In short: Cisco Umbrella deployment means sending DNS, and for SIG customers web and firewall traffic, to Umbrella's cloud. Most organisations point network DNS at Umbrella, add virtual appliances for internal DNS and Active Directory, install the roaming module on laptops, protect Chromebooks, and connect sites by IPsec tunnel for SIG.
Before you start: plan identities and policy
Every deployment method creates an identity in the Umbrella dashboard: a network, a roaming computer, a Chromebook user, a tunnel, a network device, or a user or group from your directory. Policies are applied to identities in order, so the first job is deciding which identities you need and which policy each should get.
A sensible plan answers four questions:
- Which package? DNS Security Essentials and Advantage cover DNS-layer protection; only the SIG packages add the full web proxy, cloud-delivered firewall and network tunnels. See Cisco Umbrella packages.
- Which networks? Every office, school or site with its own internet breakout needs registering, or an internal DNS path through a virtual appliance.
- Which devices leave the building? Laptops need the roaming module; Chromebooks need their own extension.
- Do you need user names in policy and reports? If so, plan the Active Directory or Microsoft Entra ID (formerly Azure AD) integration early. See Umbrella identities and SAML.
Bear the lifecycle in mind too. Cisco's end-of-sale date for Umbrella is 31 January 2027, so a new deployment should be designed with the later move to Cisco Secure Access in view. The Cisco Umbrella end of life page has the dates.
The deployment options, in order
Most organisations work through these steps. You will not need all of them, but the order matters: get DNS right first, then extend protection to devices and, if you have SIG, to all web and firewall traffic.
- Point network DNS at Umbrella. Set your router, firewall or DNS server forwarders to the Umbrella DNS servers and register each public IP address as a network identity. This protects every device on the network, including guests and IoT.
- Deploy virtual appliances where you run internal DNS. If you have Windows DNS or Active Directory, put two or more Umbrella virtual appliances in front of it, so internal names keep resolving locally and reports show internal IP addresses.
- Add the AD Connector or a cloud directory. This gives you users and groups for policy and reporting.
- Install the roaming module on laptops. The Umbrella Roaming Security Module in Cisco Secure Client (formerly AnyConnect) protects Windows and macOS devices on any network.
- Protect Chromebooks. Use Cisco Security for Chromebook, which replaced the legacy Umbrella Chromebook clients.
- For SIG, build tunnels from each site. Umbrella IPsec tunnels from firewalls, routers and SD-WAN send all internet-bound traffic to the secure web gateway and cloud-delivered firewall. Cisco Meraki has its own options; see Umbrella and Cisco Meraki.
- Use PAC files or proxy chaining where tunnels do not fit. For SIG, browsers can be pointed at the Umbrella web proxy with a PAC file, or an existing on-premises proxy can forward to it. Proxy chaining is for network deployments only: Cisco does not support sending proxy-chained traffic through an IPsec tunnel.
- Test, then tighten. Check blocks and allows with Cisco's test destinations, review Umbrella reporting, then move from a monitoring-style policy to your full content filtering policy.
Which method covers what
Each method protects a different slice of your estate. Use this to check for gaps.
| Method | What it protects | Packages | Identity it creates |
|---|---|---|---|
| Network DNS forwarding | Every device using that network's DNS | All | Network |
| Virtual appliance | Internal DNS clients, with internal IP visibility | All | Internal network, plus AD users with the connector |
| Roaming module (Secure Client) | Windows and macOS laptops on any network | All (web module needs SIG) | Roaming computer, plus user |
| Cisco Security for Chromebook | ChromeOS devices (DNS for the OS; web proxy in Chrome for SIG) | All (web proxy needs SIG) | Chromebook user |
| IPsec tunnel | All internet-bound traffic from a site | SIG only | Tunnel |
| PAC file or proxy chaining | Browser web traffic | SIG only | Depends on authentication |
| Network device integrations (e.g. Meraki access points) | DNS from clients on that device, SSID or group policy | Varies by integration | Network device |
The table reflects Cisco's package comparison: virtual appliances and roaming protection are in every package, while network tunnels and the full web proxy are SIG-only. Check the exact entitlement for your package on the packages page.
Common pitfalls
- Only one resolver configured. Always use two different Umbrella addresses so a single path failure does not break DNS.
- Internal names breaking. If clients use Umbrella directly, internal domains will not resolve. Keep internal DNS local, through a virtual appliance or your own DNS servers forwarding only external queries.
- Clients bypassing DNS. Devices with hard-coded resolvers or browser DNS over HTTPS can sidestep network DNS. Block outbound DNS to other resolvers at the firewall and manage browser settings.
- Old clients left in place. The standalone Umbrella Roaming Client reached its last date of support on 2 April 2025. Move to Secure Client.
- Tunnels with no backup. Some Umbrella data centres, Manchester among them, have no automatic IPsec failover and must have a backup tunnel. Even where failover is automatic, as with London, Cisco still recommends one.
- Policies in the wrong order. Umbrella evaluates policies from the top down and stops at the first match, falling back to the Default policy, so put the most specific identities at the top.
Planning for Cisco Secure Access
Cisco Secure Access is Cisco's named successor to Umbrella. It uses Cisco Secure Client on devices, connects sites by IPsec tunnel and draws users from the same kinds of directory. Cisco provides an automated upgrade manager for moving Umbrella organisations across, which needs an active Secure Access subscription and a claim code. Deploying Umbrella cleanly now, with documented identities, policies and tunnels, makes that move far easier later. Our Umbrella to Secure Access migration guide covers the steps, and Cisco Secure Access explains the successor platform.
Our Cisco Umbrella deployment service
We deploy Umbrella for UK businesses, schools, trusts and public sector organisations, from a single office to multi-site estates.
- Design: package choice, identity plan and policy order
- Network DNS, virtual appliances and the AD Connector or Entra ID sync
- Secure Client packaging and roll-out through Microsoft Intune, Group Policy or your RMM tool
- Cisco Security for Chromebook configuration in the Google Admin console
- IPsec tunnels from Cisco Meraki, Cisco Secure Firewall and other platforms
- Testing, handover documentation and ongoing support
Contact us to scope a deployment or review an existing one.
Explore Deployment
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the first step in a Cisco Umbrella deployment?
Register each site's public IP address as a network identity in the Umbrella dashboard and point that network's DNS forwarders at the Umbrella resolvers. Then test with Cisco's test destinations before adding virtual appliances, the roaming module, Chromebook protection or tunnels.
How long does it take to deploy Cisco Umbrella?
Pointing one network's DNS at Umbrella can be done in an afternoon. A full deployment with virtual appliances, directory integration, roaming modules and tunnels depends on the number of sites and devices, and is usually run as a short project with a pilot group first.
Do I need the roaming client if I already forward DNS to Umbrella?
Network forwarding only protects devices while they use that network. Laptops that go home or onto public Wi-Fi need the Umbrella Roaming Security Module in Cisco Secure Client to stay protected.
Can I deploy Umbrella without changing my firewall?
For DNS-layer protection, yes: you change DNS forwarders, not firewall rules. Blocking outbound DNS to other resolvers is still recommended. SIG tunnels do require configuration on the firewall or router.
Is it still worth deploying Umbrella in 2026?
Existing subscriptions continue to be supported until 31 January 2029, and Cisco's end of sale is 31 January 2027. New buyers should compare Umbrella with Cisco Secure Access before committing, and we can help you decide.