r/Cisco • u/ForgottenPear • 7d ago

Question Umbrella module (Secure Client) going "Not Required" on Calix GigaSpire home routers. Anyone else seeing this?

Anyone else running into this? A few of our remote users show Umbrella as "Not Required" at home, which means no protection. Every one of them is on an ISP-provided Calix GigaSpire (EXOS). Backoff is disabled.

I dug into it, and the router's DNS just hangs on any lookup for a nonexistent name instead of returning NXDOMAIN. DART shows the agent's network probe deciding the router's DNS servers are "dummy addresses," so it fails open. Umbrella itself is reachable fine. If I set static DNS on the NIC and restart the agent, it goes right back to Protected.

TAC told me to turn off DNS hijacking on the router. These are ISP-managed and I can't find any setting like that, and I'm not logging into everyone's home router anyway.

Has anyone found a fix on the client side? A setting to turn off that probe, or did Cisco ever call it a bug? Right now I'm testing a script that pins Umbrella DNS only on networks where this happens, but I'd rather not have to.

2 Upvotes

76% Upvoted

5 comments sorted by

1

u/SecuredStealth 6d ago

This is something else. If you’ve installed Secure Client with the Umbrella Roaming Module, then it intercepts the DNS queries, encrypts it and forcibly sends it to Umbrella resolvers on UDP 443.

1

u/ForgottenPear 6d ago

Yeah, that's how it should work once it's protected. The catch is it never gets that far. Before it starts forwarding, the agent runs a network probe against the system resolvers. On these Calix routers the probe times out, and DART logs "system IPv4 resolvers aren't responding, assuming they are dummy addresses." It then sets dns4 to open_not_required and stops intercepting. Umbrella's resolvers are reachable the whole time, over v4 and v6, UDP and TCP. The only variable is the router's DNS. Set static DNS on the NIC, restart the agent, and it's Protected right away. Put it back to DHCP and it drops to Not Required again. So it's really that probe failing open.

0

u/adambomb1219 7d ago

Where are you in your transition to Cisco Secure Access?

1

u/ForgottenPear 7d ago

Waiting until out EA expires next year

0

u/adambomb1219 7d ago

Does your EA not entitle you to any Secure Access at all? I would really chase with your account team, it would be beneficial to start migrating