In short: A Cisco Umbrella IPsec tunnel connects a site's firewall, router or SD-WAN edge to Umbrella's Secure Internet Gateway (SIG), so all internet-bound traffic is inspected by the web gateway and cloud-delivered firewall. Tunnels need a SIG package, use IKEv2 only, and are created in the dashboard's Network Tunnels page with their own credentials.
What a network tunnel does
In the DNS packages, Umbrella only sees DNS lookups. In the SIG packages, an IPsec tunnel from each site carries the traffic itself to Umbrella's data centres, where it passes through:
- the Umbrella cloud-delivered firewall, which applies layer 3 and 4 rules to traffic on any port, with layer 7 application control and IPS in SIG Advantage or as a SIG Essentials add-on;
- the Umbrella secure web gateway, which inspects web traffic, including HTTPS with selective decryption;
- Umbrella CASB and, where licensed, data loss prevention and Remote Browser Isolation (RBI).
Because protection happens in the network path, it covers every device at the site: desktops, guests, printers and IoT that cannot run an agent. The cloud-delivered firewall handles only TCP, UDP and ICMP traffic to and from the internet; Cisco says other IP protocols are silently dropped without appearing in the dashboard, so check any application that relies on them. Umbrella's SWG and firewall data centres include London and Manchester, so UK sites can connect locally.
Requirements
| Requirement | Detail |
|---|---|
| Package | SIG Essentials or SIG Advantage (or a SIG trial). Network tunnels are not included in the DNS packages. |
| IKE version | IKEv2 only. Devices that only support IKEv1 cannot connect. |
| Device | A firewall, router or SD-WAN edge that supports IKEv2 IPsec. Cisco lists tested Cisco routers, Cisco Secure Firewall, Cisco ASA, Cisco Catalyst SD-WAN and Cisco Meraki MX; other devices may work but Cisco has not tested them all. |
| Ports | UDP 500 and 4500 allowed outbound on any upstream device. |
| Packet size | Cisco specifies a maximum MTU of 1400 bytes and MSS of 1360 bytes inside the tunnel, because fragmented packets are dropped. |
| Addressing | A public IP address at the site and the head-end address of the Umbrella data centre you will connect to. |
| Routing | The ability to send internet-bound traffic (a default route or policy-based routing) into the tunnel, while keeping Umbrella's own head-end addresses and any exceptions outside it. |
Cisco publishes configuration guides for each supported platform. For Cisco Catalyst SD-WAN, the router can create the tunnel in Umbrella automatically by calling the Umbrella management API with a key and secret. For Meraki, see Umbrella and Cisco Meraki. An organisation can have a set number of network tunnels by default (50 at the time of writing), and Cisco support or your account manager can raise it.
Setting up a tunnel in the Umbrella dashboard
- In the Umbrella dashboard, go to Deployments, Core Identities, Network Tunnels and select Add.
- Name the tunnel after the site and choose the device type that matches your firewall or router (or Others).
- Choose the tunnel ID format (email address or IP address), then set the tunnel ID and a passphrase, which acts as the pre-shared key. Select Secure Internet Access as the service type.
- Copy the tunnel ID and passphrase and save. Store them securely, as you will enter both on your device, and use a unique set for every tunnel.
- On your device, create an IKEv2 IPsec tunnel to the Umbrella data centre head-end, using the tunnel ID as the local identity and the passphrase as the pre-shared key, with parameters from Cisco's supported IPsec list.
- Route internet-bound traffic into the tunnel. Exclude traffic that should not go through Umbrella, such as traffic to the tunnel head-end itself.
- Check the tunnel shows as active in the dashboard (Umbrella marks it active once it receives traffic), then add it to your web and firewall policies as an identity.
- Test with a few internal users before moving the whole site, and check events in the Activity Search report.
Redundancy and capacity
A single tunnel is a single point of failure, and Umbrella's data centres do not all behave the same way:
| Data centre type | What Cisco says | UK example |
|---|---|---|
| With automatic IPsec failover | Tunnels move automatically to the other data centre in the region if one is unavailable. A backup tunnel is not required but is still recommended, so you can monitor and move traffic yourself. | London, paired with Frankfurt in the same region |
| Without automatic IPsec failover | Tunnels must be configured with a backup tunnel, which can go to any IPsec-enabled Umbrella data centre. | Manchester |
Good designs also:
- Use unique credentials for every tunnel. Cisco says two tunnels cannot connect to the same data centre with the same credentials, and unique credentials avoid outages if a tunnel is rerouted by anycast failover.
- Use your device's failover features, such as tunnel monitoring and route tracking, to move traffic automatically.
- Plan capacity. Cisco documents an approximate throughput limit per tunnel. Larger sites build several tunnels and share traffic across them with equal-cost multi-path (ECMP) routing or policy-based routing.
- Remember the bandwidth term. SIG licences include an average bandwidth allowance per Covered User; see Cisco Umbrella pricing.
What to send through the tunnel
Send all internet-bound traffic for the site, then make deliberate exceptions:
- DNS: keep DNS going to the Umbrella resolvers or your Umbrella virtual appliances so DNS-layer policy and identity still apply. Meraki's Umbrella guidance, for example, recommends bypassing the tunnel for traffic to the Umbrella resolvers on port 53.
- Web: web traffic is inspected by the SWG once web policy applies to the tunnel identity, in transparent or explicit proxy mode. Install the Umbrella root certificate on managed devices if you decrypt HTTPS.
- Umbrella's own gateway and SAML traffic: Cisco says you must not exclude the SWG identity gateway address from the tunnel, and that SAML traffic must follow the same path as the web traffic. Exclusions are made on your device, not in the Umbrella dashboard.
- Non-web traffic: other ports are handled by the cloud-delivered firewall rules you set.
- Exceptions: VPN headends, voice platforms or applications that do not tolerate inspection may need to bypass the tunnel or be exempted from decryption.
- Inbound traffic: the tunnel secures users' outbound internet access; it is not a way to publish internal services. Keep your local firewall for inbound rules.
Tunnel traffic is identified by the tunnel itself. To see individual users, add SAML authentication for web traffic or use the roaming module on laptops; see Umbrella identities and SAML. An on-premises proxy cannot chain to Umbrella through a tunnel: Cisco supports proxy chaining for network deployments only.
Tunnels after Umbrella, and how we help
Cisco Secure Access, the successor to Umbrella, also connects sites with IPsec tunnels, and its Secure Internet Access tiers replace the SIG packages. Umbrella's end of sale is 31 January 2027. If you are designing tunnels now, keep the design documented so it can be rebuilt for Secure Access; see Umbrella to Secure Access migration.
We design and build Umbrella tunnels from Cisco Secure Firewall, Cisco Meraki, Cisco routers and other platforms, with redundancy and testing. Contact us to plan your sites, or go back to the Cisco Umbrella deployment guide.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Umbrella support IKEv1?
No. Umbrella network tunnels use IKEv2 only, so the firewall or router at each site must support IKEv2 IPsec.
Do I need SIG for Umbrella IPsec tunnels?
Yes. Network tunnels are part of the SIG Essentials and SIG Advantage packages. The DNS Security packages protect at the DNS layer only and do not include tunnels.
How many tunnels should each site have?
Plan on two, each with its own credentials. Data centres without automatic IPsec failover, such as Manchester, must have a backup tunnel, and Cisco recommends one even where failover is automatic, such as London. Larger sites may need more tunnels for capacity.
Does DNS go through the Umbrella tunnel?
DNS should still reach the Umbrella resolvers or your virtual appliances so DNS-layer policy applies. Meraki's Umbrella guidance recommends excluding traffic to the Umbrella resolvers on port 53 from the tunnel.
What MTU should an Umbrella IPsec tunnel use?
Cisco specifies an MTU no larger than 1400 bytes and an MSS no larger than 1360 bytes, because fragmented packets are dropped. Slightly larger values may work depending on your configuration.
Can I use an Umbrella tunnel for inbound traffic?
No. Umbrella tunnels secure outbound internet access from your site rather than publishing internal services. Keep your local firewall for inbound services.