Active Directory Integration – Appendix C: Communication Flow and Troubleshooting

Back to Table of Contents | Previous section: Appendix B: Configuring AD Servers on Windows Server 2003 R2

 

Understanding the communication flow of Umbrella Active Directory integration

As our integration spans several areas of your Active Directory (AD) configuration, it can be helpful to understand the flow of communication between each of the operational components. This can assist in troubleshooting or ensuring that your environment is properly configured pre-deployment.

 

When the Connector script is run on a DC

The Windows Connector script will make a one-time connection from the domain controller (DC) to the Umbrella cloud on port TCP/443 using HTTPS. This is to register the DC to the dashboard so the Connector knows about it. We make a call to https://api.opendns.com with some specific parameters.

Once the script successfully registers the DC you should see it listed at Settings > Sites and Active Directory. 

We have previously seen issues that can be related to the "Root Certificate Updates" on Windows. A quick way to determine if you are seeing this behavior is to open Internet Explorer and point the browser to https://api.opendns.com/v2/OnPrem.Asset

The page should provide a message similar to "1005 Missing API key." If there are any certificate errors or warnings seen on that page, make sure you have the latest "Root Certificates Update" from Microsoft installed.

 

How the AD Connector communicates with the Umbrella Cloud service or a Virtual Appliance

Connector > Cloud

The Connector will upload all the Active Directory (AD) data every two minutes if there are changes, using an HTTPS connection on port 443 TCP. We only upload information on Groups/Users/Computers; no passwords are uploaded and all user information is hashed locally so the data is unique to us. Although data is submitted to the Umbrella cloud service every two minutes, changes can take up to several hours to appear in the dashboard.

Connector > Virtual Appliances

The Connector constantly sends AD events to the Virtual Appliances (VAs) using port 443 TCP. This is also a one-way communication; the appliances will not talk back to the Connectors. Logs from the Connector are sent to the VAs on port 8080 TCP.

 

Connector > Domain Controllers

The Connector will talk to all Domain Controllers that are located in the same site using ports 389 TCP and 3268 TCP/UDP for LDAP sync. The Connector also communicates with the domain controllers using RPC/WMI. In general, port 135 TCP is the standard port for RPC and WMI.

Based on your AD version, WMI also uses a randomly assigned 'ephemeral' port: either between 1024 TCP and 65535 TCP for Windows 2003 and older or between 49152 TCP and 65535 TCP for Windows 2008 and above.

If any issues are seen around communication, we usually recommend checking for any Layer-7 application proxies that might be blocking/dropping some data. A common case is the inspect feature on Cisco devices that act on protocols such as DNS/HTTP/HTTPS:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/inspect.html

 

Virtual Appliances (VAs) to the cloud, other internet destinations, and internal DNS servers

The VAs will frequently communicate with the Umbrella APIs on port 443 TCP to api.opendns.com. They will also receive updates from disthost.opendns.com on port 443. The VAs receive data from the Connectors on port 443 TCP but do not require communication back to the Connector.

Additionally, the VAs need to communicate on ports 443, 80 and 2222 TCP in order to establish a support tunnel. The VA will also forward internal DNS requests to your internal DNS servers. Please ensure port 53 UDP is open between the VA and your internal DNS server.

The following table lists ports with source/destination of the request and the function of the request.

 

Port	Source/Destination	Function
53/UDP 53/TCP	208.67.222.222, 208.67.220.220  (outbound) Local clients (inbound) Internal DNS (outbound)	Send and Receive DNS queries.  Outbound DNS queries to Umbrella will be encrypted using DNSCrypt if possible and thus may trigger packet inspection rules.
443/TCP	api.opendns.com disthost.opendns.com (outbound)	Initial registration with the OpenDNS API and the Umbrella dashboard. Automatic Updates Health status reporting in Umbrella dashboard.
123/TCP	ntp.ubuntu.com	NTP. Used only during boot.
80/TCP	*ocsp.digicert.com *crl4.digicert.com	Required for SSL Revocation verification as part of the HTTPS handshake.
2222/TCP or 80/TCP or 443/TCP	67.215.92.28 (outbound)	Connect to Umbrella's SSH hub, allowing Support to log in and perform troubleshooting in case of an issue with the VAs. Please see the bottom of this article for more information about the SSH tunnel.

 

 

  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Note: The Digicert domains resolve to various IP addresses based on a CDN and are these subject to change. As of current, these domains resolve to the following IPs: 72.21.91.29, 117.18.237.29, 93.184.220.29, 205.234.175.175/

Port	Source	Function
443/TCP 8080/TCP	AD Connector  (inbound)	Send information relating to login events and IP addressing. This traffic occurs over 443/TCP, but is not an HTTPS connection. Many IDS and IPS systems will flag this traffic as suspicious; if you're running an IDS or IPS that is listening on the local network, check the enforcement logs to ensure this traffic is not getting blocked.

 

 

 

 

If you are utilizing AD components (as opposed to just using the VAs for Internal IP address granularity), the following extra inbound network traffic will also occur from the AD Connector Service.

AD Connector Service

Port	Source/Destination	Function
389/TCP 3268/TCP 135/TCP 1024-65535/TCP (Server 2003) 49152-65535/TCP (Server 2008/2012)	AD Servers (Domain Controllers) (outbound)	WMI/RPC/DCOM communication between Domain Controllers. LDAP syncing
443/TCP  (Non-SSL) 8080/TCP	Virtual Appliances (outbound)	Send information relating to login events and IP addressing. It's very important to note that this traffic occurs over 443/TCP, but is not an SSL connection. Many IDS and IPS systems will flag this traffic as suspicious; if you're running an IDS or IPS that is listening on the local network, check the enforcement logs to ensure this traffic is not getting flagged.
443/TCP	api.opendns.com disthost.opendns.com (outbound)	Initial registration with the OpenDNS API and the Umbrella dashboard. Automatic Updates Health status reporting in Umbrella dashboard.
80/TCP 80/UDP	*ocsp.digicert.com *crl4.digicert.com (outbound) crl.comodoca.com ocsp.comodoca.com crl.usertrust.com ocsp.usertrust.com	Required for SSL Revocation list verification as part of the HTTPS handshake. The crl. and ocsp. subdomains are required to maintain the Online Certificate Status Protocol (OCSP) and  certificate revocation lists (CRL)  portion of the SSL Revocation.

*Note: The Digicert domains resolve to various IP addresses based on a CDN and are these subject to change. As of current, these domains resolve to the following IPs: 72.21.91.29, 117.18.237.29, 93.184.220.29, 205.234.175.175

 

AD Servers (Domain Controllers)

 

Port	Source/Destination	Function
389/TCP 3268/TCP 135/TCP 1024- 65535/TCP (Server 2003) 49152-65535/TCP (Server 2008/2012)	AD Connector(s) (inbound)	WMI/RPC/DCOM communication between Domain Controllers.  LDAP Syncing
443/TCP	api.opendns.com (outbound)	Initial registration with OpenDNS API.
80/TCP	*ocsp.digicert.com, *crl4.digicert.com  (outbound)	Required for SSL Revocation list verification as part of the HTTPS handshake.

*Note: The Digicert domains resolve to various IP addresses based on a CDN and are these subject to change. As of current (September 2016) these domains resolve to the following IPs: 

72.21.91.29, 117.18.237.29, 93.184.220.29, 205.234.175.175

 

What does the Umbrella Windows Connector script do?

The Windows Connector script simply sets specific user permissions for the OpenDNS_Connector user. When that user is deleted, the script's impact is deleted. If you are running the script in a very strictly controlled AD environment, some administrators may not be permitted to run VB scripts. In that case, please contact Support. 

 

Visual Overview

The following diagram provides a general outline of how traffic flows between components in the Umbrella Active Directory Integration:

 

 

SSH Support Tunnel: Information about allowing or blocking the tunnel

To assist with troubleshooting and support, the VA also attempts to establish a support tunnel back to Umbrella. This support tunnel is an SSH tunnel originated by the VA to a particular terminating server which only privileged support personnel can access. Access to this terminating server is extremely restricted, and valid keys must exist on the server to obtain access. In addition, the server can only be accessed from within the Umbrella network space.

This SSH tunnel is optional and is not required for the VA to function properly. You may prevent the support tunnel from being opened by disallowing port 2222 TCP, port 80 TCP and port 443 TCP & UDP to 67.215.92.28.

Be aware however, blocking the establishment of the tunnel will limit the ability of support personnel to help troubleshoot and fix remote issues with your virtual appliance. Support personnel may request the port be opened when diagnosing issues. The IP of the SSH Support tunnel hub may change at our discretion, but we will proactively communicate out to let customers know.