Edit umbrella DNS policies and rules

Edit Umbrella DNS policies and rules to modify protection policies, configure bypass domains, enable DNSCrypt encryption, and adjust connection timeout settings to meet your organization's specific DNS security requirements.

Use this procedure when you need to modify existing Umbrella DNS policies and their associated rules. You can update protection policy settings, configure local domain bypasses, enable encryption options, and adjust timeout parameters to optimize DNS security for your network environment.

Procedure

Step 1

Choose Policies > Security policies > DNS.

Step 2

In the DNS Policy page, select the Umbrella DNS policy that you want to edit and click Edit (edit icon).

Refresh the Umbrella Protection Policy

If you want to get the latest Umbrella Protection Policy from Cisco Umbrella, click the Refresh icon next to Umbrella Protection Policy Last Updated.

To configure or modify Umbrella Connection settings for the Management Center, go to Integrations > Cloud Services Choose the Cisco Umbrella Connection.

Step 3

In the Umbrella DNS policy editor, select the Umbrella DNS rule and click Edit (edit icon).

Step 4

Configure the rule components, or accept the defaults:

  • Umbrella Protection Policy—Specify the name of the Cisco Umbrella policy to apply to the device.

  • Bypass Domain—Specify the name of the local domains for which DNS requests should bypass Cisco Umbrella and instead go directly to the configured DNS servers.

    For example, you can have your internal DNS server resolve all names for the organization's domain name on the assumption that all internal connections are allowed.

  • DNSCrypt— Enable DNSCrypt to encrypt connections between the device and Cisco Umbrella.

    Enabling DNScrypt starts the key-exchange thread with the Umbrella resolver. The key-exchange thread performs the handshake with the resolver every hour and updates the device with a new secret key. As DNScrypt uses UDP/443, you must ensure that the class map used for DNS inspection includes that port. Note that the default inspection class already includes UDP/443 for DNS inspection.

  • Idle Timeout—Configure the idle timeout after which a connection from a client to the Umbrella server will be removed if there is no response from the server.

Step 5

Click Save.

Your Umbrella DNS policy and rule modifications are saved and ready to be deployed. The updated settings will take effect when the policy is applied to devices.

What to do next

Associate the Umbrella DNS policy with an access control policy. For more information, see Associate the umbrella DNS policy with an access control policy.