Cisco umbrella install and setup doc's

Good Youtube setup video

https://www.youtube.com/watch?v=8B7xP6wV9dg

AD
https://docs.umbrella.com/product/umbrella/1-ad-integration-setup-overview/

Prereqs (firewall rules)
https://docs.umbrella.com/product/umbrella/2-prerequisites/

Setting up the VA's
https://docs.umbrella.com/product/umbrella/3-setup-dns-forwarding-with-your-vas/

https://docs.umbrella.com/deployment-umbrella/docs/active-directory-integration-with-the-virtual-appliances

Troubleshoot doc's:

AD connector

https://support.umbrella.com/hc/en-us/articles/230902468-Provide-Support-with-AD-Connector-Logs

On the DC's you need to run an script (connect to VA) and install a windows service so it can look in on AD users. You also need an  OpenDNS_Connector user setup in AD.

In umbrella dashboard
AD server  = Script (needs to be assigned to VA after its run)
AD Connector = service

More Docs:

AD integration VA vs Roaming client

https://support.umbrella.com/hc/en-us/articles/115004651366-AD-Integration-Delivery-via-VA-vs-Roaming-Client

By default the roaming client will switch itself off when it detects a VA on the LAN with it "VA backoff" this default option can be changed.

https://support.umbrella.com/hc/en-us/articles/230901168#VirtualAppliance

Comms flow (good diagrams on how it works)

https://docs.umbrella.com/deployment-umbrella/docs/appx-a-communication-flow-and-troubleshooting

Why use VA

https://docs.umbrella.com/deployment-umbrella/docs/1-introduction#section-why-should-i-use-virtual-appliances

VA setup guide

https://docs.umbrella.com/deployment-umbrella/docs/2-prerequisites-1#section-networking-requirements

Limitations

Umbrella can't work with RDS/citrix where multiple users are logging into the same server this is because the user ID it got from the login event. The work around is to create an internal network object for that server and assign it to a policy with a higher priority. Every user will have the same access from that one policy.

https://docs.umbrella.com/deployment-umbrella/docs/8-sites-and-internal-networks

RDP, when you RDP to a server the source IP shows as the server you RDP'd from not the server you RDP'd to. This can lead to identity switching issues

Prepare AD

https://docs.umbrella.com/deployment-umbrella/docs/4-prepare-your-active-directory-environment

Summary steps

Set domain controller DNS forwarders to umbrella 

208.67.222.222 (resolver1.opendns.com)

208.67.220.220 (resolver2.opendns.com)

Remove any other DNS forwarders from other ISP etc.

In each windows domain

Run the script on each DC (get files from umbrella dashboard)

Install the AD connector (get files from umbrella dashboard)

You only need to install one AD connector but two is a good idea. You can put one on each DC if you like.

Setup OpenDNS_Connector user. Record password in PW manager.

Install 2 VA's in VMware. (get files from umbrella dashboard)

You need 2 VA because you need to give out DNS servers

You need VA's for user ID

VA Install

Download OVA from Dashboard

Open VMware

Deploy the OVA file

Should be next, next finish to deploy the ova

CTRL + B to get into config mode

exit to get out of config mode (need to wait a little bit)

default password Is Umbrella[orgid] eg Umbrella1234567

OrgID can be got from the dashboard URL /o/123456

You will be asked to change password. Won't be able to paste. PW must be recored.

config va name <name>

config va interface <ipaddress> <netmask> <gateway>

config localdns add 192.168.1.10

config localdns add 192.168.1.20

Create firewall rules to allow your VA's and DC's out to umbrella

Ensure OSCP sites are allowed also

Assign your VA's and DCs to a site in umbrella cloud

Configure any internal domains needed (internal DNS servers need to be able to resolve)

Block top level domains (.ru .cn .cc .xyz etc)

https://docs.umbrella.com/deployment-umbrella/docs/add-top-level-domains-to-destination-lists

careful of 

.co (columbia but can block .com, .co.uk as well)

.io (used by tech)

.ai (used by ai tech)

.in (India, used linked.in, logme.in)

Block anonymizer app category

Policies -> Policy components -> application settings

Edit default settings

Tick Anonymizer

Click Save

Then go to Policies -> Management -> DNS policies

Edit your policy

Edit the Application Setting applied -> Tick Anonymizer (or select default settings)

Click Save

Create umbrella DNS policies (will need customer input)

Cisco recommends most specific to least (this may not work for you but a good starting point)

1 - AD user policies (to specific users)

2 - AD group policies (to AD groups)

3 - Roaming computer (roaming computer ID's)

4 - Network / site (can setup internal networks /24 etc and /32 for hosts)

5 - Default policy (if we didn't match any other ID, give the default)

Check cloud for any issues with DCs/VA's and resolve

Set update window and upgrade VA's to latest

In the umbrella dashboard set the auto-upgrade window watch out for the time zone. Also upgrade your VA's (one at a time) to the latest software version

DNS config

Workstations and non-DC Servers

- set the DNS servers to VA IPs

DCs

- DNS servers set to loopback (127.0.0.1) and other DC IP

- External forwarders set to umb external servers 208.67.220.220 and 208.67.222.222

On Prem Mail servers

The other exception to that are mail servers, on-prem mail servers aren't as common these days:

Mail servers

 - DNS servers set to loopback and other DC(s)

Change DHCP

Change DHCP/deploy a script to set all clients to use the VA's as their DNS servers.

Change firewall rules 

Only allow internal DNS to VA IPs

Only allow external DNS to umbrella IPs. Block/log other DNS.

208.67.222.222 (resolver1.opendns.com)

208.67.220.220 (resolver2.opendns.com)

You may want a temp rule to allow IT to use 8.8.8.8 (google) or 1.1.1.1 (cloudflare) for testing or temp admin tasks.