Intro to Cisco Secure Access (CSA)
At a high level it works like this:
- Users > CSA > Resources
- The idea is to secure access from anywhere to anywhere
Ways to connect to CSA
- Remote managed > ZTNA > CSA
- Remote managed > VPNaaS > CSA
- Remote unmanaged > Clientless ZTNA > CSA
- Branch > IPsec tunnel > CSA
- IOT devices > IPsec tunnel > CSA
- We can also integrate SD-WAN connections into CSA (more on it later)
What we can do inside CSA
- Groups
- firewall rules
- web gateway
- DLP
- CASB (cloud security broker)
- Device posture
- ZTNA
- Monitor and TS
Outbound from CSA
- Connections to Internet and SaaS sites
- Backhaul to private apps hosted in your public or private cloud
- IPsec tunnels to other datacenter/pop/brance
PoP is point of presence. Often user will connect to the closest one for lowest latency
CSA connection can enter the POP in dublin and etc the POP in France for examle
What problem is cisco secure access trying to solve ?
- Orgs with remote users and 3rd party contractors who need access but also all secure
- Orgs with users who are mobile (in office / at home / on the road)
- Orgs with hybrid setups (on prem / public cloud / private cloud / SaaS)
- Consolidate all the access policies in one place
- Keep a zero trust mindset
Secure private access (tunnel or proxy)
- Via VPN
- Via ZTNA client
- Via ZTNA clientless
Secure Internet Access (s
- VPN full tunnel
- Internet security module
- Branch DIA
We can have SPA and SIA working together
Insights and monitoring
Admins and monitor endpoint performance with thousand eyes
Need an account and agent deployed
Global scale architecture
User > CSA POP > CSA routing > CSA POP > Resource
Unified cloud architecture
- Control everything in one cloud dashboard
- Traffic acquisition
- Collect and augment with extra data (posture etc)
- Classify traffic (public / private)
- Rules (FWaaS / SWG / CASB / Decryption / IPS / DLP)
- Send via backhaul or internet
Open APIs
- As well as the cloud dashboard
- Multiple Restful API
- Automate tasks
- Deployment
- Admin
- Policies
- Reports
Talos threat intelligence
Visibility across the entire threat landscape fusing experts data and gen AI
Talos detect threats and block them for all customers
User connectivity
- VPNaaS
- ZTNA module
- Web roaming module (80/443 only)
- Clientless ZTNA
VPN (DTLS/IPsec) > ZTNA (Wireguard/gRPC) > ZTA (MASQUE/QUIC)
TLS - TCP security
DTLS - UDP (some speed improvement)
QUIC is UDP based (fastest0), a way to speed up TLS connections
MASQUE - Multiplex Application Substrate over QUIC encryption / a streaming protocol. This is an application proxy that runs on top of QUIC. It can have multiple streams active in one MASQ session.
Client connectivity
Secure client
VPN > ASA> IPsec / Internet
ZTNA client > ZTNA proxy > IPsec / Resource connector
Sec/Roaming module > DNS/SWG > Internet
Clientless > Rev Proxy > IPsec / Resource connector
Branch > IPSec > IPsec / Internet
Cisco Secure Client
You will need to deploy the CSC client with the ZTNA module
Duo desktop will also be deployed if you use posture
Other modules
Secure endpoint (formerly AMP)
Roaming module (Umbrella but this will be replaced)
Thousand Eyes (no UI)
Cloud management module (no UI)
DART
Secure Private Access (client based ZTNA)
ZTNA supports apps via IPsec backhaul
FTD > HA VTI tunnels > CSA
We create two tunnels to CSA for redundancy
We configure BGP between the two so they can exchange routes
Secure Private Access (clientless)
Only works with web apps
Secure Private Access (VPN)
Connect to secure access cloud
Secure Internet Accesss via VPNaaS
Connect to CSA then on to internet sites / SaaS
Modular policy with magnetic UI
Define apps / resources
define private / public rules
Live demo
https://www.cisco.com/c/en/us/products/security/secure-access/live-demo.html
Cisco have a live demo which you can try it out
First step will be to setup a tunnel group (VPN)
Setup on your peer on the HQ or brance
Connector groups are for the resource connectors
We can add one to AWS Azure and VMware
We can add SAML/SSO for our user ID
Private resources
We can had a file server here
You can make firewall rules under secure
Zero trust
- Micro segmentation
- Network isolation
- Native OS support
- TPM to protect certs and key
Principals
- Never trust
- Always verify
- Enforce least privilege
Success factors
- Allow the user to work securely with minimal disruption
- Adjust policy to risk
- Consistency across environments because of shared policy
AI assistant
Helps you create rules but leaves them disabled, a human must enable the rule.
Planning for a CSA project delivery
- Well defined scope and timelines
- Access to sites / network devices etc
- Clear roles and responsibilities
- Single customer point of contact / PM
- Customer involvment and comms
- Clearly defined and agreed use cases
- Pilot and customer validation
- Knowledge transfer
- High level docs
- SOW - statement of work
- BOM - Bill of materials
- Checklist
Secure Access licensing
Essentials
- Secure internet access (SIA)
- Secure Private Access (SPA)
- SWG
- ZTNA
- L3/4 firewall
- CASB
- RBI (for risk traffic or high level phishing targets)
Advantage
- Everything in essentials
- Layer 7 firewall
- IPS
- DLP
- RBI
Licensing subscriptions
based on per user
1 year
3 year
5 year
Non standard terms on per contract basis
Cisco user protection suite
Incorporates related technologies all into one solution
- Posture and auth management
- Endpoint security
- Email security
- Experience insights
- Remote browser isolation
- Security Service Edge
Client based ZTNA
- Auth and posure per session
- QUIC tunnel (MASQUE proxy)
- Carry private traffic all ports and protocols
- SAM auth and auti re-new
- Application
- Socket intercept/filter happens her (Zero trust access module)
- Packet intercept/filter
- routing table
- packet intercept/filter
- virtual itnerface
- physical interface
IP packet vs socket streaming
VPN and legacy ZTNA packet approach
- CGNAT is obfuscation not security
- Firewalls and NAT's
- Attackers can piggyback on UDP flows to continue them in IP packet systems
Streaming approach (modern ZTNA uses socket streams)
- Socket streaming allows any protocol to be tracked by socket call and terminated at the instance the socket is closed
- Socket streaming eliminates timers and is deterministic
- Flows can't be continued or hijacked
Streaming approach intercepts the traffic before it becomes a packet. The traffic only needs to pass through the kernel once.
App > Socket intercept > MASQ ZTNA > Kernel > Packets on the wire
ZTNA module
A module part of CSC client (previously AnyConnect)
Enrolment
Press "Enroll" button
CSA issues an authentication cert for the client
Cert is saved in the TPM
This cert is automatically renewed
Client connections are now streamed
Stream1: data + posture
Stream2: data + posture
Stream3: data + posture
By default everything is dropped (ZTNA). We need to allow traffic in the rules.
Posture levels vary
VPNaaS
- OS
- Antimalware
- Firewall
- Disk encryption
- Cert check
- Browser check
- File check
- Registry check (windows only)
- Process check
Client based
- OS
- Antimalware
- Firewall
- Disk encryption
- System password
ZTA Browsers
- OS
- Browser check
We can set a re-auth timer if needed
Enrolment more details:
- On the surface for the user they press an enrol button
- On the backend a lot is going on
What is a TPM chip
Trusted Platform Module is a dedicated security chip built into a computer's motherboard that provides hardware-based security functions:
- Stores cryptographic keys — It securely holds encryption keys, passwords, and certificates in hardware, separate from the main CPU and RAM, making them much harder to steal.
- Verifies system integrity — At boot time, it checks that the firmware and OS haven't been tampered with (this is part of "Secure Boot").
- Enables full-disk encryption — Windows BitLocker, for example, uses the TPM to store the encryption key for your drive, so the drive can't be unlocked on a different machine.
- Supports authentication — Used for multi-factor authentication, smart card functions, and secure login.
DPoP (Demonstrating Proof of Possession) is a security mechanism defined in RFC 9449 that proves a client cryptographically possesses the private key associated with a token or credential — without ever exposing that key.
The Core Problem DPoP Solves
In traditional OAuth/token flows, a bearer token can be stolen and reused by anyone. DPoP binds a token to a specific key pair, so even if the token is intercepted, it's useless without the corresponding private key (which is stored in the TPM chip on the clients machine).
How DPOP works
- Device enrolment is initiated
- Key pair is generated. Private key locked in TPM and never leaves the chip. Public key extracted.
- CSR created with public key, signed by private key (to prover ownership)
- CSR is sent to CSA. The CSR contains the public key and signature
- The signature proves we have the private key but we never send the private key. It never leaves the TPM chip.
- CSA takes the CSR and issues a signed cert (bound to the public key)
- When accessing CSA, a DPOP proof (JWT) is created
- Signed by: the TPM held private key
- Contains: HTTP method, URL, timestamp, nonce
- Proves the caller holds the private key right now
How DPOP and ZTNE enrolment works on the backend
- ZTA starts the DPOP process. Generates the public/private keys and the CSR
- Private key is stored in the TPM and is never trasmitted
- CSR / Public key sent to CSA for enrolment
- user > enroll.ztna.sse.com > enrolment broker
- enrolment broker asks for email
- user > me@address.com > enrolment broker
- enrolment broker sends SSO redirect
- user > SAML flow > Auth (customer IDP / Duo / AD/entra etc)
- Device is registered
- ZTA cert issued
- From here the cert can be used for all connections and MITM attacks are not possible
- The cert automatically updates every 2 weeks
OS native ZTA for apple and adroid devices
Just like having the ZTNA module on the devices
Enroll the device
Login via SSO
Clientless zero trust access
Essentially this will be web browsers for 3rd parties
Allows access to web apps only
Can use IPsec tunnels or resource connectors
For unmanaged BYOD devices
For 3rd parties
Limited posture detection
It makes a reverse proxy
VPN as a service (VPNaaS)
Auth and posture at connect time
DTLS tunnel
Caryy internet and private traffic (all ports and protocols)
SAML 2.0 auth
ISE integration
CSA Supports SAML and RADIUS auth methods. SAML is new but RADIUS is widely used including in ISE
- client > auth request > VPNaaS > ISE
- Client redirected to ISE
- SSL connection to port 8443, user download network setup assistant
- Network setup assisant discovers ISE, anyconnect agent download/install
- CSC ISE posture discovers ISE
- SSL excvhange on port 8443 > compliance check
- Connection is protected by portal cert
- CoA (change of auth) request, CoA ack
- In VPN use case CoA packet contains the attributes which compliant profile has
ISE SGT support
SGT is a security group tag
CSA can carry SGT's through its networks tunnels
Some sample SGT's
SGT 10 is marketing
SGT 20 IOT
SGT 30 BYOD
SGT 40 Workstations
- This allows for SGT policy across the HQ LAN network and cloud
- maintain micro segmentation
- Identigy devices and traffic based on context from ISE
- Apply policies to SGT based identity
Radius setup example
Connect > End user connectivity
VPN profile
Add VPN IP pool
endpoint pool 172.16.0.24
mgmt pool 172.17.0.0/21
dns servers: internal DNS
Radius groups not added yet
You can add your radius server group
Tick AAA options
Assign the radius servers (ISE1 and ISE2)
You can have different server for each region or one radius group for all.
Network tunnels
CSA <> your site
hub1 < > VTI1 > Your FW
hub2 < > VTI2 > Your FW
Makes ECMP group, routes are advertised with BGP
IPsec routing
Static or dynamic routing
Use static for small network or your devices doesn't support BGP
In most other cases you will want to use BGP
Branch connections
Allow branch connections to let them reach private resources
S2S tunnels from HQ FW
Catalyst SD-WAN
Why enable NAT
- NAT allows devices to use a single public IP to connect to the internet CSA
- NAT can be used to hide the real LAN IP of users connecting to CSA.
- This can also help if the same networks are used in two of your locations eg 192.168.1.0 used in two places.
Branch/DC to VPNaaS User
Internal network (pri/sec tunnels) > ECMP > Cloud headend > CSA > tunnel establish > VPN pool IP
Catalyst SD-WAN
VPN1 > SD-WAN > VPN tunnels > CSA
VPNID based policy
DIA
Direct Internet Access
Going straight out the local branch internet connection
Resource connectors
CSA > Connector group > AWS/Azure/VMware
2x Connectors in HA is recommended
RC gatewa
RC agent
RC group
ZTA > QUIC > ZTA proxy > CSA > Resource gateway > Resource connector > App
Resource connectors can help with overlapping IP's too
RC connectors use TCP 443 and UDP 443
RC status
- Connected - data tunnel is up
- Disconnected - data tunnel is down
- Disabled - admin disabled the connecotr
- Updating - software update in progress
- Expired - Cert has expired
- Ready to use - newly provisional and reach able
- Deleted - deleted by admin
- Revoked - revoked by admihn
- Setup failed - Tunnel failed to come up
There are several FQDN's you need to whitelist:
TCP 80/443
UDP 443
Gateway: Cisco IP space
Controllers:
Us.controller.acgw.sse.cisco.com
Eu.controller.acgw.sse.cisco.com
Ap.controller.acgw.sse.cisco.com
Will resolve to AWS Static IPs
Repo:
Us.repro.acgw.sse.cisco.com
Eu.repo.acgw.sse.cisco.com
Ap.repo.acgw.sse.cisco.com
ACME: Prod.acme.sse.cisco.com
API Gateway: Api.sse.cisco.com
PKI: Ssepki.cryptosvcs.cisco.com
Resouce connector redundance
Scaling calculator built in.
2 agents per connector group
All agenst have same connectivity
Multi region
CSA > RC gateway region 1 > Agent 1 + agent 2 > private resource
CSA > RC gateway region 2 > Agent 1 + agent 2 > private resource
They can deployed quickly in common virtualisation platforms.
Setting up a connector
Connect > network connection > resource connector groups
Name it
Select region
Select your connector type for example AWS
Download the image for AWS
View purchase options subscribe to this software
Launch via EC2
Give the EC2 instance a name
Create a new key pair (for connecitn to CSA)
ALlow public IP to be auto assigned
ALlow public IP to be auto assigned
Conform connection
Copy provision key from CSA to AWS
KEY=xxxxxxx
It should show as connected after a few minutes
Define a private resource
Select out RC connector we just created
Secure Internet Access
Internet app/ SaaS apps
+
Private apps
=
Security Service Edge (SSE), secure access from anywhere to anywhere
Features of cisco'sSSE
- ZTNA
- SWG
- DNS security
- FWaaS
- CASB
- RBI
- DLP
- VPNaaS
Policy enforcement
If you have all modules enabled the traffic will be processed in this order
- DNS polices
- Firewall (IPS/IDS)
- SWG (Web/Casb) 80/443 traffic
- DLP
Access rules
In CSA there are two main kinds of rules
- Private access rules (for accessing your own resources)
- Internet access rules (for access internet and cloud resources)
Anatomy of a rules
- Name (description of the rule)
- Type (Internet, private)
- Action (allow, block, warn(lets user go ahead), isolate (RBI))
- Identities (Users, groups, computers, networks, tunnels etc)
- Protection profiles (see below)
Protection profiles
- Web profile (AAA, decryption, threat protection, file and security controls)
- Tennant Control Profile (m365, G-suite, slack, drobox)
- IPS profile (Signatures lists, defaults, actions)
- Endpoint posture (VPN, ZTNA, browser based)
DNS security
- Block malware / phishing / CnC callback URLs
- Only proxy risky domains to improve performance
- Stop threats at the DNS lookup stage, before a connection is made
- Doesn't work for IP based threats
When traffic is proxied it gets further inspection
3 ways to configure DNS security in CSA (you probably need all)
- Point DNS at CSA and register public IP (all DNS requests from this public IP are protected
- Roaming security, use the module in the CSC client ,
- Virtual appliance forwarder - log DNS requests from internal IP's for more identity
CDFW flow
Network > IPsec tunnel > CSA > CDFW > SWG (80/443) > Internet/SaaS
IPS tuning
Start in detection mode
Review results, create exceptions for known good traffic
Enable protection mode, this will start blocking now
SWG and CASB
Secure web gateway full web proxy
SWG allows filtering of all web traffic and detailed information
Enabling SSL decryption allows advanced features
Decryption strategies
Most traffic is encrypted today so decryption is essential
Decryption is resource intensive
Traffic > IPS > SWG >
Advanced features
- Decryption
- SAML
- Content controls
- Tennant controls
- Granular app controls
- File type controls
- File scanning
- Data loss prevention
- Remote browser Isolation
Advanced application controls
For example we can visit Facebook but we can't download/upload files
Revered Egress IP
SaaS apps require allow list (public IP)
We can have a static IP in CSA so our internet traffic comes from the same IP
This public IP can beallow listed by your SaaS app vendors
Cloud Access Security Broker (CASB)
- Control SaaS app usage
- Alert on risky apps
- Secure outbound web traffic with inline and oob DLR
- detect and remove malware from cloud storage apps
- This will become more important as more SaaS / cloud applications are used
CASB Inline proxy
High impact deploymetn
agent or traffic redirection
No API to app
limited retro
real time enforcement inline
CASB Out of band/API
Low impact deployment
agentless, no user expierence impact
relies on api of cloud apps
retrospective (we can look back in time)
near real time enforcement
universal coverage
sanctioned app coverage
App discovery and controls
- Detects cloud apps in use
- Organised by category and risk level
- You can see number of users inbound/outbound traffic
- You can block high risk categories
Application risk override
Modify an apps risk score
Community risk score is the median of all other CSA customers to give you an idea of an app
Tenant controls
Only allow access to the corporate m365. Don't let users into their own personal tenants. This is to help with data exfiltration.
Remote browser isolation
Web browser > SWG > File inspection > Isolated browser (AWS) > Risky Website
The site never loads on the users device
Only works with web apps
DLP can be run on an isolated session too
Multi-faced threat intel
- DNS
- IP
- BGP
- SSL
- WHOIS
- HASH
- WEB
- ETC
CSA uses all the data it gathers from across the world to categorise and find malware domains and IP's.
Secure malware analytics
Sandbox inspection is done on high risk files
libmagic makes sure a .pdf is actually a .pdf file
DLP data loss prevention
You can block certain data leaving your network
For example credit card numbers can be blocked
Real time DLR
SWG
scans web traffic in line
SaasS API DLR
Cloud API's for data at rest without SWG proxy
scans out of band web traffic
On management interface for both
DLP categories
DLP has categories which can be selected.
Can monitor chatgpt the outbound traffic can be blocked
Can also block inbound generation like source code.
Digital experience monitoring (DEM) / Experience Insights
Today we have users spread across multiple locations
The users are moving between home / office / hotels etc
DEM helps track down issues
- availability
- performance
- quality
Types of questions we can get the answer to in one place with CSA
Is it home network / WIFI
Is it the endpoint ? Is the laptop managed or BYOD
Is the issue office LAN / WIFI
ISP problem ?
Security rule blocking and where DNS / fw / endpoint ?
Client / server application problem ?
VPN gw issue ?
Record metrics on how connections are working. Then use that data to help the customer TS issues and solve problems
CSA Experience Insights
Give visibility into 3rd party parts of the network like home WIFI / ISP BGP / Cloud services
Uses thousand eyes
part of base package
- Local device
- Collaboration applications (webex / teams)
- Internet and network path (map out network path, latency, jitter, loss etc)
- SaaS performance
Integration with thousand eyes
Thousand eyes endpoint (embedded endpoint agent EPA) is included in the CSC
Need to create a token and exchange
Global visibility within the CSA dashboard
Use cases
Remote worker - CSA, we can see the WIFI signal strength is bad
ISP - We can trace the network path, we can see the local WIFI is the problem as other end is reporting fine
Application - For example we can connection is all good, 4 apps working fine, 1 app is an issue this points to an issue on that SaaS app
CSA - We can look inside CSA as well. Is CSA slow or is it blocking ? We can look at endpoint posture. Check the posture status as this may be stopping the user from getting access
Proactive monitoring endpoint
Thousand eyes agent can run synthetic tests
They can be scheduled 1 / 5 / 15 minutes
We should be able to see when connections become unhealthy
Device > GW > Internet > Application
Experience scanner for end users
User can see their own score
For example it might report and issue with the local internet connection
They can reboot their WIFI themselves
If they see the issue is with a SaaS app then they know its out of their hands
AI / experience insights
Cisco AI will bubble up high level alerts to the CSA admin
AI can investigate and generate suggestions
It can pick up the SaaS applications with the worst performance
RA VPN to VPNaaS migration path
- Get the current state of existing RA VPAN so we can design CSA
- Solution requirements and design
- Implementation and testing
- Migration plan and execution
- Knowledge transfer
RA VPN to VPNaaS
Moving your VPN to the cloud
Old RA VPN headend was on firewall or multiple firewalls
CSA VPN headend is one point in the cloud and get your access to everywhere
- Configuration porting > Intent mapping > Data plan transition
- Source assessment > Intent analysis > Move to secure access
- Often migrations are done like for like but a migration to CSA can bring in new features easily
Migration phases
- Scope
- Provision
- Stage
- Go live
Milestones
- Configuration porting ( migrating the config )
- Intent mapping ( review of rules)
- Data plan transition ( moving live traffic from old RA VPN to CSA )
Let's take an example
- The customer currently has a legacy RA VPN.
- They have local VPN users
- They don't use any MFA on this
- They don't have any posture checks
- Once connected VPN users have access to the full network
You can see migrating like for like in this case would not be good and would not increase security.
In CSA
We can enable identity source from entra / AD to get user identity
We can enable MFA with Duo
We can enable posture checks
We can enable ZTNA so users only get access to what they need
Migration path
Traditional VPN > VPNaaS > Unified ZTNA
Umbrella to CSA
Why upgrade from umbrella to CSA
Safer - Zero trust access, ID intel, adaptive access, always monitoring and blocking
Better - 4x faster SIA, frictionless access to all Apps, monitor and maintain DEM/experience insights
Taking umbrella to the next level
- ZTNA
- AI for security
- Easier connectivity
Umbrella upgrade path
Umbrella DNS > SIG > Secure Access
DNS - DNS only (still very good security)
SIG - SWG and advanced features, for outbound user internet traffic only
CSA - connecting all resources via the cloud and providing all the security of above in one dashboard. Connect from anywhere to anywhere securely.
