top of page
Search

Cisco Umbrella Domain Allow Miss: nslookup When the Same PC Has Two Resolvers

  • 3 days ago
  • 2 min read
Cisco Umbrella network security troubleshooting lab
Cisco Umbrella · Techclick CLI troubleshooting lab
You allowed a domain in Umbrella. Half the users still block. Their nslookup shows 8.8.8.8 or AD first.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Cisco Umbrella for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Umbrella only sees DNS it receives. A second resolver or a DoH browser bypasses your allow.

Why this ticket shows up

Allow lists do nothing for queries that never hit Umbrella.

Symptoms operators actually see

  • Allow exists, some PCs still block

  • nslookup Server is not 208.67.x.x or the VA

  • Chrome Secure DNS on

  • Split users on/off VPN

CLI first — copy this block

Run these on the Cisco Umbrella device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

nslookup -type=a blocked.example.com
nslookup blocked.example.com 208.67.222.222
ipconfig /all | findstr /i 'DNS'
# Windows DoH
netsh dns show encryption

How to read that output

If the configured DNS is not Umbrella or the VA, your allow never ran. Queries to 8.8.8.8 will follow Google policy, not yours.

Triage order

  1. Check the PC DNS servers

  2. Force Umbrella/VA via DHCP or the roaming client

  3. Disable browser DoH in the managed profile

  4. Retest the allow

  5. Do not add the domain to the firewall as the first move

Classic traps

What you see

Real cause

Fix

Allow the domain again

DNS never went to Umbrella

Fix resolver

Block 8.8.8.8 only

DoH still bypasses

Control the client

Disable Umbrella

Half the fleet is not even using it

Fix enrollment

Proof the ticket is closed

  • nslookup server is Umbrella/VA

  • Allow works on a previously failing PC

  • DoH off on managed browsers

Say this in an interview

An Umbrella allow that 'does not work' is often DNS that never reached Umbrella.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page