If your network security allows users to change the local DNS IP server address to something other than Umbrella's IP addresses, savvy users may try to bypass Umbrella in this way. However, it should be possible to not allow those other DNS services through your network firewall to the Internet, which will prevent these users from circumventing the protection.
Most routers and firewalls will allow you to force all DNS traffic over port 53 on the router, thus requiring everyone on the network to use the DNS settings defined on the router (in this case, Umbrella's DNS servers). The preferred recommendation is to forward all DNS requests to of non-Umbrella IPs to go to the IP's listed below instead. This way, you simply forward' people's DNS requests without them knowing, instead of having the possibility of someone manually configuring DNS and having it just not work.
Alternately, create a firewall rule to only allow DNS (TCP/UDP) to Umbrella's servers and restrict all other DNS traffic to any other IPs.
Essentially, add the following filter or rule to the firewall that is at the edge of the network:
ALLOW TCP/UDP IN/OUT to 220.127.116.11 or 18.104.22.168 on Port 53
BLOCK TCP/UDP IN/OUT all IP addresses on Port 53
The first rule trumps the second rule, so anything requests to Umbrella are allowed but any DNS requests to any other IP are blocked.
- Depending on your firewall configuration interface, you may need to configure a separate rule for each of these protocols or one rule which covers them both.
- The rule can be applied on either the firewall or the router, but normally is best placed on the device most at network edge. A similar rule could be applied to software firewalls installed on a workstation as well, such as the built-in firewall on Windows or Mac OS/X.
Unfortunately, individual configurations are not something Cisco Umbrella Support is able to assist in supporting, as each firewall or router has a unique configuration interface and these vary greatly. If you are uncertain, you should check your router or firewall documentation or contact the manufacturer to see if this is possible with your device.
If available, it's a great idea to lock down your users with Active Directory Group Policy. To read how to lock down the Enterprise Roaming Client using Group Policy, click here.