Intro to Cisco Secure Access (CSA)
At a high level it works like this:
- Users > CSA > Resources
Ways to connect to CSA
- Remote managed > ZTNA > CSA
- Remote managed > VPNaaS > CSA
- Remote unmanaged > Clientless ZTNA > CSA
- Branch > IPsec tunnel > CSA
- IOT devices > IPsec tunnel > CSA
- We can also integrate SD-WAN connections into CSA (more on it later)
What we can do inside CSA
- Groups
- firewall rules
- web gateway
- DLP
- CASB (cloud security broker)
- Device posture
- ZTNA
- Monitor and TS
Outbound from CSA
- Connections to Internet and SaaS sites
- Backhaul to private apps hosted in your public or private cloud
- IPsec tunnels to other datacenter/pop/brance
PoP is point of presence. Often user will connect to the closest one for lowest latency
CSA connection can enter the POP in dublin and etc the POP in France for examle
What problem is cisco secure access trying to solve ?
- Orgs with remote users and 3rd party contractors who need access but also all secure
- Orgs with users who are mobile (in office / at home / on the road)
- Orgs with hybrid setups (on prem / public cloud / private cloud / SaaS)
- Consolidate all the access policies in one place
- Keep a zero trust mindset
Secure private access (tunnel or proxy)
- Via VPN
- Via ZTNA client
- Via ZTNA clientless
Secure Internet Access (s
- VPN full tunnel
- Internet security module
- Branch DIA
We can have SPA and SIA working together
Insights and monitoring
Admins and monitor endpoint performance with thousand eyes
Need an account and agent deployed
Global scale architecture
User > CSA POP > CSA routing > CSA POP > Resource
Unified cloud architecture
- Control everything in one cloud dashboard
- Traffic acquisition
- Collect and augment with extra data (posture etc)
- Classify traffic (public / private)
- Rules (FWaaS / SWG / CASB / Decryption / IPS / DLP)
- Send via backhaul or internet
Open APIs
- As well as the cloud dashboard
- Multiple Restful API
- Automate tasks
- Deployment
- Admin
- Policies
- Reports
Talos threat intelligence
Visibility across the entire threat landscape fusing experts data and gen AI
Talos detect threats and block them for all customers
User connectivity
- VPNaaS
- ZTNA module
- Web roaming module (80/443 only)
- Clientless ZTNA
VPN (DTLS/IPsec) > ZTNA (Wireguard/gRPC) > ZTA (MASQUE/QUIC)
TLS - TCP security
DTLS - UDP (some speed improvement)
QUIC is UDP based (fastest0), a way to speed up TLS connections
MASQUE - Multiplex Application Substrate over QUIC encryption / a streaming protocol. This is an application proxy that runs on top of QUIC. It can have multiple streams active in one MASQ session.
Client connectivity
Secure client
VPN > ASA> IPsec / Internet
ZTNA client > ZTNA proxy > IPsec / Resource connector
Sec/Roaming module > DNS/SWG > Internet
Clientless > Rev Proxy > IPsec / Resource connector
Branch > IPSec > IPsec / Internet
Cisco Secure Client
You will need to deploy the CSC client with the ZTNA module
Duo desktop will also be deployed if you use posture
Other modules
Secure endpoint (formerly AMP)
Roaming module (Umbrella but this will be replaced)
Thousand Eyes (no UI)
Cloud management module (no UI)
DART
Secure Private Access (client based ZTNA)
ZTNA supports apps via IPsec backhaul
FTD > HA VTI tunnels > CSA
We create two tunnels to CSA for redundancy
We configure BGP between the two so they can exchange routes
Secure Private Access (clientless)
Only works with web apps
Secure Private Access (VPN)
Connect to secure access cloud
Secure Internet Accesss via VPNaaS
Connect to CSA then on to internet sites / SaaS
Modular policy with magnetic UI
Define apps / resources
define private / public rules
Live demo
https://www.cisco.com/c/en/us/products/security/secure-access/live-demo.html
Cisco have a live demo which you can try it out
First step will be to setup a tunnel group (VPN)
Setup on your peer on the HQ or brance
Connector groups are for the resource connectors
We can add one to AWS Azure and VMware
We can add SAML/SSO for our user ID
Private resources
We can had a file server here
You can make firewall rules under secure
Zero trust
- Micro segmentation
- Network isolation
- Native OS support
- TPM to protect certs and key
Principals
- Never trust
- Always verify
- Enforce least privilege
Success factors
- Allow the user to work securely with minimal disruption
- Adjust policy to risk
- Consistency across environments because of shared policy
AI assistant
Helps you create rules but leaves them disabled, a human must enable the rule.
Planning for a CSA project delivery
- Well defined scope and timelines
- Access to sites / network devices etc
- Clear roles and responsibilities
- Single customer point of contact / PM
- Customer involvment and comms
- Clearly defined and agreed use cases
- Pilot and customer validation
- Knowledge transfer
- High level docs
- SOW - statement of work
- BOM - Bill of materials
- Checklist
Secure Access licensing
Essentials
- Secure internet access (SIA)
- Secure Private Access (SPA)
- SWG
- ZTNA
- L3/4 firewall
- CASB
- RBI (for risk traffic or high level phishing targets)
Advantage
- Everything in essentials
- Layer 7 firewall
- IPS
- DLP
- RBI
Licensing subscriptions
based on per user
1 year
3 year
5 year
Non standard terms on per contract basis
Cisco user protection suite
Incorporates related technologies all into one solution
- Posture and auth management
- Endpoint security
- Email security
- Experience insights
- Remote browser isolation
- Security Service Edge
