Cisco umbrella VA config

To configure Virtual appliance (VA), enter configuration mode (CTRL+B)

config va name umbrella01 (this name is just a label)

config va interface 172.16.0.6 255.255.255.0 172.16.0.1

config localdns add 172.16.0.8 (DC1)

config localdns add 172.16.0.9 (DC2)

From

https://docs.umbrella.com/deployment-umbrella/docs/appendix-d-troubleshooting-the-va-using-a-restricted-shell#section-use-configuration-mode-to-troubleshoot

Config auto updates

Need 2 VAs'

FW access to the URLS in setup doc

Config Deployments > Configuration > Sites and Active Directory.

Settings button top right

Auto upgrade

cisco webex softphone sign-in not working on cisco umbrella VA DNS servers

This is down to how cisco/webex resolves DNS. Depending on config it can be looking for external DNS records which need to resolve.

We already had an internal AD domain added (customer.com) in the umbrella dashboard as part of the internal domains.

On a working cap we saw it look for 

_collab-edge._tls.customer-ext.com which didn't resolve

Then it looked for

_cisco-uds._tcp.customer-ext.com

which did resolve to the customer ucm server IP's (this must have been resolve by internal DC/DNS)

On the "not working" capture

Wireshark showed a SRV record 

_cisco-uds._tcp.customer-ext.com was attempting to get resolved by the client but getting a "No such name" back from a public DNS server. It tried to resolve on the internet.

We needed to go into the DC and edit DNS on the external domain customer-ext.com

We also added the customer-ext.com to the internal domains in the umbrella dashboard.

Find DNS queries that didn't return an answer

(!(dns.flags.rcode==0))&&(dns.flags.response==1)  

cisco umbrella firewall rules

object-group network UmbrellaVAs
network-object host 10.53.0.71
network-object host 10.53.0.72


object-group network UmbrellaVA_Destination
network-object host 208.67.220.220
network-object host 208.67.222.222
network-object host 208.67.222.220
network-object host 208.67.220.222
network-object host 67.215.71.201
network-object host 146.112.255.155
network-object host 91.189.94.4
network-object host 91.189.89.199
network-object host 91.189.91.157
network-object host 91.189.89.198
network-object 67.215.92.0 255.255.255.0
network-object object ocsp.digicert.com
network-object object crl4.digicert.com
network-object object disthost.opendns.com
network-object object disthost.umbrella.com
network-object object s.tunnels.ironport.com

object-group service Umbrella_Ports tcp-udp
port-object eq domain
port-object eq 443
port-object eq www
port-object eq 123
port-object eq 22
port-object eq 25
port-object eq 5353
how is this even working?

test if a URL is blocked cisco umbrella

nslookup internetbadguys.com

Check the IP returned. If its one of the block IPs listed below

https://support.umbrella.com/hc/en-us/articles/115001357688-What-are-the-Cisco-Umbrella-Block-Page-IP-Addresses-

DNS checking website

https://www.whatsmydns.net/

useful for checking if 3rd party has created the txt record or not when setting up SSL certs with godaddy.

the txt record needs to be created on the main .domain.com not subdomain.domain.com

Use nslookup to find the IP addresses of the domain controllers

You can use Nslookup is a command-line tool that displays information you can use to diagnose Domain Name System (DNS) infrastructure.

1. Click Start, and then click Run.
2. In the Open box, type cmd.
3. Type nslookup, and then press ENTER.
4. Type set type=all, and then press ENTER.
5. Type _ldap._tcp.dc._msdcs.

slowness on login to linux server

Had a server which was taking 10 seconds to login after moving it from a hub to a VLAN on a switch. Sub interfaces were also created on the ASA.

Checked all the speed and duplex on the switch ports and server all looked good.
Linux command for checking network card info
sudo ethtool eth0

Sent some large ping packets back and forth was fine.

Found the issue was /etc/resolv.conf
The server couldn't reach the DNS servers configured in there

We changed the DNS servers to reachable ones and the issue was resolved.

The server must have been trying to resolve our IP address during login.

How long does DNS take to propagate and short bash script to test after changing DNS entries

I was changing a customer's DNS to point at a new public IPs. They were concerned about how long it would take to switch over. The DNS provider told me they usually tell customers it will be complete in their network within 24 hours and they can't control outside of that. They said normally the DNS change will take effect immediately and should have propagated out across the internet within 24 hours so this covers them with customers.

Wrote a short bash script to do an nslookup so we could see the new public IP's and a curl to show the website was up.

echo "**********************************************"
echo "nslookup on my.customer.com"
echo "**********************************************"
echo " "
nslookup my.customer.com
echo " "
echo "**********************************************"
echo "curl on my.customer.com, expecting http 200 OK"
echo "**********************************************"
echo " "
curl -IL my.customer.com
echo " "

finding the time to live TTL on a DNS record in windows

If you need to find the time to live on a DNS record in windows you can click
start -> administrative tools -> DNS
Click View -> Advanced
Now right click on your record and click properties
The TTL will be displayed

Alternatively
nslookup -q=a -debug www.mydomain.com

nslookup -q=mx -debug email.mydomain.com

nslookup -q=ns -debug ns.mydomain.com

In linux you can use the dig command