Prerequisites for Cisco Security for Chromebooks Client

To enable DoH protection on the Cisco Secure Chromebook client, these prerequisites are required:

You must have Cisco Security for Chromebooks Client.
You must have Secure Access login credentials.
A Google Workspace Admin account to push the Cisco Security for Chromebook client to all the Chromebook devices.
Recommended: Sync Google Workspace Identities with Secure Access to apply Google Workspace user and organizational unit based policies. For information, see Integrate Google Workspace Identities.
Chrome OS 110 or later (to enable DoH-based DNS layer protection on Chromebooks).
Chromebooks must not be in kiosk mode.
For DNS-layer protection, port 53 UDP and 443 TCP must be allowed.

You must have access to:
Chromebooks must be connected and logged in.
Install Cisco Secure Access root certificate on your Chromebooks to avoid certificate errors when accessing a Secure Access block page. For more information, see Install the Secure Access Root Certificate.
For more information about how to push the root certificate from Google admin console to all your Chromebook devices, see Set up TLS (or SSL) inspection on Chrome devices.
In the Google Workspace Admin console, the incognito window must be disallowed. From the Incognito mode menu, choose Disallow incognito mode. For more information, search for Incognito Mode in Chrome Enterprise and Education Help.

We recommend that you remove these solutions before deploying Cisco Security for Chromebook client.

The following devices and operating systems are not supported:
- Chrome browser on OS X, Windows, and Linux
- Devices running variations or third-party distributions of ChromeOS, such as Neverware CloudReady

Network requirements

Protection	Port and Protocol	Source/Destination	Notes
DNS Layer	53 (UDP)		Configured DNS resolvers should be reachable.
DNS Layer	443 (TCP) Registration.	Registration. polaris.qq.opendns.com	Used for registration of the client.
DNS Layer	443 (TCP)	sync.hydra.opendns.com	HTTPS. Used to sync device details and to fetch configuration.
DNS Layer	443 (TCP)	doh.sse.cisco.com	HTTPS. Used to resolve DNS requests.