud.
Step 2: Now go to new tab (press Ctrl + T) and go to https://www.poker.com
Step 3: Close all tabs of incognito mode.
LAB 3: Create Bypass Key for Blocked Content on Cisco Umbrella
The objective of this lab is to create a bypass key on Cisco Umbrella to allow a specific user to access blocked website.
Task 1: Create a Bypass key
Step 1: Login to Cisco Umbrella Dashboard
Step 2: Create a bypass code
Go to Admin > Bypass Codes > Add >
**In code expiry put the date and time according to the day you are performing Lab. [put next day date & time (Recommended)]
Note down the CODE it will be used in further steps
Step 3: Select Bypass code for Block Pages under Block Page Setting, so that it can be used whenever block page appears
Go to Policies > All Policies > Default Policies > Custom Block Page Applied > Edit
Task 2: Sync Windows with Cisco Umbrella Cloud
Step 1: Check Sync time on Windows Machine & on Cisco Umbrella Dashboard
Step 1.1: On Windows Machine,
Step 1.2: On Cisco Umbrella Dashboard, Go to Deployment > Core Identities > Roaming Computers
Step 2: Stop Cisco Umbrella Clienton Windows Machine, Clear DNS cache & again start the Client service
**NOTE: Automatic Sync between Windows Machine & Cisco Umbrella Cloud takes about 5-12 Minutes, so syncing may take time, we will still forcefully try to sync by restarting the Client Service after 5-12min.
Step 3: Check Sync time on both devices (it should show “synced: few minutes ago”)
Step 3.1: On Windows Machine,
**NOTE: if you are not able to see last connected: “less than a minute ago” & IPv4 DNS Status: “Protected”, then you will need to perform above step [step 2] again. If still problem persists, then restart your Windows machine.
Step 3.2: On Cisco Umbrella Dashboard, Go to Deployment > Core Identities > Roaming Computers
Task 3:** **Verify Accessing blocked websites with Bypass Code
Step 1: Go to Google Chrome and verify, if for blocked websites its showing “Administrative Bypass” or not (check in Incognito Mode). *After checking both websites close all Incognito Tabs
**If website is not showing “Administrative Bypass” then you need to go again to Task 4: and redo Step 2, maybe the sync was not done successfully between Windows Machine & Cisco Umbrella Cloud.
Step 2: Now go to new tab (press Ctrl + T) and go to “https://www.poker.com”
Step 3: Close all tabs of incognito mode.
LAB 4: Configure Ransomware Protection on Cisco Umbrella
The objective of this lab is to provide DNS based Ransomware Protection using Cisco Umbrella Cloud.
Task 1: Disable Umbrella Client from Windows Machine
**Step 1:**In Windows Machine, go to CMD and disable Umbrella Client
Task 2: Check If Malicious Websites are accessible or not
Step 1: Go to Google Chrome and check if malicious websites are accessible or not(check in Incognito Mode), after checking close all Incognito Tabs
http://maliciouswebsitetest.com/
Step 2: Close all Incognito Window
Task 2: Check Malware policies on Cisco Umbrella Dashboard
Step 1: Login to Cisco Umbrella Dashboard
Step 2: Check Malware policy for websites
Go to Policies > Management > Default Policy > All Policies >
Step 3: Enable “Malware” & “Potentially Harmful Domains” Policies
Task 3: Enable Cisco Umbrella Client on Windows Machine
Step 1: Go to CMD in Windows Machine and enable Umbrella Client
**NOTE: Sync process between Windows Machine & Cisco Umbrella Cloud takes about 5-12 Minutes, so syncing may take time, so start the Client Service after 5-12min.
Step 2: Check Sync time on both devices (it should show “synced: few minutes ago”)
Step 2.1: On Windows Machine,
**NOTE: if you are not able to see last connected: “less than a minute ago” & IPv4 DNS Status : “Protected” then you will need restart Cisco Umbrella Client. If still problem persists then restart your Windows machine.
Step 2.2: On Cisco Umbrella Dashboard, Go to Deployment > Core Identities > Roaming Computers
Task 4: Check Malicious Websites are accessible or not
Step 1: Go to Google Chrome and check if malicious websites are still accessible or not (check in Incognito Mode), after checking close all Incognito Tabs
http://maliciouswebsitetest.com/
**If website is still accessible then you need to again restart umbrella on your machine, maybe the sync was not done successfully between Windows Machine & Cisco Umbrella Cloud
Task 5: Check logs/Activities on Cisco Umbrella Dashboard
Step 1: Check logs
Go to Reporting > Core Reports > Activity Search
