Automatically Integrating Cisco Umbrella with Meraki Networks

Overview

Automatic Umbrella integration allows Meraki administrators to link their Meraki dashboard with the Cisco Umbrella dashboard effortlessly and easily assign predefined Umbrella content filtering and security policies to protect wireless clients from malicious content or unwanted web resources.

Once you assign desired Umbrella policies, MR access points will intercept all DNS requests from wireless clients and redirect them to Cisco's Umbrella for evaluation. Based on the disposition from Umbrella, the client’s request will either be allowed or blocked.

Prerequisites

This integration is available in both per-device (PDL) and co-termination (Co-Term) licensing models.

Predefined Umbrella Policies in the Meraki Dashboard

There are seven predefined Umbrella policies, which consist of different combinations of security settings and content filtering.

Security & Appropriate Use Filtering

• Security & Full Appropriate Use Filtering

• Security & Basic Appropriate Use Filtering

• Security Filtering Only

• Security & Moderate Appropriate Use Filtering (Default)

Appropriate Use Filtering

• Full Appropriate Use Filtering

This policy is targeting a corporate SSID use case with the most restrictive content policies. Corporate employees should not have access to categories like Alcohol, Chat, Dating, Drugs, Gambling, Games, Instant Messaging, Lingerie/Bikini, Nudity, Photo Sharing, Pornography, Social Networking, Video Sharing, and others. 

• Moderate Appropriate Use Filtering

This policy is meant for the guest SSID use case. Content settings for this category will allow users to access common chat apps (e.g. Facebook Messenger, WhatsApp), file storage platforms (e.g. box.com, dropbox.com), photo sharing (e.g. instagram.com), social networking (e.g. facebook.com, twitter.com), and video sharing (e.g. youtube.com) while being blocked from visiting Drugs, Gambling, Hate/Discrimination, Lingerie/Bikini, Nudity, Pornography, Terrorism, Weapons, and other content categories that should not be accessed on a typical guest wireless network.

• Basic Appropriate Use Filtering

This policy is meant for school environments. Students will be protected from viewing inappropriate content, while still being allowed to do the necessary research for their classwork or homework.

Provisioning Automatic Umbrella in Co-term and PDL Organizations

Please follow these steps to provision Automatic Umbrella:

1. Claim an appropriate quantity of MR Advanced licenses or MR Enterprise + MR Upgrade licenses on the Organization > Configure > License info page. Licenses also need to be assigned to specific APs in a PDL organization.
2. Go to the Wireless > Configure > Firewall & Traffic shaping page and click the Enable Umbrella protection button. 

   3. Select the checkmark next to Automatically provision Umbrella and click the Auto Provision button.

   4. Confirm that you want to provision Automatic Umbrella.

5. Wait a few minutes for the provisioning process to complete. 

Enabling Automatic Umbrella Integration on an SSID

1. Navigate to Wireless > Configure > Firewall & traffic shaping
2. Select the SSID from the dropdown on the top of the page.
3. Link your Meraki organization to the Umbrella organization we automatically provisioned for you in the previous step to retrieve the list of the predefined Umbrella policies. 

   4. Select the desired predefined policy and save the changes at the bottom of the page. 

Disabling Automatic Umbrella Integration on an SSID

To disable Umbrella protection on an SSID

1. Navigate to Wireless > Configure > Firewall & traffic shaping
2. Select the SSID from the dropdown on the top of the page.
3. Go to Block applications and content categories and click Disable Umbrella protection. 

4. Confirm your desired changes by clicking Yes and save changes on the bottom of the page.

 

DNS Umbrella Exclusions

While it’s impossible to customize predefined Umbrella policies, it’s possible to exclude some domain names from Umbrella protection. 

1. Navigate to Wireless > Configure > Access control
2. Select the desired SSID from the dropdown on the top of the page
3. Select Bridge mode: Make clients part of the LAN in the Addressing and traffic section
4. Save changes on the bottom of the page.

1. Navigate to Wireless > Configure > Firewall & traffic shaping
2. Select the SSID from the dropdown on the top of the page.
3. Go to Block applications and content categories
4. Add the desired domain names that should be excluded from Umbrella protection.
5. Save changes on the bottom of the page.

DNS requests for excluded domains are not redirected to Umbrella and are forwarded to the DNS server specified by the client. This behavior is beneficial for preventing DNS requests for local resources from being sent to Umbrella instead of allowing them to reach internal DNS servers to resolve correctly. MRs automatically add the '.local' and 'in-addr.arpa' domains to be excluded from Umbrella redirection by default.

Enabling Automatic Umbrella Integration via Group Policy

1. Navigate to Network-wide > Configure > Group Policies > Add a group
2. Type a name for the Group Policy.
3. Go to Firewall and traffic shaping section and select Custom SSID firewall and shaping rules.

 4. Save changes on the bottom of the page.

5. Navigate back to the newly created policy.

6. Select Link Umbrella to [Group Policy name] under DNS layer protection (Cisco Umbrella).

 8. Select a desired predefined policy from the dropdown.

 9. Save changes on the bottom of the page

Applying Group Policy with Umbrella Protection to Wireless Clients

1. Navigate to Network-wide > Monitor > Clients 
2. Click on the client and select Different policies by SSID
3. Select your Group Policy name. Click Save under the Device policy drop-down.
4. Click Save

Disabling Automatic Umbrella Integration in a Group Policy

1. Navigate to Network-wide > Configure > Group Policies and select the desired group policy
2. Click Disable Umbrella protection under DNS layer protection.

  3. Click Yes in the dialog box to confirm that you wish to enable Umbrella integration.

 4. Save changes on the bottom of the page

Umbrella DNS Protection Traffic Flow

This section describes the expected DNS traffic flow after Umbrella policies have been applied to a wireless client on either SSID-level or group policy-level.

1. A client sends a DNS query for the desired domain name (e.g., twitter.com).

2. Upstream MR access point intercepts the DNS query and attaches an Umbrella identifier to it, allowing Umbrella to determine which policy to enforce.

3. MR then encrypts the DNS query using DNSCrypt, source NATs the packet to the MR management IP, and redirects it to the appropriate Umbrella resolver.

4. Once received, the Umbrella resolver decrypts the DNS query and enforces the appropriate Umbrella policy (based on the attached identifier).

5. Umbrella returns an encrypted DNS response with the appropriate IP if the request is allowed per configured policy.

6. If the request should be blocked, Umbrella returns an encrypted DNS response pointing to the Umbrella block page IP address.

7. The client is sent to the desired domain name (e.g. twitter.com) or Umbrella Block page based on the applied policy.

Blocking HTTPS Websites

Some websites (e.g., twitter.com, facebook.com, instagram.com, dropbox.com) have an HTTP Strict Transport Security (HSTS) security policy. This policy means that a website does not allow HTTP connections. So, for example, if a user types “dropbox.com” in the web browser address bar, which usually implies http://dropbox.com, the browser will automatically connect to https://dropbox.com.

As explained below, this presents a unique challenge for displaying an Umbrella block page.

If a user tries to visit an HTTPS website by typing "https://example.com," or if the website has an HSTS security policy (e.g., dropbox.com), the following will happen:

1. The client machine sends a DNS query for dropbox.com asking for an IP address.

2. Upstream MR access point intercepts the DNS query and attaches an identifier to it, allowing Umbrella to determine which policy to enforce.

3. MR then encrypts the DNS query using DNSCrypt, source NATs the packet to the MR management IP, and redirects it to the appropriate Umbrella resolver.

4. Once received, the Umbrella resolver decrypts the DNS query and enforces the appropriate Umbrella policy (based on the attached identifier).

5. Let’s say that “Full Appropriate Use Filtering” is applied to the SSID and, therefore, https://dropbox.com (File Storage) should be blocked.

6. Umbrella will return an encrypted DNS response pointing to the Umbrella block page IP address (e.g., 146.112.61.106). This response will be decrypted by the MR and sent to the client.

7. The client will try to establish a TLS session with 146.112.61.106 (Umbrella server) IP address received in the DNS response.

8. Umbrella’s block page presents an SSL certificate to browsers that make connections to HTTPS sites. The certificate will match the requested site name (Common Name - CN) but will be signed by the Cisco Umbrella Root Certificate Authority (CA). If this CA is not trusted by your browser, an error may be displayed. For example, you can see the TLS certificate presented by OpenDNS, Inc. for dropbox.com here:

As you can see, the main issue here is that “Cisco Umbrella Root CA” is not trusted.

9. Here is an example of what we would see in the Wireshark packet capture taken on the client machine:

10. Most modern browsers (like Chrome, Firefox, Safari) will prevent users from accessing a website with an untrusted/unexpected TLS certificate. Typical errors include: "Your connection is not private" (Chrome), "Did Not Connect: Potential Security Issue" (Firefox), or “Safari Can’t Open the page” (Safari). Although the error is expected, the messages displayed can confuse end-users.

We recommend installing Cisco Root Certificate on client machines to avoid these errors. This certificate can be installed per browser or device for personal use or small deployments. In addition, an automatic installation through GPO can be done for larger deployments. Note that the automated installation will only work for Internet Explorer, Edge, or Chrome users on Windows systems. If your network includes users on Firefox or Safari browsers, the manual installation procedures must be followed.

Once you have installed the Cisco Root Certificate, users will be presented with Umbrella Block Page even for HTTPS and HSTS websites.

.

 

Using the Security Center to View MR DNS Events

The Meraki Security Center provides reporting functionality for MR DNS events for all networks in the organization. To view these reports, navigate to Organization > Monitor > Security Center > MR DNS Events.

It’s possible to search for a particular blocked website by adding "uri:" to the search string (e.g. “uri:exampleadult.com”) or a particular blocked client by adding "client:" to the search string (e.g. client:192.168.219.13).

You can also use the Filter option to filter DNS events by type (Content or Security) and/or action (Allowed or Blocked).