Guides
Secure Access Help Center

Roaming Devices Settings

You can configure a number of advanced settings for both the Cisco Umbrella roaming client and the Cisco Secure Client.

Table of Contents

Prerequisites

Procedure

  1. Navigate to Connect > End User Connectivity > Internet Security.
  2. Under Settings, select a tab and then options on that tab:

General Settings

  • Use Active Directory for Access Policy—Enables identity support for roaming devices. Identity support is an enhancement to the Umbrella roaming client or the Cisco Secure Client Umbrella roaming security module that provides Active Directory user and group identity-based policies, in addition to user and private LAN IP reporting. See Identity Support for the Roaming Client.
  • Third Party VPN Compatibility—The Cisco Umbrella roaming client works with most VPN software; however, certain Cisco Secure Roaming security module and other VPN profiles may not resolve local DNS correctly on a VPN connection with Windows 10 due to the elimination of the system DNS binding order. The local LAN may bind above the VPN, failing to resolve local DNS over the tunnel. Select this setting to apply the legacy binding order behavior. For more information, see VPNs (including Cisco Secure Client) + Standalone Roaming Client + Windows 10 and 11: DNS Binding Order VPN compatibility mode.

Client Settings

Secure Client Settings

  • AnyConnect Client Auto-Update— When enabled, AnyConnect Client and all of its installed modules automatically update within 30 days of a release being posted to Cisco.com.
  • Secure client IPv6 DNS Protection— Provides DNS protection through redirection to Secure Access resolvers for IPv6.
    Note: DNS protection over IPv6 DNS564 support is not available.

Umbrella Roaming Client Settings

  • Roaming client IPv6 DNS Protection— Provides DNS protection through redirection to Secure Access resolvers for IPv6
    Note: DNS protection over IPv6 DNS64 support is not available.

Backoff Settings

This tab presents settings to enable the client to backoff from providing DNS protection in certain scenarios.

  • Backoff Behind Virtual Appliance— When this setting is enabled and the client detects a virtual appliance, DNS traffic goes through the local network. When this setting is disabled and the client detects a virtual appliance, DNS traffic is redirected to Secure Access, while web traffic is not.
    Note: This setting also applies to the iOS setting on the Mobile Device page.
  • Customer Trusted Network— When enabled, DNS and web redirection to Secure Access is disabled if the specified subdomain name is found on the network and resolves to an RFC-1918 local IP address (e.g. "10.0.0.1").
  • DNS Protected Network— Disables the DNS-based protection applied by the Cisco Secure Client Umbrella module while on a network protected by Secure Access. This includes the intelligent proxy as it is a DNS-based redirect. Relies on the protection of the network for all features. To trigger this setting, network registration and the network must be the higher policy (not same, but higher) and the local DNS server egress network must be the same network registration as straight out from the computer to 208.67.222.222. Having the network in the same organization will not trigger the disabling of traffic redirection.
  • AnyConnect Trusted Network Detection— Trusted Network Detection (TND) is configured in the Cisco Secure Client's AnyConnect VPN profile. Enabling this setting disables DNS traffic forwarding to Secure Access whenever TND indicates the current network is trusted.
  • AnyConnect VPN Detection— When enabled, DNS traffic forwarding to Secure Access is disabled when endpoint detects that a full-tunnel VPN session is active. This is specific to Cisco VPNs.
    Note: For tunnels, this functionality is supported only for full tunnels. It does not work for full tunnels with dynamic split tunneling.

Configure Protected Networks for Roaming Devices < Roaming Device Settings > Encryption and Authentication

Updated 7 months ago