Hello Everyone,
We are approximately six months into Distance Education at our K12 institution and are looking to push out a payload to route all student iPad traffic through Cisco Umbrella. We are currently using Umbrella district wide both for on-campus network filtering and also for all Chromebook traffic (including at home).
We have successfully linked Umbrella with JAMF, as you can see in the below screenshot.
The downside we are seeing is that in order for the DNS routing to work you must install the Cisco Security Connector. This is fine and all, but it also appears that this application must be opened prior to any data following through OpenDNS? Has anybody run into a similar scenario and found a solution?
It feels like our department can do everything on our end to get this ready to go but if the student doesn't open this app at least once they will be able to browse unfiltered internet.
Here is the link to the official documentation from Cisco on deployment.
I found the answer on this, confirmed by cisco and testing - if you want the mobile device policy to continue to be applied while on-premise, the devices need to not use the on-premise Umbrella VA's for DNS resolution. Beyond that, because policies are applied in order from top to bottom, the mobile device policy needs to be above the default policy (which is applied to the site because of the trusted network egress IP).
So in our case, that means having the iPads join a subnet configured to supply our standard AD DNS servers in the DHCP response rather than the Umbrella VAs. Then we get our granular policy application from the mobile identity (and roaming client identities) same as off-premise, but with the default policy being catch-all for any device egressing from the site that doesn't have the Connector App or roaming client. Another option would have been grouping the iPads on unique internal subnet (via separate SSID, VLAN derivation, etc.) and applying a unique policy to that internal network. But that seems harder to do for grade-level specific grouping.
Secondly, I had been hoping that WPA2 Enterprise network auth against our Microsoft NPS RADIUS (and AD) would produce a login event (Event 4624) that the Cisco Umbrella AD connector would see/use to correlate username with local IP, as it does for roaming clients. But, although username is present in Windows Event 4624, local IP is not present, so this information is not correlated by Umbrella and AD username or AD group can't be used for Umbrella policy for iOS devices.
Also, a colleague confirmed the the Cisco Clarity component has nothing to do with identity as I was first wondering - it is strictly supplying info to Cisco AMP.
