Active Directory Integration – Prerequisites

Back to Table of Contents

Prerequisites

To support the Umbrella Insights Active Directory integration, you must have the following virtual server and Active Directory environment configured. 

Virtualized Server Environment

First, ensure you've met the requirements for the Virtualized Server Environment. We currently support VMWare ESX or ESXi server and Microsoft Hyper-V for Microsoft Server 2008 R2, 2012 or 2012 R2.

Note: The Virtual Appliance is not supported on Windows Server 2016 or Hyper-V for Microsoft Server 2016.

System Requirements for VMWare:

• VMware ESXi 4.1 update 2 (or newer) to create the Virtual Appliances (VAs).
• Your ESXi server host is set to the correct date and time for predictable VA behavior.
• Your ESXi server host has one CPU core, 512MB of RAM and 6.5GB of hard disk drive space available to be provisioned per VA instance. If you intend to run with four CPUs or more, you must have at least 1536MB (1.5GB) of RAM provisioned. 
• We require a minimum of two VAs per site to be deployed for high availability in case of outage or upgrade to the VA. "Site" refers to a localized contiguous subnet without NAT between the VA and the network.
• If you're interested in scaling requirements beyond this, click here for additional information. 

System Requirements for Microsoft Hyper-V:

• Windows Server 2008 R2 Server with the Hyper-V Role or Hyper-V Server 2008.
• Windows Server 2012 (Standard or Data Center), Windows Server 2012 SP1 (Standard or Data Center) or Windows Server 2012 R2 (Standard or Data Center) with Hyper-V role installed and configured
• Your Windows server is set to the correct date and time for predictable VA behavior.
• In addition to the minimum required hardware to run Windows Server itself, we recommend:
  • an additional 512MB of RAM for each VA. If you intend to run with four CPUs or more, you must have at least 1536MB (1.5GB) of RAM provisioned. 
  • allocation of  7GB of disk space for each VA
  • an additional CPU core for each VA.
    Note: This may not be necessary if the server provisioned for Hyper-V is highly spec'd.
• We require a minimum of two VAs per site to be deployed for high availability in case of outage or upgrade to the VA. A "site" refers to a localized contiguous subnet without NAT between the VA and the network.
• If you're interested in scaling requirements beyond this, click here for additional information. 

• Windows Server 2008, 2008 R2, 2012, 2012 R2, or 2016 with the latest service packs and 100MB free hard disk drive space.
• .NET Framework 3.5, 4.0 or 4.5.
• If a local anti-virus application is running, the processes OpenDNSAuditClient.exe and OpenDNSAuditService.exe should be whitelisted.

NOTE: Windows Server 2003 is not an officially supported operating system. This documentation outlines how to install the AD Integration with 2003, but this is provided for reference only. While production deployments using Windows Server 2003 may work, they are not encouraged.

 

IMPORTANT!

Read Only Domain Controllers (RODCs) should not have the script run on them, or have the Connector installed. RODCs can be present in a domain and will report as Identities, but should not be used for the Active Directory Integration and are not supported.

 

• Only a single domain environment. (child domains or trusts are currently not supported). 
  •  Multi-domain environments require a multi-dashboard experience. Please contact umbrella-support@cisco.com with information regarding your domain structure if you have any questions about whether it is supported. Umbrella has the ability to support multiple domains under the multi-org console.
  
  

  When deploying Umbrella Insights Active Directory Components at more than one WAN-linked (MPLS-type network) AD site, repeat steps 1-5 after verifying a complete, functioning installation at current site before moving on to the next.

• A new user account with:
  • The logon name (aka sAMAccountName) set to OpenDNS_Connector.
  • The box ‘Password never expires’ checked.
  • A password entered without backslashes, quotations (single or double), greater-than or less=than chevron characters ("<", ">") or colon characters.
  • Make sure the OpenDNS_Connector user is a member of the following groups and if not, please add the missing ones:
    • Event Log Readers
    • Distributed COM users
    • Enterprise Read-only Domain Controllers

    For environments on Windows Server 2003 and Windows Server 2003 R2, those groups do not exist. Please go to Appendix B and complete several manual steps.

Network Environment

For an overview of how the network topology is expected to work, as well as the flow of traffic, please see Appendix C of this documentation.  

Umbrella API Access
All Umbrella components (including Virtual Appliances, Connectors and Domain Controllers) require access to the Umbrella API. The following network requirements must be in place:

• 443 (TCP) to api.opendns.com
• Access to additional URLs on port 80/443 (TCP) may be required for Windows to perform Certificate Revocation List and Code-Signing checks. For a complete list of ports please see Appendix A – Communication Flow And Troubleshooting.

Domain Controllers
Each Active Directory domain controller (excluding Read-Only DCs) needs to perform a one time registration with the Cisco Umbrella API. For the registration script to succeed access to the Umbrella API must be available.

Connector Server
A Connector must be installed at each Umbrella site on a Windows server or workstation. The purpose of the Connector is to read information from the registered Domain Controllers and report this to the Virtual Appliance and Umbrella API. In addition to the requirements above, the Connector needs the following access:

1. 443 (TCP) to the Virtual Appliances

2. 8080 (TCP) to the Virtual Appliances

3. LDAP Sync: the Connector Server will talk to all Domain Controllers that are located in the same site using ports 389 TCP and 3268 TCP/UDP for LDAP sync. The Connector also communicates with the domain controllers using RPC/WMI. In general, port 135 TCP is the standard port for RPC and WMI.
   Based on your AD version, WMI also uses a randomly assigned 'ephemeral' port: either between 1024 TCP and 65535 TCP for Windows 2003 and older or between 49152 TCP and 65535 TCP for Windows 2008 and above

Virtual Appliance
The primary function of the Virtual Appliance is to send DNS requests to external Umbrella resolvers and to Internal DNS servers. In addition to the requirements above, the Appliance needs the following access:

• 53 (TCP/UDP) to 208.67.220.220, 208.67.222.222, 208.67.222.220 and 208.67.220.222. Please note that these ports are used to establish DNSCrypt; additional information is below.
• 53 (TCP/UDP) to the Internal DNS servers
• 123 (UDP) 91.189.94.4 and 91.189.89.199 (Canonical's Ubuntu NTP servers)
• 2222 (TCP) to 67.215.92.0/24. (Optional for SSH support tunnel under the old model)
• 22, 25, 53, 80, 443 or 4766 (TCP) to s.tunnels.ironport.com (Required for the customer-initiated SSH support tunnel)

Updates
Both the Connector and the Virtual Appliance are capable of automatic updates. To download updates these components need access to the following URL:

• 443 (TCP) to disthost.opendns.com
• 443 (TCP) to disthost.umbrella.com

Additional Considerations

Do not place devices with network address translation (NAT), or that in any manner obfuscates the internal IP address, between hosts and the Virtual Appliance per site.
If you are using a transparent HTTP web proxy, ensure that the above URLs on port 80/443 are excluded from the proxy, and not subject to authentication.

DNSCrypt and the Virtual Appliance:

The Virtual Appliance supports DNSCrypt between itself and Umbrella public DNS resolvers. This means any information contained in the EDNS packets forwarded from the VA are encrypted by DNSCrypt and cannot be intercepted. This feature is enabled by default for best protection.

Unencrypted traffic is considered a problem that should be resolved. When encryption cannot be established between your VA and Umbrella, a warning will display in your dashboard. Encryption is established with a probe sent on port 53 (UDP/TCP) to 208.67.220.220 and 208.67.222.222 and if you have a firewall or IPS/IDS doing deep packet inspection and expecting to see only DNS traffic, the probe may fail. In other words, the encrypted packets may not match the expected traffic on that port. Please review your firewall configuration if that is the case and open a case with Support if you believe that you are allowing this traffic.

Next section: Step 1: Setup DNS Forwarding via Virtual Appliances