Security · Cisco Umbrella
Plan a Cisco Umbrella (SSE) rollout: DNS-layer security, SIG proxy, AnyConnect roaming, SD-WAN tunnels, and the policy shape that actually works.
Umbrella rolls out in three sensible layers: DNS-layer first (quickest win), then the roaming module for off-network, then SIG proxy for full SSE. Skip the sequence and you'll be stuck on Layer 1 forever while half your traffic bypasses.
Output returns a 3-layer rollout plan, required components, policy matrix (who gets what policy on/off net), and gotchas (DNS loops, PAC bypass, split-tunnel on VPN).
Start DNS-first: point external DNS to Umbrella (208.67.222.222/208.67.220.220). Deploy Virtual Appliances inside your perimeter so internal AD-integrated DNS forwards externally. Turn on AD Connector to get user-level identity in reports and policy. This alone stops ~60% of malware and phishing.
Layer 2: push AnyConnect with the Umbrella roaming module. Now off-network users are protected. Layer 3: if you have SIG, build IPsec tunnels from SD-WAN routers (Meraki MX, Catalyst 8000, Viptela) or use PAC for selective proxy.
Only if you forget to define internal domains (corp.local, AD suffixes). Add them as internal domains in the VA so they bypass Umbrella resolution.
Block external DoH on the firewall — that's the #1 way users bypass Umbrella. Chrome and Firefox both support auto-DoH. Add to your FTD policy.
2× VA per site, AD Connector on a DC. AnyConnect roaming module pushed via Intune. External DNS redirected at firewall. No SIG.
IPsec tunnels from each branch SD-WAN to Umbrella head-end. VAs at HQ + 3 regional hubs. AD Connector on domain controllers. Policy split: Finance group stricter rules.