Network Wizkid

Change Log

Change	Date
Added a new section ‘Calculating SIG Usage’	18/03/24

One thing that I find is often overlooked, misunderstood or not really understood from the very start is how to determine the number of seats required for an Umbrella subscription. Now, in my opinion, I can see why customers might struggle with the way that Umbrella is licensed because of the several factors one must consider but fear not because I’ll break it down in this article.

We will focus on the following subscriptions which are available to order at the time of writing this article:

• DNS Essentials
• DNS Advantage
• SIG Essentials
• SIG Advantage
• DNS for Education
• SIG for Education

When we refer to ‘seats’, each user is classed as one seat.

When working out how many seats to purchase or renew for an Umbrella deployment, you will need to consider the following:

• The subscription type that is required
• The total number of employees
• The total number of students – K-12 and Higher Education (if any)
• Whether Umbrella is an a la carte offering or part of an Enterprise Agreement (EA)
• Anticipated DNS query average per user per day

Let me explain why each of the point mentioned above needs to be considered before purchasing or renewing a Cisco Umbrella subscription.

The subscription type that is required: Besides the variation in features offered in each subscription, the number of users required may change based on the organisation. For example, your organisation is an educational institute then an Umbrella Education (EDU) subscription model might be the most viable option over a non-EDU subscription. This leads me onto the next two points below.

The total number of employees: When purchasing or renewing Umbrella, you will need to take into account the total number of employees within your organisation. This is because it is likely that all these users will be covered by the Umbrella solution once configured. These users will often determine the total number of seats an organisation will require. Depending on how long you’re taking the subscription for, it could be worth factoring growth of up to 20% to cover new employees and to ensure that you don’t exceed the total number of seats that you intend to purchase. If your organisation is an educational institute, this number could change but is dependent on the subscription type. We will cover some examples below.

The total number of students – K-12 and Higher Education: If you’re an educational institute then you might need to take the total number of students into consideration, but this will depend on the subscription tier.

For those reading this that are not familiar with what K-12 is, here’s a definition:

The expression “K–12” is a shortening of kindergarten (K) for 5–6-year-olds through twelfth grade (12) for 17–18-year-olds, as the first and last grades. (Wikipedia)

Higher education is therefore considered anything after K-12.

The way Cisco calculates licenses for K-12 students and higher education students is as follows:

• For K-12 students, one (1) user license is required for every ten (10) students. This does not include the licenses required for employees.
• For higher education students, one (1) user license is required for every five (5) students. This does not include licenses required for employees.

We will cover some examples of this below to give you a better idea of how this is calculated. You can also refer to the Master Service Level Agreement (MSLA) here for more information but note that this might not be the latest document available.

The above calculation also depends on the Umbrella subscription tier chosen. Please see the table below for more detail. If you have any further questions reach out to your Cisco representative or comment on this article and I’ll do my best to respond.

Subscription Tier	Are Students Counted?
DNS Essentials	Yes – based on total number of employees and students
DNS Advantage	Yes – at the ratios mentioned above
SIG Essentials	Yes – based on total number of employees and students
SIG Advantage	Yes – based on total number of employees and students
DNS EDU	No – only employees are counted
SIG EDU	Yes – based on total number of employees and students

Note that the information in the table above could change and although I will do my best to update this article, I would advise you to check with your Cisco representative if you need further clarification.

Whether Umbrella is an a la carte offering or part of an Enterprise Agreement (EA): If your Umbrella subscription is part of an EA then having a rough idea of the total number of seats may be enough to get started. That is because if your Umbrella subscription is part of an EA, Cisco allows for a 20% user-based growth. Please see the EA FAQ document here for more details.

Anticipated DNS query average per user per day: Cisco Umbrella DNS packages are subject to an average DNS query limit of 5,000 DNS queries per user, per day. This means that if certain departments for example SOC teams are expected to generate more queries, then you may need to factor in additional users to cover the query limit. If it is found that queries are excessive then Cisco will work with you to try and bring the number of queries down or where this is not possible, you may need to increase the number of seats. You can read more here about the DNS query average.

Example DNS Scenarios

With all that in mind, let’s take a look at some examples for different scenarios.

Scenario One: Enterprise with 3,000 Employees

Wizkid Enterprises is a medium-sized clothing business with 3,000 employees. With the expected yearly attrition, it is not thought that Wizkid Enterprises will exceed the total headcount within the year. They are exploring the idea of purchasing Cisco Umbrella to block access to potentially harmful content using DNS security. They would like to opt of DNS Essentials for one year to begin with. They don’t have any other Cisco products currently, but this could change in the future. Employee DNS query count per day is 3,400 and so is not expected to exceed 5,000 queries per day.

Scenario One Solution

Subscription Tier: DNS Essentials

Total number of employees: 3,000

Is this an educational institute? No

Is the subscription part of an EA? No

What is the anticipated total number of DNS queries per user, per day? 3,400

Total number of Umbrella seats required for Wizkid Enterprises: 3,000

Scenario Two: K-12 School with 150 Employees and 1,000 Students

A K-12 school is seeking a DNS security solution to prevent students accessing harmful content online. Moreover, the school has also stated that they would like to protect their employees by stopping them from visiting malicious websites. The IT team would like to ability to investigate domains in order to better determine which domains to allows and which domains to block. The school caters for 1,000 students and 150 employees. The school would like to purchase an a la carte, yearly subscription of Cisco Umbrella.

Scenario Two Solution:

Subscription Tier: DNS Advantage. As IT support would like to leverage the Umbrella Investigate, they won’t be able to opt for the DNS Security EDU package as this isn’t included in this package.

Total number of employees: 150

Is this an educational institute? Yes

Total number of K-12 students: 1,000

Is the subscription part of an EA? No

What is the anticipated total number of DNS queries per user, per day? 1,500

Total number of Umbrella seats required for K-12 School: 150 Employees + (1000 K-12 Students /10) = 250 user licenses

Scenario Three: Higher Education Facility with 565 Employees and 5,400 Students

A higher education school is seeking a DNS security solution to prevent students accessing harmful content online. Moreover, the school has also stated that they would like to protect their employees by stopping them from visiting malicious websites. The IT team would like to ability to investigate domains in order to better determine which domains to allows and which domains to block. The school caters for 5,400 students and 565 employees. The school would like to purchase an a la carte, yearly subscription of Cisco Umbrella.

Note that this is the same scenario as scenario two, but the only difference is that we need to account for more employees and higher education students.

Scenario Three Solution:

Subscription Tier: DNS Advantage. As IT support would like to leverage the Umbrella Investigate, they won’t be able to opt for the DNS Security EDU package as this isn’t included in this package.

Total number of employees: 565

Is this an educational institute? Yes

Total number of higher education students: 5,400

Is the subscription part of an EA? No

What is the anticipated total number of DNS queries per user, per day? 4,200

Total number of Umbrella seats required for the higher education facility: 565 Employees + (5400 HE Students /5) = 1645 user licenses

Calculating SIG Usage

Umbrella SIG Usage is calculated based on the number of covered seats in a subscription and assumes that each user will have a bandwidth limit of 50 kilobits per second (kbps). Cisco’s MSLA states that the average SIG usage per user is determined based on a 30-day rolling period.

Over a 30-day period, Cisco will calculate the usage by observing traffic samples from each Umbrella data center where the end user traffic is sent. Cisco disregards 5% of the traffic samples and takes the peak value from the 95th percentile. Cisco state that the traffic samples include DNS traffic, Secure Web Gateway (SWG) traffic and Cloud Delivered Firewall (CDFW) traffic.

SIG Calculation

Average Bandwidth = 95th Percentile Bandwidth (Peak Bandwidth) / Number of Seats

Example SIG Scenarios

Scenario One: Enterprise with 50,000 Employees

An enterprise customer seeking cloud-based security solution for its 50,000 employees in the United Kingdom. The company has turned to Cisco as they would like to leverage the SIG features. The business anticipate that each user would consume 1,500,000 kbps (1.5 Gbps) per month.

Scenario One Solution:

Subscription Tier: SIG Essentials

Total Number of Employees: 50,000

Is the subscription part of an EA: No

Anticipated Peak Bandwidth Per User Per Month: 1,500,000 kbps (1.5 Gbps)

30 kbps (Average Bandwidth) = 1,500,000 kbps (Peak Bandwidth) / 50,000 (Number of Seats)

This would mean that their usage count would be well within the 50 kbps, per user limit specified by Cisco.

Summary

Not all scenarios have been covered but hopefully this will give you a better idea of how to calculate the number of seats required for an Umbrella deployment.

For those that would like additional help calculating the required number of seats, I have created a 3-in-1 Umbrella Calculator which you can download here.

If you have any questions, please reach out to your Cisco representative or drop a comment below and I will do my best to help.