With Cisco AnyConnect Client 4.8.01090, it may report DNS Protection Status is in protected state, but Web Protection Status is in unprotected state. This article explains the difference between each feature and the reason for Web Protection in unprotected state
Cisco AnyConnect 4.8.01090 now supports the Umbrella SWG service!
This requires an Umbrella SIG Essentials, SIG Advantage or SIG add-on subscription. Once the subscription is active the AnyConnect endpoint client will activate the Umbrella SWG service.
However, customers who do not have a SIG-based subscription and install AnyConnect 4.8.01090 will see Umbrella SWG statistics placeholders and a message stating they are unprotected.
This unprotected message only applies to the Umbrella SWG service, the DNS protection is still applied normally and is unaffected by the Umbrella SWG service not being active (or reporting the unprotected status). Future versions of AnyConnect will provide clearer messaging as to the state and protection level of Umbrella.