Does Umbrella VA change the source IP of DNS requests?

[guacamoley]

Say a user sends a DNS request for youtube.com. Their DNS is locally configured to send all requests to the VA. Will the VA then forward the request with its own private IP or would it forward it with the original device's IP? 

[Rob Ingram]

@guacamoley the VA will preserve the original client device IP address when the packet is routed to the cloud. This way Umbrella can create policies based on the internal networks.

[guacamoley]

 Got it - A follow up, in that case will the traffic will show up as "Internal Networks" as opposed to the public SNAT of your internet edge?

[MHM Cisco World]

Friend there are two IP' the IP of client request DNS and IP used by FW or router to connect to Umbrella' 

The IP used by FW or router is public IP and client IP is private almost.

I.e. the FW or router encapsulate the dns request inside udp packet.

MHM

[Rob Ingram · Accepted solution]

@guacamoley yes, if you are using the VA the traffic will show up as the internal network, which would be the client's real IP address (not the FW/router NAT IP address). You need to associate the Internal Networks with an Umbrella Site, Network or tunnel.

If you are not using the VA the NAT ip address would show up in the Cloud.