Blueprint for a seamless ZTA deployment with Cisco Secure Access

Hello everyone and welcome to our webinar. My name Israj and I'm a product manager here at Cisco focusing on helping our customers securely connect users to applications.00:09Anywhere, any time on any device. I want to start by thanking all of you for joining us today. If you're a current Cisco customer looking to maximize your investment.00:20Or you're evaluating secure access for your organization. I'm confident you'll walk away with actionable strategies for a successful zero trust deployment. Here's what we cover in this session. We'll start by giving you a broad overview of Cisco Secure Access as a unified platform.00:30Then we'll dive into various access and connectivity methods, including how we handle backhaul. We'll spend some time on the fundamental question of why zero trust and then take a deep dive into client based CTA, explaining how it works under the hood. We'll also discuss how we unify the client experience.00:50And highlight how flexible ZTA profiles can simplify and secure your rollout will then covers.01:10Streamlining enrollment, maximizing both security and performance and how Cisco's AI can make troubleshooting far easier. Finally, we leave time for your questions at the end. Cisco secure access is our unified cloud delivered platform that makes zero trust practical and achievable for organizations.01:19Like yours. Our goal is to make security safer for everyone. It's better for your users, they get a seamless and productive experience, and it's easier for your IT teams. They benefit from simplified management and reduced complexity. Today, users are everywhere. They work from remote locations on campus.01:39They use a variety of devices. This includes managed and unmanaged devices, and they need to connect to applications at anywhere. These can be internet applications, SaaS or AI apps. They also access traditional and modern private applications.01:59Cisco Secure Access protects all these users and applications. It ensures they securely connect to whatever they need, wherever they are. This slide highlights how secure access goes beyond core SSE capabilities. These include zero trust network access.02:17CASP, DLP, VPN as a service, DNS security, SWG, and many more. This unified approach simplifies your security operation, it provides a powerful and integrated platform and helps you manage and protect your business effectively. And this slide shows how secure access brings together many.02:33Security functions. These are all integrated into a single cohesive platform. This unified approach simplifies policy enforcement, it provides centralized visibility and it reduces operational overhead for your IT teams. It means consistent security across all vectors, every connection, user and device.02:53Is predicted by one intelligent security fabric.03:13And the cornerstone of this intelligent security fabric, particularly at the endpoint, is Cisco's unified client, the Cisco secure client. We have aggregated a powerful set of functions into the single client. It handles traditional security and access tasks alongside innovative ZTNA functions.03:17This goes far beyond just traditional remote access solutions. The Cisco secure client includes capabilities like VPN, ZTA, DNS protection, digital experience monitoring, and network visibility. Accomplishing all these tasks with one client is a significant advantage for both your.03:38Any administrators and your end users.03:57Crucially, for our existing any connect customers, all of this can be done without deploying a new agent. This means you can get started on your zero trust project with us as soon as today leveraging your existing investment. Now, let's explore the various ways your users and device can connect securely.04:00Be Using Cisco Secure Access.04:20For your remote users on managed endpoints, Cisco Secure Client is the primary way they connect. It's delivered as a single installer. However, it features highly customizable modules. This allows your IT teams to tailor deployments precisely to your organization's needs. It offers a flexible.04:25Approach. You can deploy the core VPN capabilities for traditional remote access needs or you can leverage its dedicated ZTA module for granular zero trust network access. Beyond just access, secure client also integrates advanced functions. This includes thousand eyes for deep.04:44Ability into network and application performance.05:04And it provides continuous portrait checks to ensure device health and compliance. This modularity and consolidation are a significant advantage. It means one client handles multiple security and operational requirements for your managed devices. It simplifies deployment and management for your IT teams.05:07And it delivers a consistent, secure experience for your end users.05:27Let's take a brief look under the hood at how secure client achieves its granular control and seamless operation especially with respect to zero trust. This is particularly relevant for your IT teams who manage these deployments. Our zero Trust client architecture leverages a modern module socket intercept.05:32Technique to see your traffic. You can see it illustrated here position between the application and the physical interface. This approach is different from traditional methods that rely on manipulating the routing table or using packet intercept filters. The socket filter offers significant advantages.05:51It provides granular control over DNS and application traffic before it even hits VPN or ZTNA module. This means we can apply policies and make decisions very early in the application connection process. Crucially, it requires NO route table manipulation. This is a big benefit.06:11Route table changes can often conflict with other network configurations or existing VPN solutions.06:31It allows a precise capture of traffic on based on FQDN, wildcard fqdns, IPs or cidrs. This gives your IT teams fine grained control over what traffic is secured and how. And importantly, it's designed to interoperate seamlessly with existing Cisco and even non Cisco.06:38VPN solutions. This makes integrations into diverse environments much smoother protecting your current investments.06:58This intelligence socket level interception ensures traffic is tiered and secured precisely according to policy. It avoids broader less control access than traditional packet level interception might provide and gives you more robust security.07:06Sometimes your users won't be on managed devices. This is common for contractors, partners or employees employees using their own personal devices. For these scenarios, our clientless ZTA offering is ideal as it requires NO client software installation on the end user devices.07:25As shown on the slide, users simply navigate to the URL configured in secure access for browser based access for a specific application. They then go to the authentication process and once authenticated and they pass.07:44The policy evaluation, they get access to the resource. This solution is perfect for accessing web based applications SSH and RDP over the browser. It under the hood, it operates as a reverse proxy architecture. This means your private applications are never directly exposed.08:00To the internet. The connection is also anonymized using.08:20Ephemeral cg net IP adding an extra layer of privacy and security. For your IT teams, this means you can extend secure control access to a broader range of users without the overhead of client deployments. For end users, it offers convenience and flexibility.08:25Before we go deeper into ZTA, let's touch a little bit on the a couple of backhaul connectivity options that we provide in secure access.08:44The one robust method is through IPsec and SD WAN tunnels. This is the more traditional yet highly effective approach. This method focuses on both performance and resilience. We offer IPsec support for any hardware. This ensures broad compatibility with your existing infrastructure.08:56By high availability we provide intra DC failover. This uses mechanisms like detection and BGP keep alive. For scalability, we support ECMP which allows you to use multiple tunnels for increased bandwidth. You can have up to eight tunnels per group with each tunnel providing one gigabits.09:16Per second of supplement.09:36Regarding routing, your IT teams have flexibility. You can configure static rules. However, these require manual setup for VPN pool and routes. Alternatively, you can use BGP peering, which offers dynamic routing with one neighbor per tunnel.09:38This IPsec based approach ensures your private application traffic is routed efficiently and securely from secure access to your data center. It's a proven method for reliable backhaul. Resource connectors is another great option for backhauling traffic.09:58Our resource connectors offer a modern agile approach that is lightweight and leverages cloud managed agents that you deploy within your data centers or private cloud. Resource connectors are designed to operate in groups and provide high performance.10:14They provide cloud side load balancing, deploying at least two connectors per group ensures optimal performance and redundancy. And they offer horizontal scaling within a group, with each connector able to handle 500 mb/s of traffic. From a routing perspective, resource connectors are highly failure.10:35They are network agnostic and can support overlapping IPs, which can be a common challenge in complex enterprise environments. They established secure outbound DTLS or TLS auto tunnels to the secure access cloud, which eliminates the need for inbound firewall.10:55Updates simplifying your network configuration. This resource connector based method provides a high highly scalable resilient, and operationally simple way to connect your users to private applications. It is especially powerful for modern distributed environments. Now that we've seen.11:14All the building blocks, the client, the cloud, and the backhaul connection output options. Let's review what ZTA is and the key capability it provides.11:34This slide shows the architecture for accessing private applications through ZTA. From the employee's perspective or the end user's perspective, the access experience is transparent. They just access the app like they were in, in an office environment, NO matter where they are. Behind the scenes, the client uses modern protocols like.11:44Mask over quick to build a secure session based packet stream to our secure access pods. It supports all TCP and UDP traffic on all ports.12:04Service managed user identity certificates which are stored in the device's PPM for high security provides strong attestation to a user's identity and reduces end user friction by reducing the need for additional user interactive authentication. The connection.12:17To the user's app can be completed through the inside out tunnel from resource connector we just discussed. This means NO inbound firewall rules required and NO routing complexity. As a result, your private applications are never directly exposed.12:36And you can, it's easy to scale with high availability built in. This architecture represents a fundamental shift from traditional VPN access. With you VPN, users get network level access. They can potentially access resources on the network.12:56Whereas with ZTNA users get application level access and only access for the specific resources they are authorized for. This dramatically reduces the attack surface.13:16We just saw how ZTA provides a secure modern way to access your private applications. But a common question we get from customers starting this migration is how do I even know which applications to define in the policy? Manually catalogging every internal app host and port can be a massive project.13:28To solve this, we're excited to introduce private resource discovery, which is available today for you to try in private preview.13:48This feature is designed to make your transition to ZTA much simpler. It requires NO configuration from you. It automatically analyzes your network traffic from both your ZTA users and your VPN users to discover what private resources are being accessed across your organization. The result is.13:55Is what you see here. A simple data driven suggestions table. Instead of guessing, you get a full report showing the host addresses port and protocol for each discovered resource. More importantly, you see how many unique users are accessing it and the total number of heads so you can prioritize migration. Your workflow from here is straightforward.14:15Good, you can review each suggestion and with a single click, add it as a private resource. If you aren't sure, you can use labels to flag it for review.14:34You can even perform these actions in bulk to save time. This discovery tool is designed to take the guesswork out of CTA deployment and accelerate adoption by building your resource list for you. Now that we covered securing private applications and how to automatically discover them, let's look.14:43At how the very same ZTM module secures all your internet and SAS traffic. With our latest update, Cisco Secure Access now extends zero trust access to all internet destinations, not just for your private apps, but for every website, cloud service or SaaS platform, your users visit. This is.15:02Same secure access client that private powers private application access now access a unified enforcement point for all outbound internet traffic, whether it's TCP or UDP.15:22From the user's perspective, it is seamless. They use the internet as usual, but behind the scenes, every connection is protected by secure internet access enforcement. This means well filtering through secure web gateway, threat protection via firewall as a service, data loss prevention, and reserved IP protection.15:35All automatically applied and managed through the same single policy engine.15:54What's especially powerful here is the consistency and simplicity. You maintain a single reliable view of user identity across both private and internet access, making policy enforcement and logging straightforward. There's just one client to deploy and manage which streamlines endpoint operation for IT. For security teams.16:01This means comprehensive coverage. Every bit of internet traffic is protected, not just specific destinations and if there are any applications, domains or IPs that need to be bypassed.16:20ZTA for business reasons, you can add exceptions easily within the dashboard. This unified approach takes the complexity out of securing internet access while delivering robust consistent protection for all users wherever they work.16:31Now, let's review how a zero trust access session is set up through resource connectors end to end. Let's say a user wants to access an application on your internal network at app.example.com. The actual server IP is 1902.16:49Two.zero.2. 100.17:07Here's what happens step by step. Step one, user requests the app. The user goes to their browser or client and tries to access app.example.com. Secure client captures this request at the socket layer. It resolves the request to an ephemeral IP in the local.17:09This range. This is a temporary local IP address that only exists on that endpoint. The application thinks it's connecting to a local service.17:29Step two transport traffic is transported to ZT proxy in secure access. The secure client encrypts the traffic using DTLS or TLS. It sends the encrypted traffic to zero trust proxy in secure access cloud. The user's identity and device postures are included as headers and.17:40And this connection.17:59Step three, the TC connection is proxied and policy is enforced. The zero trust proxy receives a request. It evaluates the policy for this user, device, and application. The policy checks includes is this user authorized, is the device compliant?18:01And are there any other additional conditions? If policy allows access, the connection is proxy. The connection is built to the mapped resource connector. Step four, the gateway establishes connection to resource connector. The secure access gateway identifies which resource.18:19Those connectors serves this application. It establishes a connection through the existing DTLS TLS tunnel.18:39The resource connector is already connected to the cloud with a persistent tunnel. And then in step five, the resource connector resolves the application IP. Once the resource connector agent receives the request for app.example.com, it performs a DNS query on.18:46On the internal network using your internal DNS servers. And in step six, once the local DNS responds with the application IP.19:06In this case it returns 18202 to 100. The resource connector agent now knows where to send the traffic. The agent in step seven establishes connection to the application and it's a TCP connection to the same IP address.19:19On the internal network. So from the applications perspective, the connection is coming from the local resource connector agent and the application response and the data flows back and forth through the same path. The entire flows is encrypted end to end.19:36And the, the user's traffic is encrypted from client such secure access cloud and from cloud to resource connectors to the application. The application in fact, never even sees the user's actual IP address.19:54Now that you've seen the end to end flow, I want to comment a little bit about the various policy enforcement modes that we provide for ZTA in secure access. Secure Access offers three flexible policy enforcement modes. The most specific match, which is.20:11As the default enforcement mode is ideal for organizations that need tight zero trust controls. It allows you to define highly granular policies for individual applications and perfect for.20:29Making sure your most sensitive assets are always protected. On the other hand, the multi app and multi app with resolved IP match modes are designed to simplify management and support gradual migration from existing VPN infrastructure.20:43These modes allow you to select multiple applications map multiple resources for us during a policy single policy evaluation rule, and it's much more similar to how VPN.21:02Policy matching up.21:21Applies in traditional firewalls. As you plan to migrate and roll out your deployment, it is important to keep in mind which policy enforcement best matches your deployment needs. And if you need to move from one mode to the other, from the.21:24For most specific match to other modes, you can reach out to Cisco support and switch your CTA policy mode.21:43Next, let's talk a little bit about ZTA profiles which are a powerful feature for managing different user experiences. ZTA profiles gives you a flexible way to group users and resources so you can deliver tailored client based ZTA experiences across your organization.21:53With profiles, you can customize traffic steering, related configurations such as trusted network detection for different users and groups, all from the same dashboard. And for internet access, you can configure the specific.22:12Enforcement mode for different groups of users.22:33Within the profiles. ZTA profiles are managed as an ordered list. This is important because the order determines which settings each user in your organization receives. As shown in the example on the slide, you might have profiles set for test users, early access groups.22:37Employees and contractors. When a user's secure access client connects, it.22:57It, it receives it it applies configuration based on the profile that the end user belongs to. The user is always assigned the configuration from the 1st profile that they belong to. This means you can prioritize more specific or restricted profiles.23:04Like test users or early access before broader groups such as all employees or contractors. The last profile in this list is always the default ZTA profile. This profile access a catch all automatically including any user and private resources that haven't been assigned. It ensures that NO gaps in.23:23And every user and every ZTA enabled private resource will be protected by the default policy.23:44For all other profiles above the default profile, you have complete flexibility. You can add or remove users, groups, and resources as needed to tailor access and partial requirements for each scenario. This ordered approach makes it easy to manage targeted rollouts, pilot programs or limited access.23:51Is for contact us while keeping the entire organization securely covered at all times.24:11Enrollment is the process of onboarding users to zero trust access. Let's look at how we make this seamless. 1st, with SAML based enrollment, user authentication using your organization's identity provider allows.24:19Users to enroll in your org. When users sign in, they are prompted to authenticate through the familiar SSO flow, leveraging multi factor authentication and your existing security controls. This method is straightforward, integrates seamlessly with cloud identities and ideal for organizations that want to centralize user authentication.24:36And take advantage of robust identity provider capabilities. Now with certificate based enrollment, we provide additional security and end user simplicity. This method allows you to enroll Windows and Mac oS users silently using identity certificate without requiring any end user.24:55Action at all. It's especially valuable for organizations with strict compliance needs of those managing large number of devices. Here's how it works. You leverage your corporate certificate authority either on prem or the cloud to issue user specific identity certificates. In Secure access.25:15You simply upload or select your CA certificate for ZTI enrollment, then you generate and distribute a configuration file to your managed devices.25:35Once the configuration file is installed and the identity certificate distributed, secure client automatically enrolls each device using the identity certificate as soon as the user signs in. Everything happens in the background, so there's NO extra strength steps or prompts for the end user.25:46This approach brings several key benefits. It delivers a seamless end user by removing all onboarding friction. It enhances security by tying enrollment and authentication to a unique certificate issued for each user supporting strong zero trust principles. And it drives operational efficiency.26:06Because enrollment and certificate rotation are automated and often integrated with your existing PKI infrastructure.26:25Whether you choose SAML certificated based enrollment or a mix of both, Cisco Secure Access gives you a flexibility to match your security compliance and user experience requirements, making zero trust onboarding both secure and easy to manage. To take zero trust access to the next level, let's discuss hybrid.26:34Private access and how security and performance need not be mutually exclusive. Let's explore how to optimize both in secure access by leveraging this market leading architecture. With hybrid private access also known as UCTNA universals.26:54We integrate.27:14The secure client, Cisco secure firewall, and secure access cloud to deliver universal zero trust enforcement, wherever your users are. This powerful architecture is designed with flexibility in mind and supports two distinct enforcement modes so you can tailor your approach to your organization's needs.27:151st, there's the hybrid mode. In this mode, secure client intelligently detects the user's location and dynamically steers private application traffic. If the user is on premises, traffic is directed through your local secure firewall for inspection and policy enforcement. If the user is remote.27:36Traffic is seamlessly redirected to the secure access cloud ensuring consistent ZTNA policies everywhere. This all happens automatically in the background without any user interaction providing optimal security and connectivity.27:56This hybrid mode can be configured on a per resource level. Second, we also support a local only enforcement mode. This is ideal for organizations with strict privacy or compliance requirements for specific resources. In this mode, all data plane traffic for the particular application is.28:11Sent through the on premises secure firewall regardless of the user's location.28:30This ensures the highest level of data privacy and control with NO exceptions. Both modes are easily managed at the private resource level through the secure access and secure cloud control portal giving a unified policy management and a streamlined deployment experiences.28:37And for end users, the experience is transparent and simple with just one Cisco secure client. Troubleshooting and complex access issues can be time consuming to dig into. Let's see some of our reporting capabilities and how AI can help accelerate resolution.28:56Cisco Secure Access empowers your teams with robust monitoring and troubleshooting tools for zero trust access. 1st, on the enrollment side, we're introducing new capabilities that will give you a clear overview of enrollment activity both for certificate based enrollment and SAML based enrollment. You'll be.29:17Be able to see the enrollment method, the details of the user and device and the enrollment status and any additional context or even details to help you quickly identify and resolve enrollment issues.29:36When it comes to user access, the authentication logs provide detailed details on every single access attempt. You can drill down into user and client information, see which specific resource and policy were matched.29:51And review the authentication verdict, whether the access was granted or denied. Device posture is also included in these logs giving you visibility into compliance at the moment of authentication along with comprehensive event details for audit and troubleshooting.30:08Flow logs, which are coming soon in a couple of weeks complements authentication logs and provides details of any network level issues that the session encountered after authentication succeeded, and it also provides flow summaries at the end of the flow.30:25The dedicated users groups and devices page provide capable onboarding monitoring capabilities. Here you get a point in time snapshot of your user base and connected device. You can view detailed information for each user device.30:41And crucially, you have direct controls to revoke access users instantly if needed, helping you respond quickly to incidents or changing risks. Together, these monitoring troubleshooting facilities give you the visibility, context, and control you need to maintain a secure compliant zero trust environment while streamlining.30:59It's issue resolution and daily operations. Finally, we are excited to show you our AI assistant troubleshooting capability.31:19This is available through the secure access AI assistant, which can automate troubleshooting for secure access. Instead of manually checking logs and configuration across all the different sources, you can ask questions in natural language. Let's look at a specific example here for private access issue. Imagine your.31:27Receive a ticket, a username Lee Parker can't access Jira. In the past, you would have to check in multiple places the enrollment logs, the authentication logs.31:47Flow logs, you need to go and dig in to see if the user was authorized, if a device was compliant, is there any issues with policy and if resource connectors are running. Now you simply type in into the AI assistant, why can't Lee Parker access Jira?31:58The AI assistant uses a multi agent collaboration and the agents work together to analyze different aspects of the access.32:18One agent checks for users and grouped memberships, another for device posture, another for policy configuration, resource connector health, and network connectivity, and they all collaborate to identify the root cause.32:27This leads to faster time to resolution. The assistant provides a summary of its finding and it tells you exactly what the problem was. E.g., it may say Lee Parker's device failed posture checks, the antivirus service is not running. This makes it immediately clear what needs to be fixed.32:42This capability is available to all secure access customers and frees up your IT team's time to focus on strategic initiative instead of digging through and collating multiple log sources. Thank you all for attending today's webinar. We covered a lot of ground in the past session.33:00In this session, you've seen how Cisco Secure Access provides a comprehensive platform for zero trust and how the different connectivity methods along with client based GTA work under the hood. We also explored.33:20ZTA profiles and how it can simplify deployment and some of the capabilities around troubleshooting. If you're new to secure access I encourage you to engage with your Cisco sales partner to test drive the platform and experience these capabilities for yourself. For existing secure access customers, you now have access.33:33To these powerful features. We invite you to try some of the new capabilities we discussed today, explore ZTA profiles to better segment access and see if resource connectors could.33:53Help simplify your backhaul and put AI system to work the next time you're troubleshooting. We'd love to hear your feedback as you put these features into practice and we are here to support your success every step of the way. Thank you.34:04Thank you for joining us today. We do have time allotted to help continue answering your questions, so please take advantage to submit any top of mind, final questions that you may have from today's content. I know a lot was covered, so please.34:27Take advantage. We request that you submit.34:46Your questions into the Q and A box, the question and answer box. You can access that by clicking on the three dots located in the lower right hand corner of your Webex console. A menu will pop up and you can select Q and A.34:50Additionally, if you don't have any questions, feel free to stay on and review questions from others that maybe of interest or relevant to you. Additionally, we have a quick survey when you exit today's webinar, it will generate right away. We do request your feedback.35:10And comments. This helps us to continually improve and also look at topics that are of interest and top of mind to you. So please take a few moments. It should be short and sweet of a survey. It'll come to you directly and we thank you for your time and your participation. It's greatly appreciated.35:29Appreciated. Again, we'll stay on the line during this time for any final questions that you may have from today's webinar. Thank you.35:49As a brief reminder, we request that any final questions be submitted at this time as we work on wrapping up today's session, you can submit those into the Q and A box. The session has been recorded and will be sent out via email. If for some reason you do not.36:02Receive, you can send us an email at cloud security.36:22Dash CSM@cisco.com and we'll be sure to get that to you. Again, any final questions, feel free to get them into Q and A We'll get those addressed. And lastly, the survey will generate once you exit today's webinar, and we do request your feedback. Thank you.36:27Thank you.36:47At this time, we will be concluding today's webinar. We greatly appreciate your time and your participation, and we hope that you found this session valuable and that you were able to learn some new information and gain some additional insight. Again, feel free to take a moment for us to provide feedback.36:49Via the survey that you will receive momentarily and we hope to see you at a future session. Be on the lookout for those via email and our monthly newsletter. Again, thanks for joining and have a great rest of your Wednesday. Take care.37:09