About CptnCrnch

CptnCrnch

Let me guess: in case of Wifi, you're using another DHCP server than for wired connections? My guess is: your wired DHCP hands out the domain suffix (Option 15), whereas the Wifi one doesn't

CptnCrnch

First of all, MX and Umbrella embrace each other to provide in-depth security going much further as MX alone would be able to do. In a nutshell, if you're intersted in what Umbrella will provide you with on the DNS alone, take a look at The Leader in DNS Security for your Business - Cisco Umbrella More general information about Umbrellas other advantages will be shown on https://umbrella.cisco.com/products/cloud-security-service including its integration in Cisco's SASE vision.

CptnCrnch

Talking to customers, this is oftentimes the point when it comes to "but F..tinet does have DNS protection!". Well, yes Mr. customer. Sort of...but not even halfway comparable to what Umbrella provides you with. You will never ever get the visibility and breadth on an on-box solution as compared as to what a cloud service operating at a global scale will bring.

CptnCrnch

Oh boy, I'm so much lookung forward to attending an i-person Cisco Live again... 😌

CptnCrnch

Where is your XenApp server located? Somewhere on the Internet or some DMZ internally? It'd be really helpful to understand your setup a little bit better. Would you be able to show us a picture?

CptnCrnch

I'd also believe that there won't be a noticable difference in performance. Never tried it though because from a security point of view, I'm seeing very little advantage. As @BrandonS already said, this normally leads to an increased count of troubleshooting tickets.

CptnCrnch

@rbnielsenWhy would you (as a company) announce some brand new piece of hardware that would be capable of leveraging a new standard and not tell anyone? Doesn't make sense to me... 😉

CptnCrnch

Policy Objects are an Organization-wide feature.

CptnCrnch

Using Syslog, you'll see URL information but not DNS requests. Using Umbrella would increase your security a lot, but would possibly be a quite expensive solution when it comes down to logging only. 😉

CptnCrnch

Interesting: I'm completely unable to find anything newer than 28.1

CptnCrnch

Thanks so much guys for these fantastic achievements! Man, you gotta love this community! 😎

CptnCrnch

When I tested this, failover to LTE was instantly. Perhaps that's why you don't find any specific times. 🙂

CptnCrnch

I'd take bets this has something to do with MAC address randomization: https://appleinsider.com/articles/20/09/17/ios-14-mac-randomization-privacy-feature-may-cause-cisco-enterprise-network-issues

CptnCrnch

ASA is my typical go-to platform when it comes to S2S VPN because it handles almost everything flawlessly.

CptnCrnch

I'm also using Policy Objects for quite a while, especially for complex environments. As @KarstenI stated, I wouldn't want to miss this within these networks. Luckily enough, I didn't have any bigger hickups using that feature.

CptnCrnch

Yeah, it requires the so called "Authentication Proxy" that connects your user login (via RADIUS), your AD and Duo cloud. But it's the same thing with NPS (whoever actually wants to use this piece of software). You'll get a Plugin that enables you to use Azure MFA.

CptnCrnch

Yes, though not natively. With Duo for example, this is being handled by their AuthProxy component acting as the RADIUS server: https://duo.com/docs/cisco

CptnCrnch

OK, I guess that something is blocking these. Are you getting error messages in the Security Center?

CptnCrnch

You'd always want to use your internal DNS servers for resolving internal destinations. With Umbrella, you have the chance to resolve every external DNS request directly and still be protected by Umbrella wherever you are. This also solves other issues like "local" M365 access for endpoints that roam internationally: by letting them resolve everything not internally resolvable via Umbrella, the client will always receive the "nearest" Microsoft datacenter.

CptnCrnch

That's exactly my point (if I'm not completely getting you wrong): by tunneling your DNS requests via your HQ, you're missing this features functionality. From my point of view: 1) You're in the HQ and are protected by your local DNS servers forwarding to Umbrella. Verything is working as you'd expect 2) You're off-site and relying on your VPN connection. By letting your endpoint querying Umbrella directly (without pushing DNS over the tunnel), you're evenly protected, at least if your policies are set up accordingly.

CptnCrnch

Hey Matt, before delving deeper into TND, let me start by describing my preferred setup: In most cases, I tend to solve this one by using " Traffic Forwarding on Umbrella Protected Networks". This way, the Umbrella module will realize that it's within a protected network and will not activate itself. Everytime the client is roaming, it will be protected even if your VPN connection to the headquarter is off. Much simpler (in my point of view) and because you don't have to fiddle around with all the bells and whistles regarding TND. Apart from that, it raises your security because it doesn't matter if your VPN is running or not. If this is not what you want, we can continue to assist you with your troubleshooting. 🙂

CptnCrnch

Have you configured IPS on your MX? Could you please show us Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention

CptnCrnch

Another possibility: Is your DB connection up and running and being torn down after a while? Even more so after having been idle? If so, this would be typical firewall behaviour: long running idle TCP sessions are typically held for an hour. At least, thanks is something I‘ve seen a lot regarding databases connections. Fix for that: implement TCP keepalives on your DB server.

CptnCrnch

Each way of distributing automatic Anyconnect updates will interfere with existing VPN sessions. The only way to change that would be having the software downloaded and only started without a running VPN session, possibly via scripting

CptnCrnch

Even better than! Our own experience with Umbrella‘s Anyconnect module are really great, also our customers are lovin it. Tunneling everything into your HQ and having a central internet breakout / centralized DNS is clearly on the decline with cloud services especially like Microsoft 365. It really helps you to keep up (or even lift up) your overall security posture. Having an Auto Update in place is just an added bonus then. 😉

CptnCrnch

Community Record

Badges