Manage Internet Security on Cisco Secure Client

Cisco Secure Client is Cisco's endpoint security client application that enables secure connections to private resources, software as a service (SaaS) apps, and internet resources protected by Secure Access. The Cisco Secure Client is configured with various software modules. A Cisco Secure Client module may require the deployment of a certain profile to run the module successfully. A system configuration manager or remote monitoring and management (RMM) system can download and deploy the Cisco Secure Client on an organization's user devices.

A Roaming Device is a user device that has Cisco Security Client deployed on the device with the Umbrella (Roaming Security) module.

Cisco Secure Client deployed with the Umbrella module enables secure internet access on user devices. The Umbrella module includes:

• DNS-layer security

• Web security—Secure web gateway (SWG)

Once deployed, Cisco Secure Client registers the user device with Secure Access and the device is added to the list of Roaming Device resources. Cisco Secure Client syncs with Secure Access periodically and the user device's web traffic is protected by the Secure Access policy. An organization's administrators can manage Roaming Devices protected by internet security in Secure Access. For more information, see Manage Internet Security.

For more information about the Cisco Secure Client, see Cisco Secure Client (including AnyConnect) Administrator Guide, Release 5.1.

Internet Security Bypass Sizing: Cisco Secure Access supports up to 5,000 combined domain entries (and up to 9,000 entries upon request to your Cisco representative or Cisco Support). While large lists are supported, maintaining consolidated domain lists is recommended for optimal performance and reduced memory utilization on roaming devices running Cisco Secure Client. For more information, see Manage Internet Security Bypass.

To ensure that the Cisco Secure Client Umbrella Roaming Security module deploys and operates successfully, your device must meet specific system and network requirements. This topic outlines the necessary prerequisites for installation, including supported network settings, security protocols, DNS configurations, and internal domain handling.

• System Requirements

• Network Requirements

• Transport Layer Security Protocol

• Network Access

• Roaming Security DNS Requirements

• Internal Domains

The Cisco Secure Client supports all vendor-maintained, generally available releases of an operating system unless otherwise noted. The Umbrella Roaming Security Module for Cisco Secure Client is not supported on Windows Server. For more information on the Cisco Secure Client and supported operating systems, see Release Notes for Cisco Secure Client (including AnyConnect), Release 5.1.

• For more information, see Network Requirements for Secure Access: Transport Layer Security Protocol.

• The Umbrella Roaming Security Module for Cisco Secure Client is not supported on Windows Server and is incompatible with other DNS-serving software. Do not install the module on a device that serves DNS requests. The module’s dnscryptproxy subprocess encrypts DNS traffic and listens on UDP and TCP port 53. This port usage conflicts with the Windows DNS Server service. The module is also generally incompatible with other software that binds to UDP or TCP port 53 on localhost, regardless of the operating system.

• Uninstall DNSCrypt before your install the Cisco Secure Client Umbrella (Roaming Security) module. The Cisco Secure Client Umbrella (Roaming Security) module installer automatically detects installations of DNSCrypt and prompts the administrator to uninstall before proceeding with the installation.

• Install the Cisco Secure Client Umbrella Roaming Security module on the C:\ drive. The Cisco Secure Client Umbrella module does not support secondary or remote drive installations.

• The Cisco Secure Client Umbrella Roaming Security module only supports dual-stack IPv4/IPv6 for macOS and Windows. Standalone support for IPv6 for both macOs and Windows is not supported.

The Cisco Secure Client sends all of your DNS lookups directly from your computer to the Secure Access global network resolvers. Thus, to ensure that Cisco Secure Client directs internal DNS requests to your internal DNS servers for resolution, you must add your local domain names to the internal domains list in Secure Access. The Cisco Secure Client's Umbrella module syncs with Secure Access periodically to check for new internal domains. This is a critical part of the setup process. We recommend that you populate the list of internal domains before you deploy the Umbrella (Roaming Security) module. For more information, see Domain Management.

Cisco Secure Access provides the option to manage domains when endpoints connect to internet resources with the Cisco Secure Client or a PAC file. Domain management allows DNS queries for certain domains to query the local network's DNS servers instead of the Secure Access DNS servers.

If you do not specify a list of internal domains, all DNS queries are sent directly to Secure Access, and as a result, cannot reach your network's local resources (for example: computers, servers, printers) on internally-hosted domains that rely on local DNS servers.

When you add internal domains to your bypass list, these internal domain queries sent from an endpoint with a Secure Access PAC file or the Cisco Secure Client bypass the Secure Access DNS resolvers. However, in the case of a tunnel, this configuration is not passed down, so there is no way to bypass traffic to the proxy per-organization with a custom configuration for network tunnels.

To ensure uninterrupted access to these resources, administrators should add the appropriate domains to the organization's domain bypass list. The domain bypass list syncs to all Cisco Secure Clients in your organization.

Populate the internal domains list with domains used by your organization to access local resources while on the organization's network (at the physical location or connected through VPN). The internal domains list is pre-populated with the .local TLD and all RFC-1918 (private network) reverse DNS address space. Secure Access syncs newly added domains to Cisco Secure Clients within about one hour. For more information, see Manage Domains.

The domains contained in the DNS suffixes configuration on a computer's adapter and global network settings are imported automatically into a Cisco Secure Client's internal domains list each time the Cisco Secure Client starts or a new network adapter (such as a VPN or wireless connection) is initiated. This sync process helps Cisco Secure Clients adapt when on newly seen networks where they may want to access local resources without adding the domain through the Secure Access.

The Cisco Secure Client can handle internal and external DNS queries gracefully.

The following sections focus on more in-depth information and logic with internal domains and expected behavior.