Cisco Umbrella + DNS Guardian Integration

Best-of-Breed Security to Protect Against the Widest Range of DNS Threats, On & Off-Network

The joint solution offers an unprecedented level of in-depth visibility and security of DNS services for the most comprehensive threat protection. On-premise, SOLIDserverTM DNS Guardian is a purpose-built security appliance enabling DNS Transaction Inspection (DTI) technology for real-time advanced analytics and context-aware behavioral attack detection over client traffic, at ultra-high speed (up to 10M Queries per Second). Patented adaptive countermeasures (block, quarantine, or rescue mode) ensure service continuity and data confidentiality while mitigating risk of false positives. When internet recursive DNS queries are identified as trustworthy, DNS Guardian tags, encrypts (DNSCrypt) and forwards them to the Cisco Umbrella platform to take advantage of the secure Cloud-based gateway. Cisco Umbrella checks filtering policies and resolves or denies the queries, offering a complementary layer of defense based on destination domain reputation thanks to Internet-wide big data analytics and machine learning.

This combination of complementary security technologies extends the enterprise security perimeter by protecting both on/off-network users and internal DNS services availability – resolver and authoritative. Thanks to “on-the-fly” traffic tagging with Cisco IDs, DNS Guardian enables detailed visibility of the client behind each query, via the Cisco Umbrella portal. Additionally, DNS-DHCP-IPAM data offers key information on associated devices such as location or name, improving network control, reporting capacity and remediation efficiency.