Intro to Cisco Secure Access (CSA)
At a high level it works like this:
- Users > CSA > Resources
Ways to connect to CSA
- Remote managed > ZTNA > CSA
- Remote managed > VPNaaS > CSA
- Remote unmanaged > Clientless ZTNA > CSA
- Branch > IPsec tunnel > CSA
- IOT devices > IPsec tunnel > CSA
- We can also integrate SD-WAN connections into CSA (more on it later)
What we can do inside CSA
- Groups
- firewall rules
- web gateway
- DLP
- CASB (cloud security broker)
- Device posture
- ZTNA
- Monitor and TS
Outbound from CSA
- Connections to Internet and SaaS sites
- Backhaul to private apps hosted in your public or private cloud
- IPsec tunnels to other datacenter/pop/brance
PoP is point of presence. Often user will connect to the closest one for lowest latency
CSA connection can enter the POP in dublin and etc the POP in France for examle
What problem is cisco secure access trying to solve ?
- Orgs with remote users and 3rd party contractors who need access but also all secure
- Orgs with users who are mobile (in office / at home / on the road)
- Orgs with hybrid setups (on prem / public cloud / private cloud / SaaS)
- Consolidate all the access policies in one place
- Keep a zero trust mindset
Secure private access (tunnel or proxy)
- Via VPN
- Via ZTNA client
- Via ZTNA clientless
Secure Internet Access (s
- VPN full tunnel
- Internet security module
- Branch DIA
We can have SPA and SIA working together
Insights and monitoring
Admins and monitor endpoint performance with thousand eyes
Need an account and agent deployed
Global scale architecture
User > CSA POP > CSA routing > CSA POP > Resource
Unified cloud architecture
- Control everything in one cloud dashboard
- Traffic acquisition
- Collect and augment with extra data (posture etc)
- Classify traffic (public / private)
- Rules (FWaaS / SWG / CASB / Decryption / IPS / DLP)
- Send via backhaul or internet
Open APIs
- As well as the cloud dashboard
- Multiple Restful API
- Automate tasks
- Deployment
- Admin
- Policies
- Reports
Talos threat intelligence
Visibility across the entire threat landscape fusing experts data and gen AI
Talos detect threats and block them for all customers
User connectivity
- VPNaaS
- ZTNA module
- Web roaming module (80/443 only)
- Clientless ZTNA
VPN (DTLS/IPsec) > ZTNA (Wireguard/gRPC) > ZTA (MASQUE/QUIC)
TLS - TCP security
DTLS - UDP (some speed improvement)
QUIC is UDP based (fastest0), a way to speed up TLS connections
MASQUE - Multiplex Application Substrate over QUIC encryption / a streaming protocol. This is an application proxy that runs on top of QUIC. It can have multiple streams active in one MASQ session.
Client connectivity
Secure client
VPN > ASA> IPsec / Internet
ZTNA client > ZTNA proxy > IPsec / Resource connector
Sec/Roaming module > DNS/SWG > Internet
Clientless > Rev Proxy > IPsec / Resource connector
Branch > IPSec > IPsec / Internet
Cisco Secure Client
You will need to deploy the CSC client with the ZTNA module
Duo desktop will also be deployed if you use posture
Other modules
Secure endpoint (formerly AMP)
Roaming module (Umbrella but this will be replaced)
Thousand Eyes (no UI)
Cloud management module (no UI)
DART
Secure Private Access (client based ZTNA)
ZTNA supports apps via IPsec backhaul
FTD > HA VTI tunnels > CSA
We create two tunnels to CSA for redundancy
We configure BGP between the two so they can exchange routes
Secure Private Access (clientless)
Only works with web apps
Secure Private Access (VPN)
Connect to secure access cloud
Secure Internet Accesss via VPNaaS
Connect to CSA then on to internet sites / SaaS
Modular policy with magnetic UI
Define apps / resources
define private / public rules
Live demo
https://www.cisco.com/c/en/us/products/security/secure-access/live-demo.html
Cisco have a live demo which you can try it out
First step will be to setup a tunnel group (VPN)
Setup on your peer on the HQ or brance
Connector groups are for the resource connectors
We can add one to AWS Azure and VMware
We can add SAML/SSO for our user ID
Private resources
We can had a file server here
You can make firewall rules under secure
Zero trust
- Micro segmentation
- Network isolation
- Native OS support
- TPM to protect certs and key
Principals
- Never trust
- Always verify
- Enforce least privilege
Success factors
- Allow the user to work securely with minimal disruption
- Adjust policy to risk
- Consistency across environments because of shared policy
AI assistant
Helps you create rules but leaves them disabled, a human must enable the rule.
Planning for a CSA project delivery
- Well defined scope and timelines
- Access to sites / network devices etc
- Clear roles and responsibilities
- Single customer point of contact / PM
- Customer involvment and comms
- Clearly defined and agreed use cases
- Pilot and customer validation
- Knowledge transfer
- High level docs
- SOW - statement of work
- BOM - Bill of materials
- Checklist
Secure Access licensing
Essentials
- Secure internet access (SIA)
- Secure Private Access (SPA)
- SWG
- ZTNA
- L3/4 firewall
- CASB
- RBI (for risk traffic or high level phishing targets)
Advantage
- Everything in essentials
- Layer 7 firewall
- IPS
- DLP
- RBI
Licensing subscriptions
based on per user
1 year
3 year
5 year
Non standard terms on per contract basis
Cisco user protection suite
Incorporates related technologies all into one solution
- Posture and auth management
- Endpoint security
- Email security
- Experience insights
- Remote browser isolation
- Security Service Edge
Client based ZTNA
- Auth and posure per session
- QUIC tunnel (MASQUE proxy)
- Carry private traffic all ports and protocols
- SAM auth and auti re-new
- Application
- Socket intercept/filter happens her (Zero trust access module)
- Packet intercept/filter
- routing table
- packet intercept/filter
- virtual itnerface
- physical interface
IP packet vs socket streaming
VPN and legacy ZTNA packet approach
- CGNAT is obfuscation not security
- Firewalls and NAT's
- Attackers can piggyback on UDP flows to continue them in IP packet systems
Streaming approach (modern ZTNA uses socket streams)
- Socket streaming allows any protocol to be tracked by socket call and terminated at the instance the socket is closed
- Socket streaming eliminates timers and is deterministic
- Flows can't be continued or hijacked
Streaming approach intercepts the traffic before it becomes a packet. The traffic only needs to pass through the kernel once.
App > Socket intercept > MASQ ZTNA > Kernel > Packets on the wire
ZTNA module
A module part of CSC client (previously AnyConnect)
Enrolment
Press "Enroll" button
CSA issues an authentication cert for the client
Cert is saved in the TPM
This cert is automatically renewed
Client connections are now streamed
Stream1: data + posture
Stream2: data + posture
Stream3: data + posture
By default everything is dropped (ZTNA). We need to allow traffic in the rules.
Posture levels vary
VPNaaS
- OS
- Antimalware
- Firewall
- Disk encryption
- Cert check
- Browser check
- File check
- Registry check (windows only)
- Process check
Client based
- OS
- Antimalware
- Firewall
- Disk encryption
- System password
ZTA Browsers
- OS
- Browser check
We can set a re-auth timer if needed
Enrolment more details:
- On the surface for the user they press an enrol button
- On the backend a lot is going on
DPoP (Demonstrating Proof of Possession) is a security mechanism defined in RFC 9449 that proves a client cryptographically possesses the private key associated with a token or credential — without ever exposing that key.
The Core Problem DPoP Solves
In traditional OAuth/token flows, a bearer token can be stolen and reused by anyone. DPoP binds a token to a specific key pair, so even if the token is intercepted, it's useless without the corresponding private key (which is stored in the TPM chip on the clients machine).
How DPOP works
- Device enrolment is initiated
- Key pair is generated. Private key locked in TPM and never leaves the chip. Public key extracted.
- CSR created with public key, signed by private key (to prover ownership)
- CSR is sent to CSA. The CSR contains the public key and signature
- The signature proves we have the private key but we never send the private key. It never leaves the TPM chip.
- CSA takes the CSR and issues a signed cert (bound to the public key)
- When accessing CSA, a DPOP proof (JWT) is created
- Signed by: the TPM held private key
- Contains: HTTP method, URL, timestamp, nonce
- Proves the caller holds the private key right now
How DPOP and ZTNE enrolment works on the backend
- ZTA starts the DPOP process. Generates the public/private keys and the CSR
- Private key is stored in the TPM and is never trasmitted
- CSR / Public key sent to CSA for enrolment
- user > enroll.ztna.sse.com > enrolment broker
- enrolment broker asks for email
- user > me@address.com > enrolment broker
- enrolment broker sends SSO redirect
- user > SAML flow > Auth (customer IDP / Duo / AD/entra etc)
- Device is registered
- ZTA cert issued
- From here the cert can be used for all connections and MITM attacks are not possible
- The cert automatically updates every 2 weeks
OS native ZTA for apple and adroid devices
Just like having the ZTNA module on the devices
Enroll the device
Login via SSO
Clientless zero trust access
Essentially this will be web browsers for 3rd parties
Allows access to web apps only
Can use IPsec tunnels or resource connectors
For unmanaged BYOD devices
For 3rd parties
Limited posture detection
It makes a reverse proxy
VPN as a service (VPNaaS)
Auth and posture at connect time
DTLS tunnel
Caryy internet and private traffic (all ports and protocols)
SAML 2.0 auth
ISE integration
CSA Supports SAML and RADIUS auth methods. SAML is new but RADIUS is widely used including in ISE
- client > auth request > VPNaaS > ISE
- Client redirected to ISE
- SSL connection to port 8443, user download network setup assistant
- Network setup assisant discovers ISE, anyconnect agent download/install
- CSC ISE posture discovers ISE
- SSL excvhange on port 8443 > compliance check
- Connection is protected by portal cert
- CoA (change of auth) request, CoA ack
- In VPN use case CoA packet contains the attributes which compliant profile has
ISE SGT support
SGT is a security group tag
CSA can carry SGT's through its networks tunnels
Some sample SGT's
SGT 10 is marketing
SGT 20 IOT
SGT 30 BYOD
SGT 40 Workstations
- This allows for SGT policy across the HQ LAN network and cloud
- maintain micro segmentation
- Identigy devices and traffic based on context from ISE
- Apply policies to SGT based identity
Radius setup example
Connect > End user connectivity
VPN profile
Add VPN IP pool
endpoint pool 172.16.0.24
mgmt pool 172.17.0.0/21
dns servers: internal DNS
Radius groups not added yet
You can add your radius server group
Tick AAA options
Assign the radius servers (ISE1 and ISE2)
You can have different server for each region or one radius group for all.
Network tunnels
CSA <> your site
hub1 < > VTI1 > Your FW
hub2 < > VTI2 > Your FW
Makes ECMP group, routes are advertised with BGP
IPsec routing
Static or dynamic routing
Use static for small network or your devices doesn't support BGP
In most other cases you will want to use BGP
Branch connections
Allow branch connections to let them reach private resources
S2S tunnels from HQ FW
Catalyst SD-WAN
Why enable NAT
- NAT allows devices to use a single public IP to connect to the internet CSA
- NAT can be used to hide the real LAN IP of users connecting to CSA.
- This can also help if the same networks are used in two of your locations eg 192.168.1.0 used in two places.
Branch/DC to VPNaaS User
Internal network (pri/sec tunnels) > ECMP > Cloud headend > CSA > tunnel establish > VPN pool IP
Catalyst SD-WAN
VPN1 > SD-WAN > VPN tunnels > CSA
VPNID based policy
DIA
Direct Internet Access
Going straight out the local branch internet connection
Resource connectors
CSA > Connector group > AWS/Azure/VMware
2x Connectors in HA is recommended
RC gatewa
RC agent
RC group
ZTA > QUIC > ZTA proxy > CSA > Resource gateway > Resource connector > App
Resource connectors can help with overlapping IP's too
RC connectors use TCP 443 and UDP 443
RC status
- Connected - data tunnel is up
- Disconnected - data tunnel is down
- Disabled - admin disabled the connecotr
- Updating - software update in progress
- Expired - Cert has expired
- Ready to use - newly provisional and reach able
- Deleted - deleted by admin
- Revoked - revoked by admihn
- Setup failed - Tunnel failed to come up
There are several FQDN's you need to whitelist:
TCP 80/443
UDP 443
Gateway: Cisco IP space
Controllers:
Us.controller.acgw.sse.cisco.com
Eu.controller.acgw.sse.cisco.com
Ap.controller.acgw.sse.cisco.com
Will resolve to AWS Static IPs
Repo:
Us.repro.acgw.sse.cisco.com
Eu.repo.acgw.sse.cisco.com
Ap.repo.acgw.sse.cisco.com
ACME: Prod.acme.sse.cisco.com
API Gateway: Api.sse.cisco.com
PKI: Ssepki.cryptosvcs.cisco.com
Resouce connector redundance
Scaling calculator built in.
2 agents per connector group
All agenst have same connectivity
Multi region
CSA > RC gateway region 1 > Agent 1 + agent 2 > private resource
CSA > RC gateway region 2 > Agent 1 + agent 2 > private resource
They can deployed quickly in common virtualisation platforms.
Setting up a connector
Connect > network connection > resource connector groups
Name it
Select region
Select your connector type for example AWS
Download the image for AWS
View purchase options subscribe to this software
Launch via EC2
Give the EC2 instance a name
Create a new key pair (for connecitn to CSA)
ALlow public IP to be auto assigned
ALlow public IP to be auto assigned
Conform connection
Copy provision key from CSA to AWS
KEY=xxxxxxx
It should show as connected after a few minutes
Define a private resource
Select out RC connector we just created
