Cisco Umbrella virtual appliance (VA)

In short: The Cisco Umbrella virtual appliance (VA) is a lightweight DNS forwarder you run on your own hypervisor or cloud. It sends external queries to Umbrella with the internal IP address attached, forwards internal domains to your DNS servers, and, with the AD Connector, adds user and group identity. Cisco requires two or more per site.

What the virtual appliance does

With plain network DNS forwarding, Umbrella only sees your public IP address, so every request from a site looks the same. The VA fixes that. Your clients use the VAs as their DNS servers, and each VA:

• Forwards external queries to Umbrella, tagged with the internal IP address of the device that asked, so policy and reports can tell devices apart.
• Forwards internal domains to your own DNS servers. You list your internal domains in the Umbrella dashboard, and the VA sends those lookups to your domain controllers or internal DNS. Cisco's VA console also supports conditional forwarding of specific internal domains to specific internal servers.
• Adds user and group identity when paired with the AD Connector, so a policy can apply to a group and reports name the person.
• Keeps protection consistent for every device that uses internal DNS, including servers, printers and guest-isolated networks that route through it.

VAs are available in every Umbrella package, from DNS Security Essentials upwards.

Supported platforms

Cisco supplies the VA as an image for common hypervisors and public clouds. Cisco's documentation names:

Each VA is a small virtual machine with a static internal IP address and outbound access to Umbrella on the ports Cisco documents. VAs upgrade themselves automatically by default, under auto-upgrade settings in the dashboard, and an out-of-date VA can also be upgraded from the Sites and Active Directory page. The restricted console covers settings such as DNSSEC, resolver choice, custom NTP servers, SNMP, per-IP rate limiting and syslog export of audit, health and internal DNS logs.

Cisco recommends API key credentials to authenticate the VAs and AD Connectors to Umbrella; current releases of both support this. We size and place VAs to suit your estate using Cisco's sizing guidance.

Redundancy: always deploy at least two

Cisco's own dashboard warns when a site's VA is "not redundant" and asks for two or more VAs per site. The reason is simple: if your clients' only DNS server goes down, nothing on the network can resolve names.

Good practice:

• Deploy two VAs per site, on different hosts where possible.
• Hand both out as the DNS servers in DHCP, and configure servers with both.
• Keep your internal DNS servers redundant too, since the VAs forward internal lookups to them.
• Group VAs and AD Connectors into Umbrella sites so the right connector feeds the right VAs.
• Monitor VA health in the dashboard and act on its warnings.

Pairing the VA with the AD Connector

The VA supplies the internal IP address; the AD Connector supplies who was using it. The connector is a small Windows service, on a domain member server or a domain controller, that passes logon events from your domain controllers to the VAs and sends users, groups and computers to the Umbrella cloud. Passwords are not uploaded, Cisco says user information is hashed locally, and the connector does not read password hashes.

The connector talks to the VAs one way, and that traffic is not encrypted, so keep it on a trusted internal network. A domain controller needs a connector in the same Umbrella site to feed that site's VAs. One connector per AD domain is enough to provision identities, with an optional second for redundancy; spreading domain controller load across two or more connectors is an advanced option enabled through Cisco support. Full details are on Umbrella identities and SAML.

Roaming clients behind a VA

Laptops running the Umbrella Roaming Security Module in Cisco Secure Client move between home and the office. With the dashboard's backoff behind virtual appliance setting enabled, a roaming computer that detects a VA sends its DNS through the local network instead. That keeps internal name resolution working and means the request is attributed through the VA and AD Connector, as it would be for a desktop.

A customer trusted network setting, based on an internal-only subdomain, can also tell the module it is on the corporate network. Either way, devices are protected by the VA in the office and by the module everywhere else, under one policy.

When a DNS policy includes VA identities, Umbrella matches them in a set order: AD user, then AD computer, internal network, site, roaming client and finally network. Cisco recommends pointing all computers at the VAs; if a network identity still shows up in reports for a VA-protected site, the configuration may be incomplete.

Deployment steps and how we help

1. Register your public IP addresses as network identities and confirm basic DNS protection works.
2. Create an Umbrella site and download the VA image for your hypervisor or cloud.
3. Deploy two VAs with static IP addresses and complete the console setup.
4. List your internal domains in the dashboard, and add conditional forwarders where needed.
5. Install the AD Connector in the same site as your domain controllers, with a second for redundancy if you want one, and check that users and groups appear.
6. Change DHCP and server DNS settings to point at the VAs, then block outbound DNS to anything else at the firewall.
7. Test internal and external resolution, block pages and reporting before full cut-over.

A well-documented VA design (sites, internal domains, forwarders and connectors) also makes it far easier to plan the Umbrella to Secure Access migration later. Umbrella's end of sale is 31 January 2027; see Cisco Umbrella end of life.

We design, deploy and support Umbrella VAs and the AD Connector. Contact us to plan yours, or go back to the Cisco Umbrella deployment guide.

How Forever Systems supplies and supports Cisco Umbrella

We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.

• Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
• Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
• Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
• Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
• Ongoing support: reporting, policy tuning, renewals and licence changes

Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.

Frequently asked questions

Explore Cisco Umbrella

Related from Forever Group

• Cisco Secure Access
• The Cisco Secure portfolio
• Cisco Umbrella from Forever Group
• Cyber security services