If the domain is deemed to be malicious or hosting malicious content or blocked by a customized security policy, the IP address of the Umbrella block page server is sent back in the DNS response instead of the IP address of the domain. Security Blocking and Installing a Certificate on Endpointsīased on the domain (FQDN) that is being queried, Umbrella determines if the IP addresses should be provided in the response. For more information and an example of the problem, see Cisco ASA Firewall blocks DNSCrypt DNSCrypt-If there are any devices in front of the ISR that may block DNSCrypt for not looking like an actual DNS packet, the DNSCrypt feature may not work.For initial registration-The opendns_out interface (this may have a different name if you so choose) must be able to access over port 443 in order to complete initial registration.The following network requirements must be met: Ensure that DNS traffic goes through the Cisco 4000 Series ISR. The Cisco 4000 Series ISR should be set as the default DNS server gateway.A valid Cisco Umbrella subscription license.The Cisco 4000 Series ISR must have a security K9 license to enable Cisco Umbrella.For more information, see the Upgrading the Device Image to Cisco IOS XE Denali 16.3 section of this guide. You can upgrade from any ROMMON version to release 16.2(1r).The Cisco 4000 Series ISR runs the Cisco IOS XE Denali 16.3 software image or later.

The minimum ROMMON version to load the Cisco IOS Denali 16.2 image on a Cisco 4000 Series ISR is 16.2(1r).Before you configure the Cisco Umbrella integration feature on the Cisco 4000 Series ISR, ensure that you have the following:

Opendns dnscrypt check