Configure a SASE Tunnel for Umbrella

Step 1

Log in to your management center, choose Devices > VPN > Site To Site.

Step 2

Click + SASE Topology to open the SASE topology wizard.

Step 3

Enter a unique Topology Name.

Step 4

Pre-shared Key: This key is auto-generated according to the Umbrella PSK requirements. For a single topology, the pre-shared key is common for all threat defense spokes and Umbrella.

Step 5

Choose a data center from the Umbrella Data center drop-down list. (Configure routing on the threat defense to ensure reachability of the umbrella DC from the threat defense.)

Step 6

Click Add to add a threat defense node.

1. Choose a threat defense from the Device drop-down list.

   Only devices managed by the management center appear in the list. For high availability pairs, the HA pair names appear in the endpoint list.

2. Choose a static VTI interface from the VPN Interface drop-down list.

   To create a new static VTI interface, click +. The Add Virtual Tunnel Interface dialog box appears with the following pre-populated default configurations.

   • Tunnel Type is static.

   • Name is <tunnel_source interface logical name>+ static_vti +<tunnel ID>. For example, outside_static_vti_2.

   • Tunnel ID is auto-populated with a unique ID.

   • Tunnel Source Interface is auto-populated with an interface with an 'outside' prefix.

   • IPsec tunnel mode is IPv4.

   • IP address is from the 169.254.x.x/30 private IP address range.

3. Enter a prefix for the local tunnel ID in the Local Tunnel ID field.

   The prefix can have a minimum of eight characters and a maximum of 100 characters. Umbrella generates the complete tunnel ID (<prefix>@<umbrella generated ID>-umbrella.com) after the management center deploys the tunnel on Umbrella. The management center then retrieves and updates the complete tunnel ID and deploys it on the threat defense device. Each tunnel has a unique local tunnel ID.

4. Click Save to add the endpoint device to the topology.

   You can add multiple endpoints in a SASE topology.

Step 7

Click Next to view the summary of the Umbrella SASE tunnel configuration.

Step 8

Check the Deploy configuration on threat defense nodes check box to trigger deployment of the network tunnels to the threat defense. This deployment occurs after the tunnels are deployed on Umbrella. Local tunnel ID is required for the threat defense deployment.

Step 9

Click Save.