In today’s increasingly digital and distributed work environment, organizations face a growing challenge to secure users and devices regardless of their location. Traditional perimeter-based security architectures struggle to keep pace with modern threats, cloud adoption, and remote work trends. Cisco Umbrella Secure Internet Gateway (SIG) addresses these challenges by delivering comprehensive security services from the cloud. Among its many features, the Cloud-Delivered Firewall (CDFW) stands out as a critical component, enabling scalable, flexible, and centrally managed network security.
Overview of Cisco Umbrella Secure Internet Gateway (SIG)
Cisco Umbrella SIG is a cloud-native platform designed to protect enterprises from internet threats by integrating multiple security capabilities. It provides organizations with the ability to enforce policies that control and secure internet access for users, regardless of whether they are on the corporate network or working remotely.
Some of the core features within Umbrella SIG include:
- DNS-Layer Security: This foundational layer blocks threats at the Domain Name System (DNS) level by preventing users from connecting to malicious domains, IPs, or URLs before a connection is even established.
- Secure Web Gateway: It inspects HTTP and HTTPS traffic, enforcing web access policies and filtering malicious content.
- Cloud-Delivered Firewall: This feature enforces firewall policies in the cloud, enabling organizations to filter traffic based on IP addresses, ports, protocols, and applications.
- Cloud Access Security Broker (CASB): Monitors cloud app usage and enforces security policies.
By consolidating these functions within a single cloud service, Cisco Umbrella SIG simplifies security operations, reduces the need for multiple point products, and offers consistent protection everywhere users connect.
The Role of the Cloud-Delivered Firewall in Umbrella SIG
The Cloud-Delivered Firewall is a key piece of the Umbrella SIG offering. Traditional firewalls, often deployed on-premises, can be costly to maintain, limited in scalability, and difficult to extend to remote or branch locations. Umbrella’s CDFW addresses these challenges by moving firewall functionality to the cloud.
With Cloud-Delivered Firewall, organizations can enforce Layer 3 and Layer 4 policies that filter network traffic based on IP addresses, ports, and protocols. Beyond these traditional firewall controls, Umbrella’s CDFW also provides Layer 7 capabilities that allow policies to be applied at the application layer. This means that administrators can block or allow specific applications—such as social media platforms, file-sharing tools, or gaming apps—offering granular control over user behavior.
By routing outbound traffic through Umbrella’s cloud, organizations gain centralized visibility and control across all locations, including branch offices, remote users, and mobile devices. The cloud delivery model enables rapid scaling without the need for new hardware and reduces operational complexity.
Prerequisites for Deploying the Cloud-Delivered Firewall
Before enabling the Cloud-Delivered Firewall, organizations must meet certain prerequisites to ensure smooth deployment and operation.
A central requirement is the establishment of a secure, persistent connection between the organization’s network and Cisco Umbrella’s cloud infrastructure. This connection is typically realized using an IPsec tunnel, which provides a secure path for all outbound traffic destined for inspection and policy enforcement.
Network devices such as Cisco Cloud Services Routers (CSR), Adaptive Security Appliances (ASA), Firepower Threat Defense (FTD) devices, or even cloud infrastructure like AWS can be configured to create these IPsec tunnels. Cisco provides detailed, platform-specific documentation to guide administrators through the configuration process.
Key steps and considerations for establishing the IPsec tunnel include:
- Tunnel Identification: Assigning a unique name or identifier to the tunnel for management and monitoring.
- Authentication and Encryption: Using shared secrets or certificates to authenticate endpoints and encrypt data traversing the tunnel.
- Routing Configuration: Directing relevant traffic through the tunnel while maintaining normal routing for other destinations.
- Failover and Redundancy: Designing the tunnel setup to provide continuity during network outages or device failures.
Establishing the tunnel correctly is vital because it forms the backbone of the Cloud-Delivered Firewall functionality. Only traffic that traverses this tunnel can be inspected and filtered by Umbrella.
Configuration and Management via the Umbrella Dashboard
Once the IPsec tunnel is operational, administrators use the Umbrella management dashboard to configure firewall policies. The dashboard provides an intuitive interface to create, modify, and monitor security policies.
Initially, the Cloud-Delivered Firewall comes with a default policy that allows all outbound traffic. This baseline ensures no immediate disruption while administrators define their custom policies.
Creating policies involves specifying criteria such as:
- IP Addresses and Subnets: Defining source or destination IP addresses or ranges to which rules apply.
- Ports and Protocols: Filtering traffic based on Layer 4 parameters such as TCP/UDP ports and protocols like HTTP, HTTPS, FTP, or DNS.
- Applications: Using Layer 7 application awareness to allow or block specific software or web applications.
Policies can be assigned priorities, and administrators can enable logging for each rule. Logging provides visibility into matched traffic and helps in auditing, troubleshooting, and refining policies.
For example, an administrator might create a rule to block access to a specific IP address range known to be malicious. Enabling logging on this rule will allow the team to monitor attempts to access that range and evaluate potential security incidents.
Another common use case is controlling application usage. Organizations often need to restrict peer-to-peer file sharing applications such as BitTorrent due to security risks and bandwidth consumption. Umbrella’s CDFW allows creating application-based rules to block such traffic seamlessly.
Testing and Validation of Firewall Policies
After policies are created, it is crucial to validate their effectiveness. This involves generating network traffic that matches specific rules and confirming that the traffic is blocked or allowed as intended.
The Umbrella dashboard provides real-time logging and historical data showing which rules were triggered and what actions were taken. This visibility enables administrators to quickly identify misconfigurations or policy gaps.
Continuous monitoring and fine-tuning of firewall policies ensure that the organization maintains an optimal balance between security and usability. Overly restrictive policies might block legitimate business traffic, while lax policies expose the network to risk.
Benefits of Cloud-Delivered Firewall in Modern Networks
The Cloud-Delivered Firewall offers several advantages over traditional firewall models:
- Scalability: Because it is cloud-based, organizations can scale security capabilities quickly to match network growth or changing requirements without purchasing additional hardware.
- Centralized Management: All firewall policies are managed from a single dashboard, simplifying administration and ensuring consistency across distributed locations.
- Extensibility: New features and updates are delivered automatically, allowing organizations to stay ahead of emerging threats without manual upgrades.
- Global Coverage: Umbrella’s extensive global infrastructure ensures low-latency inspection and policy enforcement wherever users connect.
- Integration: CDFW integrates tightly with other Umbrella SIG features, providing layered security and a holistic view of network activity.
In summary, Cisco Umbrella Secure Internet Gateway with its Cloud-Delivered Firewall feature provides a modern, flexible, and scalable approach to enforcing network security policies. Establishing secure IPsec tunnels and configuring granular policies through the Umbrella dashboard are foundational steps in leveraging this technology. The cloud-delivered model aligns well with the needs of today’s distributed and dynamic network environments.
IPsec Tunnel Setup and Configuration for Cisco Umbrella Cloud-Delivered Firewall
A critical step in deploying Cisco Umbrella’s Cloud-Delivered Firewall (CDFW) is establishing a secure and reliable connection between your on-premises or cloud network infrastructure and the Umbrella cloud. This connection is typically created using an IPsec tunnel, which encrypts traffic between your network devices—such as Cisco Cloud Services Routers (CSR), ASA firewalls, Firepower Threat Defense (FTD), or cloud gateways—and Umbrella’s global data centers.
The IPsec tunnel ensures that all outbound traffic destined for inspection by Umbrella passes securely and reliably through the cloud firewall service. Setting up this tunnel correctly is essential to guarantee policy enforcement, security, and network performance.
Understanding the IPsec Tunnel Architecture
An IPsec tunnel creates a virtual private network (VPN) connection between two endpoints: your local device (the tunnel endpoint) and the Umbrella cloud gateway. This tunnel encapsulates and encrypts all traffic flowing between these points, preventing interception or tampering during transit.
Umbrella’s cloud gateways are distributed worldwide, allowing your tunnel endpoint to connect to a nearby data center to minimize latency. Once the tunnel is established, your traffic is routed through Umbrella’s infrastructure, where firewall policies, DNS filtering, and other security features inspect and enforce your organization’s security posture.
Prerequisites for Tunnel Configuration
Before configuring the IPsec tunnel, ensure the following prerequisites are met:
- Your network device (CSR, ASA, FTD, etc.) supports IPsec VPNs and is running compatible software versions.
- Network connectivity between your device and the internet is established, with appropriate routing and firewall rules to allow IPsec traffic.
- You have access to the Umbrella dashboard with sufficient privileges to create and manage network tunnels.
- Necessary cryptographic credentials such as pre-shared keys or certificates are available.
Creating the IPsec Tunnel in the Umbrella Dashboard
The first step is to configure the tunnel information in the Umbrella dashboard. Navigate to the “Network Tunnels” section, where you define a new tunnel with the following key parameters:
- Tunnel Name: A unique identifier for the tunnel, used for management and logging.
- Tunnel Destination: The IP address of your on-premises device’s external interface that will terminate the IPsec tunnel.
- Pre-shared Key (PSK): A secret key used to authenticate the tunnel endpoints. This must be kept secure and matched on both sides.
- Tunnel Identity: Used to identify the tunnel in Umbrella logs and policy assignments.
Once created, Umbrella generates the necessary configuration details to be applied to your local device.
Configuring the Tunnel on Your Network Device
Next, apply the tunnel configuration on your device. For example, when using a Cisco CSR router, the configuration involves:
- Defining the crypto map specifying the IPsec parameters such as encryption algorithm (AES), hashing (SHA), and Diffie-Hellman group.
- Setting the peer IP address to Umbrella’s tunnel gateway.
- Applying the pre-shared key for authentication.
- Creating access control lists (ACLs) to define which traffic should be routed through the tunnel.
- Associating the crypto map with the outbound interface connected to the Internet.
Umbrella provides detailed guides for other platforms, such as ASA, FTD, and cloud providers like AWS, to help with device-specific configurations.
Routing Considerations
Once the tunnel is up, you must ensurethat traffic intended for inspection routes through it. This typically involves configuring static or dynamic routes on your device that direct outbound traffic destined for the internet or specific subnets through the tunnel interface.
This routing ensures that all relevant traffic is securely forwarded to Umbrella’s cloud firewall for policy enforcement. Misconfiguration here can lead to traffic bypassing the tunnel and losing protection.
Tunnel Monitoring and Troubleshooting
After configuration, monitor the tunnel status to verify that it is up and stable. Most devices provide commands or dashboards to check tunnel health, uptime, and traffic statistics.
If the tunnel fails to establish, common troubleshooting steps include:
- Verifying pre-shared keys and authentication methods match on both ends.
- Confirming network connectivity and that firewalls permit IPsec-related protocols (ESP, UDP 500 and 4500).
- Checking logs for negotiation failures or mismatched cryptographic parameters.
- Ensuring routing is correctly configured on both ends.
Umbrella’s dashboard also provides monitoring tools to track tunnel status and performance.
Benefits of Using IPsec Tunnels for CDFW
Using IPsec tunnels to connect your network to Umbrella’s Cloud-Delivered Firewall offers multiple advantages:
- Security: Encrypts all traffic between your device and Umbrella, ensuring confidentiality and integrity.
- Reliability: Provides a persistent, managed connection that supports consistent security enforcement.
- Scalability: Supports multiple tunnels from different sites, enabling distributed architectures.
- Visibility: Enables traffic identification by tunnel name in Umbrella logs and reporting, aiding analysis.
Establishing an IPsec tunnel is a foundational step in deploying Cisco Umbrella Cloud-Delivered Firewall. It enables secure, reliable routing of traffic from your network to Umbrella’s cloud, where it is inspected and filtered according to your security policies.
Proper tunnel setup involves careful configuration of tunnel parameters, cryptographic credentials, routing, and device-specific settings. Monitoring and troubleshooting tools help ensure ongoing tunnel health and performance.
With the tunnel in place, organizations can fully leverage Umbrella’s cloud firewall capabilities to protect their networks with centralized, cloud-delivered policies.
Creating and Managing Firewall Policies in Cisco Umbrella Cloud-Delivered Firewall
Once a secure IPsec tunnel has been established between your network devices and Cisco Umbrella’s cloud infrastructure, the next crucial step is to configure firewall policies within the Umbrella management dashboard. These policies govern the flow of network traffic through the Cloud-Delivered Firewall (CDFW), enabling organizations to enforce precise security controls aligned with their business and compliance requirements.
Default Policy and Policy Framework
When you first enable the Cloud-Delivered Firewall feature, the Umbrella dashboard typically presents a default policy that allows all outbound traffic. This permissive baseline ensures that no immediate disruption occurs to network connectivity while administrators build tailored policies.
Cisco Umbrella’s firewall policies operate on a rule-based framework. Each rule defines specific matching criteria and an action to take when traffic meets those conditions. Rules are evaluated sequentially, from highest to lowest priority, until a match is found. The corresponding action—allow, block, or log—is then applied to the traffic.
Administrators can create multiple policies and apply them to different network locations or groups, allowing for flexible and granular control over traffic flows.
Defining Policy Criteria
Policies in the Umbrella Cloud-Delivered Firewall are highly customizable and can filter traffic based on a variety of attributes across multiple network layers:
- Layer 3 (Network Layer): Policies can filter traffic by source or destination IP addresses or subnets. This is useful for controlling access to specific network segments or blocking traffic to known malicious IPs.
- Layer 4 (Transport Layer): Policies may specify TCP or UDP ports and protocols. This allows blocking or permitting traffic on specific services such as HTTP (port 80), HTTPS (port 443), FTP, or custom application ports.
- Layer 7 (Application Layer): Umbrella’s CDFW supports application-level filtering, which identifies and controls traffic based on the application generating it. This enables organizations to block or limit the use of specific applications, such as peer-to-peer file sharing, social media, or messaging apps.
By combining these criteria, organizations can craft fine-grained policies that align tightly with security objectives.
Creating and Enabling Policies
To create a firewall policy rule:
- Navigate to the Firewall Policies section in the Umbrella dashboard.
- Add a new rule and specify the match conditions. For example, set the destination IP or subnet, ports, protocols, and/or applications.
- Choose the desired action—commonly to allow or block the matched traffic.
- Enable logging if you want to capture details of traffic matching the rule. Logging is valuable for auditing, monitoring policy effectiveness, and forensic analysis.
- Assign the rule a priority to determine its order in the evaluation sequence.
- Apply the rule to specific network locations or groups, allowing differentiated policy enforcement across your environment.
Example Use Case: Blocking Malicious IPs
Consider an organization that wants to block access to a particular IP address associated with malicious activity. An administrator would create a rule specifying the destination IP to block, set the action to “block,” enable logging to monitor attempts, and assign the rule to relevant locations.
Once enabled, any traffic destined for that IP from users in those locations is dropped by Umbrella’s cloud firewall. Administrators can view logs confirming the rule was hit and investigate further if needed.
Example Use Case: Application Control
In another scenario, an organization may want to prevent the use of file-sharing applications like BitTorrent due to security and bandwidth concerns. Using Umbrella’s Layer 7 capabilities, an administrator creates a rule to block the BitTorrent application traffic.
This application-aware filtering allows the organization to enforce corporate policies effectively, regardless of IP or port obfuscation often used by such applications.
Monitoring and Reviewing Firewall Logs
Logging is a vital feature in managing firewall policies. When enabled, the Umbrella dashboard collects detailed information about traffic matching firewall rules. These logs include source and destination IPs, ports, protocols, applications, timestamps, and the action taken.
Administrators can use these logs to:
- Verify that policies are functioning as intended.
- Detect attempts to access blocked resources.
- Identify unusual traffic patterns or potential threats.
- Provide evidence for compliance audits.
Umbrella’s centralized dashboard consolidates logs across all sites, simplifying oversight in distributed environments.
Policy Optimization and Maintenance
Firewall policies are living configurations that require ongoing review and refinement. As the threat landscape evolves and business needs change, administrators should regularly:
- Analyze firewall logs to identify false positives or negatives.
- Adjust rule priorities or conditions to improve accuracy.
- Add new rules to address emerging threats or applications.
- Remove obsolete policies to reduce complexity.
This proactive management ensures that the Cloud-Delivered Firewall continues to provide effective protection without impacting legitimate network usage.
Integration with Other Umbrella Features
The Cloud-Delivered Firewall works in concert with other Umbrella SIG components such as DNS-layer security and Secure Web Gateway. This layered approach provides comprehensive coverage—blocking threats early at the DNS layer and applying deeper inspection and control at the firewall level.
By correlating firewall logs with DNS and web gateway data, security teams gain a holistic view of network activity and potential risks, enabling faster detection and response.
In summary, creating and managing firewall policies within Cisco Umbrella Cloud-Delivered Firewall empowers organizations to enforce granular, scalable, and cloud-managed network security. From blocking malicious IP addresses to controlling application usage, administrators have the flexibility and visibility needed to protect their networks effectively.
IPsec Tunnel Setup and Configuration for Cisco Umbrella Cloud-Delivered Firewall
The foundation of deploying Cisco Umbrella Cloud-Delivered Firewall (CDFW) lies in establishing a secure, reliable connection between your network infrastructure and Umbrella’s cloud environment. This connection is typically implemented using an IPsec tunnel. IPsec tunnels create an encrypted path that securely routes traffic through Umbrella’s cloud where firewall policies and other security controls can be applied. Understanding the architecture, requirements, and configuration steps for this tunnel is essential for a successful deployment.
Understanding the Purpose of the IPsec Tunnel
The IPsec tunnel serves as a secure conduit between your local network devices—such as Cisco Cloud Services Routers (CSR), Cisco ASA firewalls, Firepower Threat Defense (FTD) devices, or cloud gateways—and Umbrella’s cloud security nodes. Traffic from your network destined for internet access or inspection is routed through this tunnel, ensuring that it is protected by Umbrella’s firewall, DNS-layer security, and other features.
This approach enables consistent security enforcement regardless of the user’s physical location or device. Because Umbrella is a cloud service with data centers around the globe, your traffic is directed to the nearest cloud node, minimizing latency and optimizing performance.
Pre-Deployment Requirements
Before configuring the tunnel, several prerequisites must be in place:
- Compatible Network Devices: Your on-premises or cloud devices must support IPsec VPN tunnels and be compatible with Cisco Umbrella’s requirements.
- Network Connectivity: Proper internet connectivity must exist to establish tunnels to Umbrella’s global nodes. Relevant ports (UDP 500 and 4500 for IPsec) must be open and accessible.
- Credentials and Authentication: A secure method of tunnel authentication such as a pre-shared key (PSK) or certificates must be established and securely shared between your device and Umbrella.
- Routing Infrastructure: Appropriate routing must be planned to send traffic destined for Umbrella through the tunnel and to route return traffic correctly.
- Umbrella Dashboard Access: Administrative access to Umbrella’s web-based management console is necessary to create tunnel configurations and manage policies.
Creating the Tunnel Configuration in the Umbrella Dashboard
Begin by logging into the Umbrella management portal and navigating to the network tunnels section. Here, you create a new tunnel configuration that includes:
- Tunnel Name: Choose a descriptive name to identify the tunnel within Umbrella.
- Tunnel Destination IP: The public IP address of your device’s interface that will terminate the IPsec tunnel.
- Pre-shared Key: A secure passphrase used to authenticate the tunnel endpoints.
- Additional Settings: Depending on your device type, you may specify additional parameters such as interface bindings or traffic selectors.
Once configured, Umbrella generates details that you will replicate on your local device to complete the tunnel setup.
Configuring the IPsec Tunnel on Network Devices
Each supported device has a specific method to configure IPsec tunnels. For example:
- Cisco CSR Router: Use CLI commands to define crypto maps, set encryption and hashing algorithms (e.g., AES-256, SHA), configure Diffie-Hellman groups, and bind the crypto map to an interface.
- Cisco ASA Firewall or FTD: Utilize ASDM or CLI to define tunnel groups, set pre-shared keys, configure crypto policies, and set traffic selectors.
- Cloud Gateways (e.g., AWS): Configure virtual private gateways and customer gateways, establish VPN connections, and ensure routing is correct.
Key configuration elements include:
- IKE Phase 1 and Phase 2 Parameters: Define the cryptographic methods and keys used to establish the tunnel.
- Tunnel Interfaces: Assign IP addresses to virtual tunnel interfaces if applicable.
- Access Control Lists: Specify which traffic should be encrypted and sent through the tunnel.
- Routing: Ensure that routes for traffic to be protected point to the tunnel interface or crypto map.
Umbrella’s documentation provides detailed, device-specific configuration guides and sample scripts to assist administrators.
Routing and Traffic Considerations
Proper routing is crucial to ensure that the intended traffic flows through the IPsec tunnel to Umbrella. Typically, all outbound internet traffic or specific subnets are routed via the tunnel interface. This may require adjusting default routes or implementing policy-based routing.
Traffic destined for local network segments or other VPNs should bypass the tunnel to avoid routing loops or unnecessary encryption.
It is essential to validate that return traffic from Umbrella’s cloud nodes can flow back to your network without obstruction. This involves ensuring firewall rules and NAT policies accommodate the tunnel traffic.
Tunnel Monitoring and Troubleshooting
After configuration, monitoring the tunnel’s status confirms connectivity and security. Common monitoring methods include:
- Device CLI Commands: Commands such as show crypto isakmp sa and show crypto ipsec sa display tunnel status, packet counts, and error conditions.
- Umbrella Dashboard: Displays tunnel health, traffic statistics, and alerts for connectivity issues.
- Syslogs and SNMP: Configure logging to capture detailed tunnel events for deeper analysis.
If tunnels fail to establish or drop unexpectedly, troubleshooting steps include:
- Verifying pre-shared keys and authentication settings.
- Checking that required ports and protocols (UDP 500, UDP 4500, ESP) are allowed.
- Reviewing encryption algorithms and ensuring both endpoints use compatible settings.
- Confirming routing configurations and absence of NAT issues on the tunnel path.
- Examining logs for specific errors or negotiation failures.
High Availability and Redundancy
For critical deployments, it is recommended to configure multiple tunnels for redundancy. This may involve:
- Establishing secondary IPsec tunnels to alternate Umbrella nodes or using multiple ISP connections.
- Load balancing traffic across tunnels to improve performance and resilience.
- Using device features like Cisco’s DMVPN or FlexVPN for dynamic failover.
Umbrella’s cloud architecture inherently provides high availability, but your network design must complement this with robust tunnel configurations.
The IPsec tunnel is the secure backbone that connects your network to Cisco Umbrella’s Cloud-Delivered Firewall service. Establishing this tunnel involves careful planning, device-specific configuration, routing adjustments, and ongoing monitoring to maintain a secure and reliable connection.
By adhering to Umbrella’s guidelines and best practices, organizations ensure that all outbound traffic is inspected and filtered by Umbrella’s cloud security stack, providing consistent protection regardless of user location.
Final Thoughts
Cisco Umbrella’s Cloud-Delivered Firewall represents a significant evolution in network security, shifting firewall enforcement from traditional on-premises appliances to a scalable, cloud-native platform. This transformation enables organizations to apply consistent, granular security policies across all users and devices, regardless of their physical location.
Throughout this series, we explored the foundational elements of deploying Umbrella’s Cloud-Delivered Firewall: understanding the role and benefits of the service, establishing secure IPsec tunnels to connect your network to Umbrella’s cloud, and creating tailored firewall policies that govern network traffic at multiple layers, including application-level controls.
The cloud-delivered model simplifies management, reduces capital expenditures on hardware, and leverages Umbrella’s global infrastructure to ensure low latency and high availability. It also integrates seamlessly with Umbrella’s broader Secure Internet Gateway capabilities, providing comprehensive protection against modern threats.
Successful deployment depends on careful planning—ensuring prerequisites are met, IPsec tunnels are properly configured and monitored, and firewall policies are thoughtfully crafted and continuously refined. Logging and visibility into traffic flows empower security teams to make informed decisions and respond swiftly to incidents.
As organizations continue to adapt to increasingly dynamic work environments and sophisticated cyber threats, leveraging cloud-delivered security services like Cisco Umbrella’s firewall will be critical. It offers the flexibility, scalability, and comprehensive protection necessary to secure modern networks effectively.