I'm currently architecting a secure web gateway deployment for a financial services client with a hybrid workforce, and I need to implement a time-based access control policy within Cisco Umbrella. The business requirement is to enforce a stricter security policy during core business hours (Monday to Friday, 9 AM to 5 PM local time), while relaxing certain categories for research during off-hours.
My specific configuration challenge revolves around the interaction of Identity and Policy components. I have successfully configured Active Directory integration via the AD Connector, and my identities are populating correctly. However, the temporal condition for policy application is not behaving as expected.
Here is my current policy configuration attempt, focusing on the critical elements:
1. **Policy Structure:** I created a dedicated policy intended to be applied only during the specified time window.
2. **Identities:** The policy is associated with the relevant AD groups.
3. **Destination Lists:** I have configured the necessary allow and block lists.
4. **Time Window Configuration (The problematic section):**
* I navigated to **Policies > Policy Components > Time Windows**.
* Created a new Recurring Time Window named "Core-Business-Hours".
* Set the schedule as:
* Days: Monday, Tuesday, Wednesday, Thursday, Friday.
* Start Time: 09:00
* End Time: 17:00
* Time Zone: (Set to the organization's primary time zone, UTC-5).
I then attached this Time Window to the target policy. The expected behavior is that the policy's security settings (specifically, blocking select content categories like "Adult Themes" and "Streaming Media") are only active during the 9-to-5 window. Outside this window, the policy should not apply, and a less restrictive default policy should take effect.
The observed behavior is inconsistent. The policy appears to be active at all times for the identified users, not just during the defined window. This suggests a potential misconfiguration in the policy precedence or identity evaluation order.
My primary questions for the community are:
* What is the precise evaluation order when a Time Window is applied? Does Umbrella evaluate the identity first, then check if the time window is active, or is the time condition evaluated concurrently?
* Could this be related to the "All other identities" default policy? Should the time-bound policy have a higher or lower priority than the default policy?
* Are there known limitations with Time Windows when identities are sourced from an on-premises AD Connector versus a cloud-integrated identity?
* Has anyone successfully deployed a similar configuration and can share a verified policy architecture?
I am particularly interested in any diagnostic steps, such as specific log queries within the Umbrella Investigate module, that can confirm the active/inactive status of a time-based policy for a given user session. A concrete example of a working policy hierarchy would be invaluable.
Time windows are notoriously finicky in these platforms, especially with a hybrid workforce. The local time mapping usually trips people up. When you say "local time," are you sure Umbrella is correctly associating the source IP or identity location with a timezone? It often defaults to UTC or the umbrella datacenter region.
You mentioned your identities are populating, but did you verify the time condition is actually evaluating per identity and not as a global schedule? I've seen it where the policy activates on the console's clock, not the user's. That mismatch will give you exactly the behavior you're describing.
Trust but verify
That's a really good point about the console's clock versus the user's local time. I've mostly worked with tools that base time zones on a user profile setting, not dynamic IP detection. How reliable is Umbrella's method for determining location from an IP for this? If someone is traveling or using a VPN, could that break the policy timing entirely?