Active Directory Integration – Step 3: Connect Active Directory to Umbrella

Back to Table of Contents | Step 2: Prepare your Active Directory Environment

Connect Active Directory to Umbrella

The purpose of the Connector is to monitor one or more Domain Controllers. It listens to user and computer logins via the security event logs and subsequently enables IP-to-user and IP-to-computer mappings on the Virtual Appliances. It synchronizes user-to-group, computer-to-group and group-to-group memberships with the Umbrella Security Cloud, enabling you to create and enforce group-based settings and view user, computer, and group-based reports.

The connector helps import your Active Directory Users, Groups and Computers to provide these mappings. Other Active Directory objects, including Organization Units (OUs) are not imported.   

If you are interested in having Active Directory integration support OUs in a future release, please submit your request to our Feature Requests section of the Knowledge Base.

Install the Connector

1. From the Umbrella dashboard, navigate to Settings > Sites and Active Directory.
2. Click download components to expand the section, then download the Windows Service archive.
   Note: You must download the ZIP file to the local machine where you plan to run it or copy it locally from another machine. Issues have been observed attempting to install the connector from networked drives as well as running the setup.msi directly from the compressed file.
3. As an Admin, extract the contents of the ZIP file you downloaded to a folder.
4. Navigate to that folder.
5. Run setup.msi.
6. Enter the password you configured for the OpenDNS_Connector user you created. (See Prerequisites.)
7. Follow the setup wizard prompts.
8. When finished, click Close.
9. Return to the dashboard.

Verify the Connector Syncs with the Dashboard

If the Connector does not appear in the dashboard and port 443 is confirmed to be open to api.opendns.com, ccrl3.digicert.com, and crl4.digicert.com, the DC may be missing the DigiCert CA. To confirm, visit https://api.opendns.com/v2/OnPrem.Asset in the browser and if a certificate error is presented, download and install the latest DigiCert Global Root CA from DigiCert here and restart the Connector service. If it does not appear, contact support. 

1. When you return to the dashboard, you will see the hostname of the Domain Controller or other Windows machine that you installed the Connector on the Settings > Sites and Active Directory page.
2. The Umbrella Security Cloud automatically configures and connects the VAs to the Domain Controllers via the Connectors for each configured site, and the status of all of your VAs, AD Servers, and Connectors should change from “Inactive”  to “Active” . If not, contact support.
3. Navigate to Policies > Policy List.
   • The Domain Controllers (or other Windows machine) should automatically synchronize user and computer group memberships, and any subsequent changes, with Umbrella via the Connector. You can verify that this has occurred successfully by clicking the + (Add) icon and confirming that your groups are present.
   • You should see all of your AD Groups, included those nested within other groups, within the identity picker of the policy wizard.
   • If you don’t see your groups, check the Settings > Sites and Active Directory page to see if the status of all components is ‘Active’ . If not, contact umbrella-support@cisco.com.
      
     
      

     Note:

     It can take up to 10 minutes for large numbers of AD user, computer and group objects to synchronize for the first time. During this time, the Connector status icon may appear as red () until the initial sync is complete. After the sync completes, it will be labeled as "Active" .

      
      

Verify all Active Directory Components are Operational

1. Before continuing, confirm that you can resolve DNS traffic by entering the following command that sends a query to opendns.com through your VA: 
   

   C:\>nslookup > server {{enter the IP of one of your VA's}} > opendns.com

2. You can further verify DNS traffic by entering the following command to send a TXT Record query to debug.opendns.com through the VA:

   > set type=TXT > debug.opendns.com > exit

   This query returns a string of information if you are going through the VA. If you receive a non-existent domain result from that query, there is still something wrong with your configuration and you should contact support.

    

Next section: Step 4: Configure Policy via Dashboard