Hey everyone,
I'm setting up a separate VLAN for some IoT devices (smart thermostats, cameras, the usual) and I'm trying to figure out the best DNS strategy. We're using Cisco Umbrella for our main corporate network, and I'm wondering if/how I should integrate it.
My main goals are:
1. Keep the IoT traffic isolated but still manageable.
2. Ensure they can't reach out to shady command-and-control servers.
3. Possibly log their DNS queries for basic monitoring.
Right now, my VLAN just points to the router's local DNS, which forwards to Umbrella. But that feels a bit too blended with our main network traffic. I've read about setting up a separate Umbrella policy with different DNS settings.
Could someone share a practical example of how they've set this up? Like, do you:
- Create a dedicated network identity in Umbrella for the IoT VLAN?
- Use a different DNS resolver IP for that VLAN?
- How do you handle the firewall rules to only allow DNS to go to Umbrella and nothing else?
Also, are there any common pitfalls with this approach? I'm thinking about things like devices that hardcode their DNS (looking at you, Google Nest), or breaking local discovery protocols like mDNS.
Here's a super basic snippet of what I *think* the DHCP config on the VLAN might need:
```text
option domain-name-servers 208.67.222.222, 208.67.220.220; // Example Umbrella IPv4
interface Vlan20
description IoT_VLAN
ip address 10.0.20.1 255.255.255.0
ip helper-address
```
But I'm not sure if I should be pointing them directly to Umbrella or through an internal forwarder. Any real-world experiences would be super helpful!
Learning by breaking