As the end-of-life of Cisco's Umbrella Roaming Client looms, customers are scrambling to understand the impact, transition to the Cisco Secure Client or potential alternatives. There are a few things they should consider.

The Cisco Umbrella was born based on the networking giant’s acquisition of Open DNS in 2015. Cisco earlier announced the stand-alone Umbrella Roaming Client software, which has provided DNS security for millions of users, is going end-of-life on April 2 this year and the last date of support will be April 2, 2025.

“All its functionality has been incorporated into the Umbrella Roaming Module in Cisco Secure Client,” Adam Winn, leader of product management at Cisco, told SDxCentral in response to questions. “Customers may upgrade to the Cisco Secure Client at no cost. Customers will not lose any functionality and will gain new benefits.”

“While Cisco typically provides a 12-month notice for such software EOL [end of life] announcements, given the millions of users of the Umbrella Roaming Client, we pre-announced the end-of-life notice six months ago to give our customers and partners extra time to prepare,” he said. “Additionally, after the April 2025 end-of-life date, the Roaming Client will continue to work for those customers that cannot complete the upgrade by then.”

Customers try to figure out the impact on cost and labor

However, the end-of-life transition presents both challenges and opportunities for more than 30,000 Umbrella customers and the wider market, as the migration to Cisco Secure Client is likely to include price increases and will require labor to replace the roaming clients across all endpoints, a competing DNS security provider DNSFilter noted.

While Cisco has outlined migration steps to ease the process, IT teams will still face inevitable work and potential disruptions, Steve Staden, senior director of product management at DNSFilter, told SDxCentral.

“From our customer's opinion, it ends up being work and headache, because they're going to have to make changes to customer environments. And with that, there's always risks of something going wrong,” he said. “I think that's kind of the big unknown.”

The end-of-life cycle has opened the door for some Umbrella Roaming Client users to reevaluate their needs and assess competing products like DNSFilter, according to Staden. “So if they've been frustrated with Cisco for any reason, or have had reasons to look at other options. Now's kind of the time because they're gonna have to do work no matter what.”

“Most of the conversations we've had are kind of pre-that migration because they're looking around already saying, 'Hey, I'm gonna do this anyway. What are the other options out there and try to understand the differences,” he said. “I think a lot of folks are just trying to understand what is the typical cost of these tools, because back when they purchased, they may have been a legacy customer five years ago. Pricing has changed, especially as there's been new entrants in the market.”

In addition, from the viewpoint of managed service providers (MSPs) and managed security service providers (MSSPs), the transition is particularly challenging as they are serving many different customers with tons of endpoints.

“So [MSPs and MSSPs] seem to be the ones that they're most interested in looking around. And I mean, it's not any surprise, but they're also very cost sensitive … and they're getting pushed by their customers like how can they have the most cost-effective and most efficient solution out there,” Staden said.

Cisco addresses customer concerns over the end-of-life transition

Cisco claims the transition to the Cisco Secure Client will improve performance, broad compatibility and bring no extra costs.

On pricing worries, Winn assured that Umbrella solution subscriptions are fixed for the life of the contract (up to five years), with no separate license or cost for the Cisco Secure Client with the Umbrella Roaming Module.

“Cisco understands that this is not the right time to be pushing price increases on customers, and we want to be clear that this is a no-cost, net-benefit migration for our customers,” he said. “In fact, Cisco has not changed prices of the Umbrella products since 2016.”

Regarding labor-related concerns, Winn argued, “For quite a few customers, this change is labor-saving. Cisco Secure Client reduces the number of endpoint agent installations a customer must test and deploy.”

He added Cisco took special care to make this migration technically as easy as possible. “When Secure Client is installed, it will automatically detect any existing Roaming Client installations, gather the configuration from it, migrate those settings to Secure Client, and then uninstall the Roaming Client. This is all automatic and seamless.”

The transition also brings more security capabilities to customers, Winn claims. The Umbrella Roaming Module under the Cisco Secure Client platform provides off-network DNS-layer security and adds client-based secure web gateway (SWG) protection.

The platform also offers the optional AnyConnect VPN/zero-trust network access (zero-trust network access (ZTNA)) and secure endpoint detection and response (EDR) Modules. “A further benefit of Umbrella’s roaming functionality being incorporated into Cisco Secure Client is improved interoperability with third-party VPNs,” he said.

The transition to Cisco Secure Client is part of the platform approach

Winn sheds light on Cisco's strategic vision behind this transition. “Cisco believes in the power of the platform. Our goal is to create a unified experience that integrates previously separate solutions into one simpler tightly integrated solution.”

He explained Cisco Secure Client is the vendor’s endpoint capability within the Cisco Security Cloud, which allows customers to adopt new Cisco products without having to deploy new software every time.

“Our customers have told us that deploying and managing separate endpoint agents is time-consuming,” he said. “Based on that feedback, in 2022, Cisco released a unified security client that consolidated standalone Cisco Secure Endpoint, AnyConnect VPN Client, etc. into a single integrated agent with the flexibility for customers to install and deploy the modules they want to enable functionality. In 2023, the standalone Umbrella Roaming Client was integrated into Cisco Secure Client as an additional module.”