Can I exclude a SSID from Cisco Umbrella Policy?

[DMLUX1]

We have Cisco umbrella integrated with our Meraki firewalls.    My question is can we exclude guest SSIDs using Meraki DHCP?     

[DarrenOC]

Hi @DMLUX1 , this document should help:

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Manually_Integrating_...)

[DMLUX1]

This document does a good job explaining how to add an umbrella,  my question is how can it be excluded from SSIDs.    Once it is added firewall it covers everything.  

[cmr]

If you are adding it to the MX, you can exclude the subnet.

1) ensure AP management IP addresses are in their own subnet, separate from all other traffic.

2) exclude that subnet from umbrella, as per the documentation linked to by @DarrenOC.

As the Meraki DHCP clients will appear to the MX with the APs IP address, they will be excluded.  If you have another SSID using Meraki DHCP, then it will also be excluded, so change it if you don't want that.

[Brash]

I may be having a brain fart - is there a way to exclude subnets from forwarding DNS requests to Umbrella? You can exclude domains, but I didn't think there was a place to exclude subnets as such.

[cmr]

I was referring to your option 2 - using group policies.  I think that should work?

[Brash]

True, that's probably the easiest way to do it - using group policies to apply Umbrella only to subnets you specifically want it on.

I recently deployed it using option 1 which worked just fine, the idea being that Umbrella was preferred on all clients of a network unless excluded via group policies.

[Brash]

It kind of depends where you're integrating Umbrella.

1. On the MX (under Threat Protection)
    - Adding the Umbrella integration here should intercept DNS requests from all clients and proxy them to Umbrella (except for domains added to the exclusions list). If there are clients you don't want this to apply to, you can assign a group-policy to them (Eg. via the VLAN) which will then exclude them from this behaviour.

2. On the MX (via Group Policies)
  - Adding the Umbrella integration in the group policy will only apply it to clients that are assigned that group policy (directly or via VLAN or AD etc.)

3. On the MR (via SSID)
  - This will apply the Umbrella integration only on clients connected on that SSID.


In your scenario, if you have integration on the MX via Threat Protection, and are using Meraki DHCP for clients, this means that the client's DNS requests are seen by the MX as coming from the MR's management IP address. The only way to exclude these from Umbrella would be to create a group policy and apply it to the Meraki AP management subnet.
The group policy itself should be able to use network defaults for all of the settings but not have any Umbrella integration applied to it.