{"id":24250,"date":"2026-11-02T15:45:16","date_gmt":"2026-11-02T07:45:16","guid":{"rendered":"https:\/\/cciedump.spoto.net\/blog\/?p=24250"},"modified":"2026-11-02T15:45:18","modified_gmt":"2026-11-02T07:45:18","slug":"how-cisco-umbrella-works","status":"publish","type":"post","link":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html","title":{"rendered":"How Cisco Umbrella Works"},"content":{"rendered":"<p>Modern enterprise networks no longer operate within the safe confines of a physical perimeter. With workforces distributed across branch offices, home workstations, and public Wi-Fi, traditional backhauling of web traffic through centralized corporate data centers introduces latency, degrades application performance, and leaves remote endpoints vulnerable. Cisco Umbrella solves this challenge by delivering security directly from the cloud. Originally developed around recursive DNS routing through the OpenDNS acquisition, Umbrella has expanded into a full Secure Internet Gateway (SIG) and Security Service Edge (SSE) platform. By combining recursive DNS inspection, a cloud-delivered firewall, a full secure web proxy, and cloud application security, Umbrella acts as a scalable, cloud-delivered checkpoint between users and the public internet.<\/p>\n<hr>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_17 counter-hierarchy counter-decimal ez-toc-light-blue\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" style=\"display: none;\"><i class=\"ez-toc-glyphicon ez-toc-icon-toggle\"><\/i><\/a><\/span><\/div>\n<nav><ul class=\"ez-toc-list ez-toc-list-level-1\"><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#How_DNS-Layer_Security_Intercepts_and_Resolves_Queries\" title=\"How DNS-Layer Security Intercepts and Resolves Queries\">How DNS-Layer Security Intercepts and Resolves Queries<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Cisco_Umbrella_Secure_Internet_Gateway_SIG_Architecture\" title=\"Cisco Umbrella Secure Internet Gateway (SIG) Architecture\">Cisco Umbrella Secure Internet Gateway (SIG) Architecture<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Deploying_Endpoint_Protection_for_Remote_Workers\" title=\"Deploying Endpoint Protection for Remote Workers\">Deploying Endpoint Protection for Remote Workers<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Verifying_and_Testing_Cisco_Umbrella_Enforcement\" title=\"Verifying and Testing Cisco Umbrella Enforcement\">Verifying and Testing Cisco Umbrella Enforcement<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Step_1_Query_Resolver_Debug_Records_via_CLI\" title=\"Step 1: Query Resolver Debug Records via CLI\">Step 1: Query Resolver Debug Records via CLI<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Step_2_Validate_System_Registration_via_Browser\" title=\"Step 2: Validate System Registration via Browser\">Step 2: Validate System Registration via Browser<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Step_3_Test_Security_Threat_Blocking\" title=\"Step 3: Test Security Threat Blocking\">Step 3: Test Security Threat Blocking<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Step_4_Validate_Content_Filtering_and_Intelligent_Proxy\" title=\"Step 4: Validate Content Filtering and Intelligent Proxy\">Step 4: Validate Content Filtering and Intelligent Proxy<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Step_5_Decode_Block_Page_Diagnostic_Data\" title=\"Step 5: Decode Block Page Diagnostic Data\">Step 5: Decode Block Page Diagnostic Data<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Cisco_Umbrella_vs_Zscaler_Internet_Access_vs_Cloudflare_Gateway\" title=\"Cisco Umbrella vs. Zscaler Internet Access vs. Cloudflare Gateway\">Cisco Umbrella vs. Zscaler Internet Access vs. Cloudflare Gateway<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Package_Tiers_and_Licensing_Architecture\" title=\"Package Tiers and Licensing Architecture\">Package Tiers and Licensing Architecture<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Administrator_Documentation_and_API_Reference_Directory\" title=\"Administrator Documentation and API Reference Directory\">Administrator Documentation and API Reference Directory<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Administrative_Portals_and_Core_Documentation\" title=\"Administrative Portals and Core Documentation\">Administrative Portals and Core Documentation<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Cisco_DevNet_Cloud_Security_REST_APIs\" title=\"Cisco DevNet Cloud Security REST APIs\">Cisco DevNet Cloud Security REST APIs<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\/#Conclusion\" title=\"Conclusion\">Conclusion<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"How_DNS-Layer_Security_Intercepts_and_Resolves_Queries\"><\/span>How DNS-Layer Security Intercepts and Resolves Queries<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The foundation of Cisco Umbrella is its Domain Name System (DNS) layer security. DNS is the first step in virtually every internet communication: before an endpoint can open an IP connection, download a file, or negotiate an SSL\/TLS handshake, it must resolve a human-readable domain name into an IP address. Umbrella leverages this fundamental protocol to enforce security at the earliest possible stage of network activity.<\/p>\n<pre><code>+--------------------------------------------------------------------------------------------------+\n|                                Cisco Umbrella DNS Resolution Flow                                |\n+--------------------------------------------------------------------------------------------------+\n\n  [ Endpoint \/ Network ]\n             \u2502\n             \u2502  1. DNS Query (UDP\/TCP 53 or DoH\/DoT)\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Cisco Umbrella Anycast Resolvers                                \u2502\n  \u2502  (208.67.222.222 \/ 208.67.220.220)                               \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u2502  2. Identify Source &amp; Evaluate Policy (IP \/ Agent \/ AD User)\n             \u2502  3. Consult Cisco Talos Threat Intelligence Engine\n             \u25bc\n      [ Destination Classification ]\n             \u2502\n             \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n             \u2502                       \u2502                               \u2502\n             \u25bc                       \u25bc                               \u25bc\n      Safe \/ Whitelisted       Malicious \/ Blocked             Risky \/ Grey Domain\n             \u2502                       \u2502                               \u2502\n   Returns Real IP (A\/AAAA)   Returns Block Page IP           Returns Cloud Proxy IP\n             \u2502                (146.112.61.106)                (146.112.0.0\/16)\n             \u25bc                       \u25bc                               \u25bc\n   Direct Fast Connection     Browser Displays Block Page     Redirected to Selective Proxy\n                              No Malware Downloads            (Full URL &amp; File Inspection)\n<\/code><\/pre>\n<p>The DNS-layer inspection and resolution process proceeds through five sequential phases:<\/p>\n<ol>\n<li><strong>Query Redirection to Anycast Resolvers:<\/strong> Network routers, local DNS forwarders, or endpoint roaming clients direct all outbound DNS queries (UDP\/TCP port 53, or encrypted DNS over HTTPS\/TLS) to Cisco Umbrella&#8217;s global Anycast IP addresses (<code>208.67.222.222<\/code> and <code>208.67.220.220<\/code>, alongside IPv6 addresses <code>2620:119:35::35<\/code> and <code>2620:119:53::53<\/code>). Anycast routing steers the request to the nearest Umbrella data center, minimizing resolution latency.<\/li>\n<li><strong>Identity Determination:<\/strong> When the query arrives at an Umbrella resolver, the platform identifies the source identity. This identity is extracted from the egress public IP address, a site-specific network tag, internal Active Directory (AD) user and group metadata transmitted by an internal Virtual Appliance (VA), or a unique cryptographic token from an endpoint agent.<\/li>\n<li><strong>Threat Intelligence Evaluation:<\/strong> Before sending the request upstream to authoritative nameservers, Umbrella cross-references the requested domain against real-time threat data supplied by Cisco Talos. Talos analyzes over 600 billion daily internet requests, tracking malicious infrastructure, newly registered domains, algorithmic domain generation (DGA) patterns, and known command-and-control (C2) servers.<\/li>\n<li><strong>Policy Enforcement and Categorization:<\/strong> Umbrella evaluates the organization&#8217;s customized policy rules against the resolved domain. These policies include security categories (malware, phishing, cryptomining), content categories (gambling, adult content, streaming media), and custom allow\/block lists.<\/li>\n<li><strong>Resolution Branching:<\/strong> Depending on the classification, Umbrella returns one of three responses to the client:<\/li>\n<li><strong>Safe Domain:<\/strong> Umbrella queries authoritative nameservers, caches the result, and returns the legitimate A or AAAA record. The endpoint connects directly to the destination web server without proxy overhead.<\/li>\n<li><strong>Malicious or Blocked Domain:<\/strong> Umbrella drops the real address and returns the IP address of an Umbrella Block Page server (such as <code>146.112.61.106<\/code> or <code>block.opendns.com<\/code>). The client connects to the block page, which displays an administrative warning; no connection to the malicious server is ever established.<\/li>\n<li><strong>Risky or &#8220;Grey&#8221; Domain:<\/strong> For domains that are not explicitly classified as malicious but exhibit anomalous characteristics (such as newly registered hosting domains or dual-use file-sharing services), Umbrella invokes its <strong>Intelligent Proxy<\/strong>. Instead of the real IP, Umbrella returns a proxy IP address in the <code>146.112.0.0\/16<\/code> range, routing subsequent HTTP\/HTTPS traffic through deeper inspection engines.<\/li>\n<\/ol>\n<p><strong>Section Takeaway:<\/strong> By inspecting and filtering requests at the recursive DNS resolver layer, Umbrella terminates threats before an underlying IP connection is ever established, conserving bandwidth and protecting endpoints across all protocols.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Cisco_Umbrella_Secure_Internet_Gateway_SIG_Architecture\"><\/span>Cisco Umbrella Secure Internet Gateway (SIG) Architecture<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>While DNS-layer security stops a large percentage of malicious connections, advanced threats often conceal payloads within legitimate content delivery networks, leverage IP-direct callbacks that bypass DNS, or use non-standard ports. To address these vectors, Cisco Umbrella operates as a comprehensive Secure Internet Gateway (SIG), providing multi-layer inspection that blends stateful network firewalling, full web proxying, cloud application control, and data protection into a unified processing chain.<\/p>\n<p>Traffic steering into the SIG architecture occurs via IPsec VPN tunnels from edge routers and SD-WAN appliances, explicit proxy configurations (PAC files), or endpoint client modules. Once traffic enters the cloud fabric, it traverses an inspection pipeline:<\/p>\n<pre><code>+--------------------------------------------------------------------------------------------------+\n|                            Umbrella SIG Unified Inspection Pipeline                              |\n+--------------------------------------------------------------------------------------------------+\n\n  Inbound Traffic (IPsec Tunnel \/ SD-WAN \/ PAC \/ Roaming Client)\n             \u2502\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Stage 1: DNS-Layer Pre-Filter                                   \u2502\n  \u2502  Instantly blocks known-bad domains before payload handling       \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Stage 2: Cloud-Delivered Firewall (CDFW)                        \u2502\n  \u2502  Inspects non-web traffic; L3\/L4 stateful filtering + L7 IPS    \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502 (Ports 80\/443 Web Traffic)\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Stage 3: Secure Web Gateway (SWG) Full Proxy                    \u2502\n  \u2502  Terminates HTTP\/S; executes SSL\/TLS decryption &amp; file analysis  \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n             \u25bc                                                       \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Stage 4: Cloud Access Security     \u2502 \u2502  Stage 5: Data Loss Prevention      \u2502\n  \u2502  Broker (CASB)                      \u2502 \u2502  (DLP) &amp; Isolation (RBI)            \u2502\n  \u2502  Uncovers Shadow IT &amp; granular app  \u2502 \u2502  Deep content inspection for PII\/   \u2502\n  \u2502  controls (read-only SaaS access)   \u2502 \u2502  PCI; renders risky code in cloud   \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u25bc\n  Egress to Clean Internet \/ Corporate Cloud Infrastructure\n<\/code><\/pre>\n<p>The inspection pipeline proceeds through five specialized components:<\/p>\n<ol>\n<li><strong>DNS-Layer Pre-Filter:<\/strong> Inbound traffic first passes through DNS filtering to drop requests destined for known malicious hosts. This filters high-volume noise upfront, freeing compute capacity for deeper payload analysis down the chain.<\/li>\n<li><strong>Cloud-Delivered Firewall (CDFW):<\/strong> Non-web outbound traffic and raw IP flows enter the CDFW over IPsec tunnels. The firewall enforces Layer 3 and Layer 4 stateful filtering by source IP, destination IP, port, and protocol. For organizations on advanced tiers, the CDFW applies Layer 7 application visibility and Snort-powered Intrusion Prevention System (IPS) rules, identifying and blocking non-web evasion techniques like DNS tunneling or SSH exfiltration.<\/li>\n<li><strong>Secure Web Gateway (SWG) Full Proxy:<\/strong> All web traffic traversing ports 80 and 443 is directed to a full proxy architecture. The SWG terminates the client session, performs full SSL\/TLS decryption using an enterprise root CA, and inspects the inner HTTP request headers and payload. Content is checked against URL-reputation engines, scanned for malware signatures, and passed to Cisco Secure Malware Analytics (AMP\/Threat Grid) for dynamic file sandboxing.<\/li>\n<li><strong>Cloud Access Security Broker (CASB):<\/strong> As web requests transit the proxy, the CASB engine identifies, catalogs, and categorizes active SaaS applications across the organization. It surfaces Shadow IT, calculates application risk scores based on vendor compliance profiles, and enforces granular tenant controls (such as allowing corporate Microsoft 365 logins while blocking personal OneDrive sessions).<\/li>\n<li><strong>Inline Data Loss Prevention (DLP) and Remote Browser Isolation (RBI):<\/strong><\/li>\n<li><strong>DLP:<\/strong> The outbound payload is scanned using pattern recognition, dictionary matches, and custom regular expressions to intercept unauthorized transmissions of sensitive data, such as Personally Identifiable Information (PII) or financial records.<\/li>\n<li><strong>RBI:<\/strong> When users visit uncategorized or potentially risky web destinations, Umbrella can route the session to an isolated container in the cloud. The target website executes within a secure cloud-hosted browser, streaming a sanitized vector\/pixel feed back to the user&#8217;s local browser to eliminate drive-by malware execution.<\/li>\n<\/ol>\n<p><strong>Section Takeaway:<\/strong> Cisco Umbrella SIG broadens pure DNS resolution into a complete Security Service Edge (SSE) pipeline, running network traffic through firewalling, deep packet proxying, CASB, and zero-trust content inspection.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Deploying_Endpoint_Protection_for_Remote_Workers\"><\/span>Deploying Endpoint Protection for Remote Workers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Deploying protection at the network edge works well for corporate facilities, but roaming laptops and remote workers bypass physical edge firewalls. To safeguard off-network employees without forcing all web traffic through an on-premises VPN concentrator, Cisco integrates Umbrella endpoint enforcement directly onto the client device.<\/p>\n<p>While legacy environments previously used the standalone Umbrella Roaming Client (which reached its official End-of-Support milestone in 2025), modern deployments standardize on the <strong>Cisco Secure Client<\/strong> (the evolution of Cisco AnyConnect) incorporating the <strong>Umbrella Roaming Security Module<\/strong>.<\/p>\n<pre><code>+--------------------------------------------------------------------------------------------------+\n|                   Cisco Secure Client: Local Loopback Redirection Flow                          |\n+--------------------------------------------------------------------------------------------------+\n\n  [ Endpoint OS Application \/ Browser ]\n             \u2502\n             \u2502 Generates DNS Query (e.g., example.com)\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Network Interface DNS Binding: 127.0.0.1:53                     \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Cisco Secure Client: Umbrella Roaming Security Module           \u2502\n  \u2502  - Intercepts packet locally on loopback                         \u2502\n  \u2502  - Appends OrgInfo.json identity token                           \u2502\n  \u2502  - Evaluates Trusted Network Detection (TND)                     \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n             \u2502 Off-Network \/ Direct Internet                         \u2502 On-Network (Corporate)\n             \u25bc                                                       \u25bc\n  Encapsulates &amp; Encrypts DNS Query               Defers to Local Corporate DNS\n  to Cisco Anycast Resolvers (208.67.222.222)     Resolvers for Internal AD Resolution\n<\/code><\/pre>\n<p>Administrators can deploy and manage this endpoint module using the following step-by-step process:<\/p>\n<ol>\n<li><strong>Obtain the Organization Identity Profile:<\/strong> Navigate to the Cisco Umbrella Dashboard under <strong>Deployments &gt; Roaming Computers<\/strong>. Download your tenant&#8217;s configuration profile, which contains the <code>OrgInfo.json<\/code> file. This JSON file stores your unique <code>organizationId<\/code>, registration token, and fingerprint hashes used to register endpoints to your administrative dashboard.<\/li>\n<li><strong>Package the Client Software:<\/strong> Download the Cisco Secure Client pre-deployment package for Windows or macOS. Use enterprise configuration management platforms (such as Microsoft Intune, SCCM, or Jamf Pro) to deploy the core VPN client package alongside the optional <code>Umbrella<\/code> module installer.<\/li>\n<li><strong>Provision the Profile File:<\/strong> Ensure the <code>OrgInfo.json<\/code> file is copied to the appropriate client directory during deployment:<\/li>\n<li><em>Windows:<\/em> <code>%ProgramData%\\Cisco\\Cisco Secure Client\\Umbrella\\OrgInfo.json<\/code><\/li>\n<li><em>macOS:<\/em> <code>\/opt\/cisco\/secureclient\/umbrella\/OrgInfo.json<\/code><\/li>\n<li><strong>Local Loopback Interception Mechanism:<\/strong> Once installed, the Umbrella module binds a local listening service to <code>127.0.0.1:53<\/code> (IPv4 loopback) and sets the active network adapter&#8217;s primary DNS server to this local address. All operating system DNS calls are intercepted by the local module, which injects cryptographic identity headers and transmits the query to Umbrella over encrypted tunnels.<\/li>\n<li><strong>Trusted Network Detection (TND) and Split Tunneling:<\/strong> When an employee joins the physical corporate network or activates a full-tunnel corporate VPN, the Umbrella module&#8217;s Trusted Network Detection senses the internal domain beacon. It automatically steps aside to allow internal enterprise DNS servers (such as local Active Directory domain controllers) to resolve private <code>.local<\/code> or internal domain names without conflict, re-engaging external protection as soon as the client disconnects.<\/li>\n<\/ol>\n<p><strong>Section Takeaway:<\/strong> The Cisco Secure Client Umbrella module secures roaming workers by intercepting DNS queries directly on the local loopback adapter, ensuring consistent policy enforcement wherever devices connect.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Verifying_and_Testing_Cisco_Umbrella_Enforcement\"><\/span>Verifying and Testing Cisco Umbrella Enforcement<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once network forwarding, edge tunnels, or roaming modules are configured, you must verify that DNS and web traffic are properly protected. Cisco provides official diagnostic endpoints, debug queries, and controlled simulation domains to validate active protection.<\/p>\n<p>Follow this sequential verification guide to test configuration and policy enforcement across your fleet:<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_1_Query_Resolver_Debug_Records_via_CLI\"><\/span>Step 1: Query Resolver Debug Records via CLI<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Open a terminal or command prompt and execute a diagnostic DNS lookup against the debug record to confirm that your local network adapter queries Cisco Umbrella resolvers rather than an unmanaged ISP resolver:<\/p>\n<p>On Windows:<\/p>\n<pre><code class=\"language-shell\">nslookup -type=txt debug.opendns.com\n<\/code><\/pre>\n<p>On Linux or macOS:<\/p>\n<pre><code class=\"language-shell\">dig txt debug.opendns.com\n<\/code><\/pre>\n<p>Examine the returned text records. A functional, registered client returns metadata strings containing:<br \/>\n&#8211; <code>dnscrypt enabled<\/code>: Confirms encryption between client and resolver.<br \/>\n&#8211; <code>actype<\/code>: Denotes the active license\/service tier.<br \/>\n&#8211; <code>org<\/code>: Displays your organization ID number.<br \/>\n&#8211; Any line starting with <code>server<\/code> confirming resolution through an Umbrella resolver node.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_2_Validate_System_Registration_via_Browser\"><\/span>Step 2: Validate System Registration via Browser<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Launch a web browser from the managed endpoint and navigate to the official configuration test page:<\/p>\n<pre><code>http:\/\/welcome.umbrella.com\n<\/code><\/pre>\n<ul>\n<li><strong>Successful Result:<\/strong> The page renders a prominent green checkmark with the message <em>&#8220;You are using Cisco Umbrella.&#8221;<\/em><\/li>\n<li><strong>Unsuccessful Result:<\/strong> An orange or red warning banner appears stating you are not currently utilizing Umbrella, indicating that local DNS settings, DHCP scopes, or roaming client services require troubleshooting.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Step_3_Test_Security_Threat_Blocking\"><\/span>Step 3: Test Security Threat Blocking<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>To verify that Talos security policies actively drop malicious destinations, navigate to Cisco&#8217;s designated, non-destructive test domains:<br \/>\n&#8211; <strong>Phishing Protection Test:<\/strong> <code>http:\/\/www.internetbadguys.com<\/code><br \/>\n&#8211; <strong>Malware Protection Test:<\/strong> <code>http:\/\/examplemalwaredomain.com<\/code><br \/>\n&#8211; <strong>Command &amp; Control Callback Test:<\/strong> <code>http:\/\/examplebotnetdomain.com<\/code><\/p>\n<p>If security enforcement is active, the browser will not resolve the destination server. Instead, it will be redirected to an Umbrella Block Page stating that access was denied for security reasons.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_4_Validate_Content_Filtering_and_Intelligent_Proxy\"><\/span>Step 4: Validate Content Filtering and Intelligent Proxy<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Navigate to <code>http:\/\/exampleadultsite.com<\/code> to confirm that content category filtering functions as intended. To verify that SSL decryption and the Selective\/Intelligent Proxy are operating on grey-list destinations, browse to:<\/p>\n<pre><code>https:\/\/ssl-proxy.opendnstest.com\/\n<\/code><\/pre>\n<p>Inspect the browser&#8217;s TLS certificate chain. If the Intelligent Proxy is functioning with SSL inspection enabled, the certificate will be signed by your organization&#8217;s custom Cisco Umbrella Root CA rather than the public certificate authority.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_5_Decode_Block_Page_Diagnostic_Data\"><\/span>Step 5: Decode Block Page Diagnostic Data<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If a legitimate site is unexpectedly blocked or you need to audit which rule triggered an event, click the <strong>Diagnostic Info<\/strong> drop-down link at the bottom of any rendered Umbrella block page. Note the following parameters:<br \/>\n&#8211; <code>Bundle ID<\/code>: Identifies the policy bundle applied to the request.<br \/>\n&#8211; <code>Identity ID<\/code>: Identifies the user, network, or roaming profile linked to the request.<br \/>\n&#8211; <code>Host<\/code>: Displays the specific classification engine (e.g., <code>malware.opendns.com<\/code> vs. <code>block.opendns.com<\/code>).<\/p>\n<p>Copy the <code>Bundle ID<\/code> into the Umbrella Dashboard search bar to pull up the exact policy rule responsible for the block.<\/p>\n<p><strong>Section Takeaway:<\/strong> You can systematically validate Umbrella deployments using CLI debug records, the <code>welcome.umbrella.com<\/code> status page, and official threat-simulation domains to ensure security and content filtering policies are working properly.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Cisco_Umbrella_vs_Zscaler_Internet_Access_vs_Cloudflare_Gateway\"><\/span>Cisco Umbrella vs. Zscaler Internet Access vs. Cloudflare Gateway<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Selecting an enterprise cloud security solution requires evaluating platform architecture against your existing network topology. Organizations assessing Cisco Umbrella typically compare it against <strong>Zscaler Internet Access (ZIA)<\/strong> and <strong>Cloudflare Gateway (Cloudflare Zero Trust)<\/strong>.<\/p>\n<p>While all three platforms deliver cloud security, their underlying architectural foundations and traffic steering models differ significantly:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Evaluation Criteria<\/th>\n<th style=\"text-align: left;\">Cisco Umbrella (SIG)<\/th>\n<th style=\"text-align: left;\">Zscaler Internet Access (ZIA)<\/th>\n<th style=\"text-align: left;\">Cloudflare Gateway<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>Architectural Origin<\/strong><\/td>\n<td style=\"text-align: left;\">DNS-First + Integrated Cloud SWG Proxy<\/td>\n<td style=\"text-align: left;\">Cloud Proxy-First (Full Web Proxy)<\/td>\n<td style=\"text-align: left;\">Edge-Compute Anycast Network<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Traffic Steering Entry Point<\/strong><\/td>\n<td style=\"text-align: left;\">Recursive DNS routing, IPsec tunnels, Cisco Secure Client module<\/td>\n<td style=\"text-align: left;\">GRE\/IPsec tunnels, Zscaler Client Connector (agent proxy)<\/td>\n<td style=\"text-align: left;\">WireGuard client (WARP), Anycast DNS, Magic WAN<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>SSL\/TLS Decryption Model<\/strong><\/td>\n<td style=\"text-align: left;\">Selective\/Intelligent Proxy by default; full SSL decryption available on SIG tiers<\/td>\n<td style=\"text-align: left;\">Inline, full proxy SSL\/TLS decryption on all web transactions<\/td>\n<td style=\"text-align: left;\">Distributed Anycast edge proxy with programmable SSL decryption<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Threat Intelligence Engine<\/strong><\/td>\n<td style=\"text-align: left;\">Cisco Talos (broad multi-vector email, endpoint, and network telemetry)<\/td>\n<td style=\"text-align: left;\">ThreatLabz (cloud proxy telemetry, behavioral sandboxing)<\/td>\n<td style=\"text-align: left;\">Cloudflare Radar (massive global public web and 1.1.1.1 DNS telemetry)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Cloud-Delivered Firewall (CDFW)<\/strong><\/td>\n<td style=\"text-align: left;\">Layer 3\/4 stateful firewall; Layer 7 application control with Snort IPS on advanced tiers<\/td>\n<td style=\"text-align: left;\">Full Cloud Firewall (L3\u2013L7) with integrated DPI and cloud sandbox<\/td>\n<td style=\"text-align: left;\">Cloud-native Magic Firewall (L3\u2013L7 packet filtering and DDoS mitigation)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Network Fabric Integration<\/strong><\/td>\n<td style=\"text-align: left;\">Native API\/tunnel integration with Cisco SD-WAN (Viptela\/Meraki) and Secure Firewall<\/td>\n<td style=\"text-align: left;\">Network-agnostic; connects via standardized GRE\/IPsec tunnels<\/td>\n<td style=\"text-align: left;\">Edge-native connectivity via Anycast GRE\/IPsec, Magic WAN, and Cloudflare Tunnels<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Deployment Velocity<\/strong><\/td>\n<td style=\"text-align: left;\">Minutes for network-wide DNS; progressive rollout for SWG and CDFW tunnels<\/td>\n<td style=\"text-align: left;\">Moderate; requires configuring proxy PACs, agent certs, and traffic redirection<\/td>\n<td style=\"text-align: left;\">Fast; modern zero-trust agent and edge-native network setup<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Primary Strength<\/strong><\/td>\n<td style=\"text-align: left;\">Rapid deployment, low-latency DNS defense, and native Cisco ecosystem synergy<\/td>\n<td style=\"text-align: left;\">Comprehensive proxy inspection depth and mature data protection policies<\/td>\n<td style=\"text-align: left;\">Ultra-low edge latency, modern administrative interfaces, and unified network\/edge compute<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Section Takeaway:<\/strong> Cisco Umbrella stands out for its rapid time-to-value at the DNS layer and deep integration with Cisco SD-WAN environments, whereas Zscaler is built around full-proxy inspection and Cloudflare optimizes for distributed edge performance.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Package_Tiers_and_Licensing_Architecture\"><\/span>Package Tiers and Licensing Architecture<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Cisco Umbrella licensing is structured around user counts (seats), network access points, or site metrics. Organizations can scale their deployment from foundational DNS protection to comprehensive Security Service Edge (SSE) capabilities.<\/p>\n<p>The table below outlines the core packages, feature availability, and enterprise licensing parameters across Umbrella tiers (and their corresponding paths within the evolving Cisco Secure Access framework):<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Capability \/ Feature<\/th>\n<th style=\"text-align: left;\">DNS Security Essentials<\/th>\n<th style=\"text-align: left;\">DNS Security Advantage<\/th>\n<th style=\"text-align: left;\">SIG Essentials<\/th>\n<th style=\"text-align: left;\">SIG Advantage<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>DNS-Layer Security &amp; Content Filtering<\/strong><\/td>\n<td style=\"text-align: left;\">Yes<\/td>\n<td style=\"text-align: left;\">Yes<\/td>\n<td style=\"text-align: left;\">Yes<\/td>\n<td style=\"text-align: left;\">Yes<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Intelligent Proxy (Selective Inspection)<\/strong><\/td>\n<td style=\"text-align: left;\">Yes (Basic URLs\/AV)<\/td>\n<td style=\"text-align: left;\">Yes (Advanced Talos feeds)<\/td>\n<td style=\"text-align: left;\">Integrated into full SWG<\/td>\n<td style=\"text-align: left;\">Integrated into full SWG<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Investigate Threat Intelligence API<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Included (Full console\/API access)<\/td>\n<td style=\"text-align: left;\">Included<\/td>\n<td style=\"text-align: left;\">Included<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Secure Web Gateway (Full HTTP\/S Proxy)<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Yes (Full URL &amp; payload inspection)<\/td>\n<td style=\"text-align: left;\">Yes (Full URL &amp; payload inspection)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>SSL\/TLS Decryption &amp; Sandboxing<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Included (Up to 500 file samples\/day)<\/td>\n<td style=\"text-align: left;\">Included (Unlimited file sandboxing)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Cloud-Delivered Firewall (CDFW)<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Layer 3\/4 Stateful Inspection<\/td>\n<td style=\"text-align: left;\">Layer 7 App Control + Snort IPS<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Cloud Access Security Broker (CASB)<\/strong><\/td>\n<td style=\"text-align: left;\">Shadow IT Discovery only<\/td>\n<td style=\"text-align: left;\">Shadow IT Discovery only<\/td>\n<td style=\"text-align: left;\">App Discovery + Basic Cloud Blocking<\/td>\n<td style=\"text-align: left;\">Granular In-App Control + Cloud DLP<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Data Loss Prevention (DLP)<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Add-on<\/td>\n<td style=\"text-align: left;\">Included (Inline inspection for PII\/PCI)<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Remote Browser Isolation (RBI)<\/strong><\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">No<\/td>\n<td style=\"text-align: left;\">Add-on<\/td>\n<td style=\"text-align: left;\">Included for high-risk destinations<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Licensing Metric<\/strong><\/td>\n<td style=\"text-align: left;\">Per User \/ Subscription<\/td>\n<td style=\"text-align: left;\">Per User \/ Subscription<\/td>\n<td style=\"text-align: left;\">Per User \/ Subscription<\/td>\n<td style=\"text-align: left;\">Per User \/ Subscription<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Target Deployment Profile<\/strong><\/td>\n<td style=\"text-align: left;\">Basic perimeter &amp; roaming DNS filtering<\/td>\n<td style=\"text-align: left;\">Advanced SecOps requiring deep Talos intelligence<\/td>\n<td style=\"text-align: left;\">Distributed branch\/remote workforce replacing web proxies<\/td>\n<td style=\"text-align: left;\">Enterprise SASE\/SSE deployments requiring zero trust and DLP<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>Note on Platform Evolution:<\/em> Cisco is actively unifying Umbrella SIG into the broader <strong>Cisco Secure Access<\/strong> platform. Under this model, DNS packages map to <em>Secure Access DNS Defense<\/em>, while SIG packages align with <em>Secure Access Secure Internet Access (SIA)<\/em>, which adds capabilities like Zero Trust Network Access (ZTNA) and Digital Experience Monitoring powered by ThousandEyes.<\/p>\n<p><strong>Section Takeaway:<\/strong> Organizations can start with lightweight DNS Security Essentials for quick, low-overhead protection, then scale into SIG Advantage when they need full proxy inspection, Layer 7 firewalling, and inline DLP.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Administrator_Documentation_and_API_Reference_Directory\"><\/span>Administrator Documentation and API Reference Directory<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For engineers designing, automating, and maintaining an Umbrella deployment, Cisco maintains technical documentation, administrative portals, and developer resources.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Administrative_Portals_and_Core_Documentation\"><\/span>Administrative Portals and Core Documentation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Central Administrative Dashboard:<\/strong> Accessible at <code>https:\/\/dashboard.umbrella.com<\/code>, providing unified visibility into traffic reporting, roaming client status, security policies, and user identities.<\/li>\n<li><strong>Cisco Umbrella User Guides:<\/strong> Cisco&#8217;s official technical library hosts dedicated reference manuals:<\/li>\n<li><em>DNS User Guide:<\/em> Configuration instructions for Anycast resolver pointing, internal DNS Virtual Appliances (VAs), Active Directory integration, and content policies.<\/li>\n<li><em>SIG User Guide:<\/em> Architecture and setup documentation for IPsec tunnel termination, Cloud-Delivered Firewall rule sets, PAC file deployment, and proxy CA certificate distribution.<\/li>\n<li><strong>Cisco Secure Client Administrator Guide:<\/strong> Covers deployment of the Umbrella Roaming Security module, local loopback routing, Trusted Network Detection triggers, and MDM\/Intune deployment profiles.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Cisco_DevNet_Cloud_Security_REST_APIs\"><\/span>Cisco DevNet Cloud Security REST APIs<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Umbrella provides programmatic interfaces via the Cisco DevNet Cloud Security portal. The modern API uses OAuth 2.0 client credential flows (targeting <code>https:\/\/api.umbrella.com<\/code>) alongside legacy management interfaces.<\/p>\n<pre><code>+--------------------------------------------------------------------------------------------------+\n|                           Cisco Umbrella REST API Architecture                                   |\n+--------------------------------------------------------------------------------------------------+\n\n  Client Application (CI\/CD \/ SIEM \/ SOAR)\n             \u2502\n             \u2502 1. POST \/auth\/v2\/token (client_id + client_secret)\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  OAuth 2.0 Token Issuer: https:\/\/api.umbrella.com                \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u2502 2. Issues Bearer JWT Token\n             \u25bc\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  Authorized REST API Operations                                  \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n             \u2502\n             \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n             \u25bc                      \u25bc                                \u25bc                     \u25bc\n   admin\/v2               deployments\/v2                   policies\/v2           reports\/v2\n   Key administration,    Roaming computers, networks,     Destination lists,    DNS &amp; web activity,\n   user provisioning,     and virtual appliances           and rule settings     security summaries\n<\/code><\/pre>\n<p>The API surface is organized across five distinct functional scopes:<\/p>\n<ol>\n<li><strong>Authentication Scope (<code>auth\/v2<\/code>):<\/strong> Issues temporary JWT bearer tokens using registered Client IDs and Client Secrets generated in the Umbrella Dashboard under <strong>Admin &gt; API Keys<\/strong>.<\/li>\n<li><strong>Administration Scope (<code>admin\/v2<\/code>):<\/strong> Manages organizational accounts, API keys, administrative roles, and user lifecycle events. Enterprise subscriptions also support directory syncing via the SCIM 2.0 endpoint (<code>https:\/\/management.api.umbrella.com\/scim\/v2<\/code>).<\/li>\n<li><strong>Deployments Scope (<code>deployments\/v2<\/code>):<\/strong> Programmatically provisions and manages internal networks, IPsec network tunnel groups, virtual appliances, and roaming computer objects.<\/li>\n<li><strong>Policies Scope (<code>policies\/v2<\/code>):<\/strong> Enables automated updates to destination allow\/block lists, application lists, and security policy rules, facilitating CI\/CD integration with SecOps playbooks.<\/li>\n<li><strong>Reports Scope (<code>reports\/v2<\/code>):<\/strong> Exposes endpoints to query DNS activity, web proxy logs, security summary metrics, and top blocked destinations for ingestion into external SIEM\/SOAR platforms.<\/li>\n<li><strong>Investigate Threat Intelligence API (<code>investigate\/v2<\/code>):<\/strong> Provides direct programmatic queries into the Umbrella Investigate threat database, returning domain risk scores, historical DNS patterns, co-occurrences, and WHOIS registration metadata for security analysis.<\/li>\n<\/ol>\n<p><strong>Section Takeaway:<\/strong> Cisco maintains documentation hubs and a structured OAuth 2.0 REST API across administration, policy, reporting, and threat intelligence scopes, enabling automated deployment and monitoring.<\/p>\n<hr>\n<h2><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Cisco Umbrella secures the modern enterprise by moving policy enforcement to the cloud. Its architecture combines multi-layered defense with flexible deployment options: organizations can start with lightweight, zero-latency DNS filtering that blocks threats before connections open, then layer on deeper inspection\u2014including a stateful cloud-delivered firewall, full web proxying, CASB controls, and inline DLP\u2014as their security needs evolve. Whether delivered to roaming laptops via the Cisco Secure Client loopback driver or connected to branch networks through SD-WAN IPsec tunnels, Umbrella provides consistent, cloud-managed visibility and threat protection across distributed environments.<\/p>\n<div class='sfsi_Sicons' style='width: 100%; display: inline-block; vertical-align: middle; text-align:left'><div style='margin:0px 8px 0px 0px; line-height: 24px'><span>Please follow and like us:<\/span><\/div><div class='sfsi_socialwpr'><div class='sf_fb_share sf_icon' style='text-align:left;vertical-align: middle;'><a href='https:\/\/www.facebook.com\/sharer\/sharer.php?u=https%3A%2F%2Fcciedump.spoto.net%2Fblog%2Fhow-cisco-umbrella-works_24250.html' style='display:inline-block;'  > <img class='sfsi_wicon'  data-pin-nopin='true' width='auto' height='auto' alt='fb-share-icon' title='Facebook Share' src='https:\/\/cciedump.spoto.net\/blog\/wp-content\/plugins\/ultimate-social-media-icons\/images\/visit_icons\/fbshare_bck.png'  \/><\/a><\/div><div class='sf_twiter sf_icon' style='display: inline-block;vertical-align: middle;width: auto;margin-left: 7px;'>\r\n\t\t\t\t\t\t<a target='_blank' href='https:\/\/twitter.com\/intent\/tweet?text=How+Cisco+Umbrella+Works+https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html'style='display:inline-block' >\r\n\t\t\t\t\t\t\t<img data-pin-nopin= true width='auto' class='sfsi_wicon' src='https:\/\/cciedump.spoto.net\/blog\/wp-content\/plugins\/ultimate-social-media-icons\/images\/visit_icons\/en_US_Tweet.svg' alt='Tweet' title='Tweet' >\r\n\t\t\t\t\t\t<\/a>\r\n\t\t\t\t\t<\/div><div class='sf_pinit sf_icon' style='text-align:left;vertical-align: middle;float:left;line-height: 33px;width:auto;margin: 0 -2px;'><a href='#'  onclick='sfsi_pinterest_modal_images(event,\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\",\"How Cisco Umbrella Works\")' style='display:inline-block;'  > <img class='sfsi_wicon'  data-pin-nopin='true' width='auto' height='auto' alt='fb-share-icon' title='Pin Share' src='https:\/\/cciedump.spoto.net\/blog\/wp-content\/plugins\/ultimate-social-media-icons\/images\/share_icons\/Pinterest_Save\/en_US_save.svg'  \/><\/a><\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Modern enterprise networks no longer operate within the safe confines of a physical perimeter. With workforces distributed across branch offices, home workstations, and public Wi-Fi, traditional backhauling of web traffic through centralized corporate data centers introduces latency, degrades application performance, and leaves remote endpoints vulnerable. Cisco Umbrella solves this challenge by delivering security directly from&#8230; &raquo; <a class=\"read-more-link\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\">read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,608],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v18.0 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How Cisco Umbrella Works - SPOTO Official Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Cisco Umbrella Works - SPOTO Official Blog\" \/>\n<meta property=\"og:description\" content=\"Modern enterprise networks no longer operate within the safe confines of a physical perimeter. With workforces distributed across branch offices, home workstations, and public Wi-Fi, traditional backhauling of web traffic through centralized corporate data centers introduces latency, degrades application performance, and leaves remote endpoints vulnerable. Cisco Umbrella solves this challenge by delivering security directly from... &raquo; read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\" \/>\n<meta property=\"og:site_name\" content=\"SPOTO Official Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T07:45:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-02T07:45:18+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"SPOTO \u7f16\u8f91\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638\",\"name\":\"SPOTO Club\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/cciedump.spoto.net\/blog\/wp-content\/uploads\/2020\/03\/spoto-facemask-96x96.jpg\",\"contentUrl\":\"https:\/\/cciedump.spoto.net\/blog\/wp-content\/uploads\/2020\/03\/spoto-facemask-96x96.jpg\",\"caption\":\"SPOTO Club\"},\"logo\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#personlogo\"},\"description\":\"SPOTO is an excellent leader in IT certification training for 20+ years. We offer 100% real Cisco CCNA, CCNP exam dumps, CCIE Lab study materials, PMP, CISA, CISM, AWS, Palo Alto, and other IT exam dumps. We have helped thousands of candidates around the world to pass their IT exams on the first try! As the first-class online IT training organization in China, SPOTO cooperates with many giant Internet companies in China like Tencent, Baidu, and Alibaba. What\u2019s more, we have won lots of awards in IT education training such as \u201cTop Ten Influential Brands In Online Education Industry\u201d given by Baidu, \u201cOfficial IT Online Training Organization\u201d awarded by Tencent Class, etc. Join us: https:\/\/cciedump.spoto.net\/ Contact us: E-mail: support@spoto.net Phone \/ WhatsApp: +86 18344981205\",\"sameAs\":[\"https:\/\/cciedump.spoto.net\/\"]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#website\",\"url\":\"https:\/\/cciedump.spoto.net\/blog\/\",\"name\":\"SPOTO Official Blog\",\"description\":\"Focus on Online IT Training for 20+ Years\",\"publisher\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cciedump.spoto.net\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage\",\"url\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\",\"name\":\"How Cisco Umbrella Works - SPOTO Official Blog\",\"isPartOf\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#website\"},\"datePublished\":\"2026-11-02T07:45:16+00:00\",\"dateModified\":\"2026-11-02T07:45:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cciedump.spoto.net\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How Cisco Umbrella Works\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage\"},\"author\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/4edd6074d9632c14eda17a2205a88dd1\"},\"headline\":\"How Cisco Umbrella Works\",\"datePublished\":\"2026-11-02T07:45:16+00:00\",\"dateModified\":\"2026-11-02T07:45:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage\"},\"wordCount\":2955,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638\"},\"articleSection\":[\"CCNA Certification\",\"Cisco Certification\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/4edd6074d9632c14eda17a2205a88dd1\",\"name\":\"SPOTO \u7f16\u8f91\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cciedump.spoto.net\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/cciedump.spoto.net\/blog\/wp-content\/litespeed\/avatar\/f525ded90e4ff384a19ebdbe47c80d22.jpg?ver=1793350507\",\"contentUrl\":\"https:\/\/cciedump.spoto.net\/blog\/wp-content\/litespeed\/avatar\/f525ded90e4ff384a19ebdbe47c80d22.jpg?ver=1793350507\",\"caption\":\"SPOTO \u7f16\u8f91\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Cisco Umbrella Works - SPOTO Official Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html","og_locale":"en_US","og_type":"article","og_title":"How Cisco Umbrella Works - SPOTO Official Blog","og_description":"Modern enterprise networks no longer operate within the safe confines of a physical perimeter. With workforces distributed across branch offices, home workstations, and public Wi-Fi, traditional backhauling of web traffic through centralized corporate data centers introduces latency, degrades application performance, and leaves remote endpoints vulnerable. Cisco Umbrella solves this challenge by delivering security directly from... &raquo; read more","og_url":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html","og_site_name":"SPOTO Official Blog","article_published_time":"2026-11-02T07:45:16+00:00","article_modified_time":"2026-11-02T07:45:18+00:00","twitter_card":"summary_large_image","twitter_misc":{"Written by":"SPOTO \u7f16\u8f91","Est. reading time":"16 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Person","Organization"],"@id":"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638","name":"SPOTO Club","image":{"@type":"ImageObject","@id":"https:\/\/cciedump.spoto.net\/blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/cciedump.spoto.net\/blog\/wp-content\/uploads\/2020\/03\/spoto-facemask-96x96.jpg","contentUrl":"https:\/\/cciedump.spoto.net\/blog\/wp-content\/uploads\/2020\/03\/spoto-facemask-96x96.jpg","caption":"SPOTO Club"},"logo":{"@id":"https:\/\/cciedump.spoto.net\/blog\/#personlogo"},"description":"SPOTO is an excellent leader in IT certification training for 20+ years. We offer 100% real Cisco CCNA, CCNP exam dumps, CCIE Lab study materials, PMP, CISA, CISM, AWS, Palo Alto, and other IT exam dumps. We have helped thousands of candidates around the world to pass their IT exams on the first try! As the first-class online IT training organization in China, SPOTO cooperates with many giant Internet companies in China like Tencent, Baidu, and Alibaba. What\u2019s more, we have won lots of awards in IT education training such as \u201cTop Ten Influential Brands In Online Education Industry\u201d given by Baidu, \u201cOfficial IT Online Training Organization\u201d awarded by Tencent Class, etc. Join us: https:\/\/cciedump.spoto.net\/ Contact us: E-mail: support@spoto.net Phone \/ WhatsApp: +86 18344981205","sameAs":["https:\/\/cciedump.spoto.net\/"]},{"@type":"WebSite","@id":"https:\/\/cciedump.spoto.net\/blog\/#website","url":"https:\/\/cciedump.spoto.net\/blog\/","name":"SPOTO Official Blog","description":"Focus on Online IT Training for 20+ Years","publisher":{"@id":"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cciedump.spoto.net\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage","url":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html","name":"How Cisco Umbrella Works - SPOTO Official Blog","isPartOf":{"@id":"https:\/\/cciedump.spoto.net\/blog\/#website"},"datePublished":"2026-11-02T07:45:16+00:00","dateModified":"2026-11-02T07:45:18+00:00","breadcrumb":{"@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cciedump.spoto.net\/blog"},{"@type":"ListItem","position":2,"name":"How Cisco Umbrella Works"}]},{"@type":"Article","@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#article","isPartOf":{"@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage"},"author":{"@id":"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/4edd6074d9632c14eda17a2205a88dd1"},"headline":"How Cisco Umbrella Works","datePublished":"2026-11-02T07:45:16+00:00","dateModified":"2026-11-02T07:45:18+00:00","mainEntityOfPage":{"@id":"https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#webpage"},"wordCount":2955,"commentCount":0,"publisher":{"@id":"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/25594d4796697ccb1ef63d55c269c638"},"articleSection":["CCNA Certification","Cisco Certification"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cciedump.spoto.net\/blog\/how-cisco-umbrella-works_24250.html#respond"]}]},{"@type":"Person","@id":"https:\/\/cciedump.spoto.net\/blog\/#\/schema\/person\/4edd6074d9632c14eda17a2205a88dd1","name":"SPOTO \u7f16\u8f91","image":{"@type":"ImageObject","@id":"https:\/\/cciedump.spoto.net\/blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/cciedump.spoto.net\/blog\/wp-content\/litespeed\/avatar\/f525ded90e4ff384a19ebdbe47c80d22.jpg?ver=1793350507","contentUrl":"https:\/\/cciedump.spoto.net\/blog\/wp-content\/litespeed\/avatar\/f525ded90e4ff384a19ebdbe47c80d22.jpg?ver=1793350507","caption":"SPOTO \u7f16\u8f91"}}]}},"_links":{"self":[{"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/posts\/24250"}],"collection":[{"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/comments?post=24250"}],"version-history":[{"count":1,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/posts\/24250\/revisions"}],"predecessor-version":[{"id":24309,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/posts\/24250\/revisions\/24309"}],"wp:attachment":[{"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/media?parent=24250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/categories?post=24250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cciedump.spoto.net\/blog\/wp-json\/wp\/v2\/tags?post=24250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}