Getting started with Cisco Secure Private Access

I team. Thank you folks for coming today. Welcome to our secure access secure Internet Access webinar.00:01My name is one. I'll be your host of the presentation with a bit of housekeeping in the Webex there is an ellipses. If you use that you get to the Q and A section. Please submit your questions over there. Have a team of experts that are.00:19Waiting for all your questions to provide all the answers that you're looking for. The session will be recorded and provided via email. If you have technical difficulties, please use the chat. This is the list of items that we're gonna.00:35Go over this small presentation. The session will basically be a small presentation I'm gonna go through very quickly and then the actual demo, which is a a recorded video. We're gonna go through the packages very briefly where the secure access fit in your environment.00:51The difference between secure private access and secure internet access, the new zero trust access module, components of secure private access, a configuration of a rule and finally the demo. SSE is a key enabler for any.01:10Organization's hybrid work strategy basically allow the communication between your employees and your resources to occur in a safely manner.01:30Whether you have your applications or your data posted in private data centers behind side to side tunnels, we will stay basically in the middle making sure all the traffic is safe.01:39When you get to the destination. This this chart contains the two packages that are available for secure access. Once you review it, you'll.01:55You get to see the differences between the packages and see what's included with one and and not with the other. A few of these links are going to be provided at the end of the presentation, so you have a better understanding of what's included.02:11Where do we fit or how can we help you? We're basically a facilitator through, through the cloud. Secure access is a collection of technologies that make this in the traffic possible.02:30This aims to provide a seamless, transparent, and secure connection methods for your end users and you from anywhere to anywhere. The, just to name a few technologies that make this possible, we have SWG or secure web gateway, SP.02:45ZTNA, firewall as a service, you can also do remote access in the cloud and few others. Like stated, the scope of this mix of technologies is to help you protect your public and your private traffic. What's the difference between.03:03Secure private access and secure internet access. Private access rules control and secure access to internal resources and applications. Whereas internet access rules would be the equivalent to what Umbrella does. It polices your internet traffic. This one is a scope to protect your private data.03:24The other one is Cisco to allow your users to browse the internet in a safe manner. This next two slides showcase a little graph.03:43It's like a workflow of what each solution looks like. The 1st slide here is a representation of what the secure private access flow looks like. On the left most side of the slide, we have your potential sources or where the traffic is coming from.03:58Going from the top to bottom if you install the ZTNA module on a computer, it will redirect the traffic to our cloud. Also you can connect to our cloud via as a service using Cisco secure client any connect.04:17If you have an IPV two capable device, you can also establish a tunnel between your physical branches and ZTNA also offers the possibility to perform clientless connections. The big square in the middle is us. Once we receive your traffic.04:34We can send it through a series of security features. The top bubble are, features that handle the traffic that are mandatory. We can do a cell encryption, cloud delivery firewall and secure access rules.04:50The features at the bottom are optional but highly suggested posturing IPS and step up authentication. And once the traffic leaves our cloud, you can egress directly to the resource and depending on what you're using.05:08And the traffic will also be provided in your source IP and then traffic will ingress out. And the destination will be your private resources. This is the flow for secure private access. On the next slide, we have the flow for secure internet access.05:25It's it's very similar but with a few differences. On the left side, we have also your potential sources. You can install the roaming security module or the umbrella module if you're familiar with that. On a system, if you configure the cloud to perform a full tunnel remote access VPN.05:41This method can also be used to police your internet traffic and also if you have an IQV two IPsec capable device, you can use that to establish them. And it's the same logic as in the previous slide, the top part of the.06:00Middle square is the the what we call the unified policy, we do DNS filtering, firewall filtering decryption, and then gateway and at the bottom optional but highly suggested features with data loss prevention, PS.06:18Malware scanning, in some cases sandboxing of malicious files, and then the traffic goes out to the internet. We provide a new IP when you egress out to the internet. Notice the blue line at the very top, not all the traffic.06:35Has to go through secure internet access. There is a way to configure exceptions. We do that on the client directly or remote access profile or on your IQB two capables, so there's a way to exclude traffic as well.06:52We'll talk about the zero trust access module right now. This is a new module that is appended to anyconnect, if you're familiar with what the modules look like, it's just gonna be a new block in anyconnect.07:12This screenshot right here have zero trust at the top and at the bottom umbrella, NO anyconnect or NO VPN module in this example. How do you install it?07:26You can download a zip file from the dashboard. It's gonna give you all the msis. You deploy it as you regularly deploy software, you can use Ninja, SDR Intune, you name it. It's just an MSI, you append a command to it and then install it.07:41Few requirements are Windows machines have to have TPM or trusted platform module two point oh which is a fairly common corporate standard nowadays. If you're using Mac devices, the equivalent of that is secure and played.07:58Once you have these two components, then the client should be able to get installed and function. The benefits remote users can connect to one single private resource instead of the entire network.08:13Anyconnect offers connectivity as of layer three and upwards. That DNA offers connectivity as of layer four, you have to specify which destination you're opening as well as the port and the protocol.08:30This is a more tight security. It is based on zero trust. So the logic of having the traffic explicitly allowed applies for this this type of flows. Optionally you can do posture to assess the device to make sure it's up to date.08:44On all the requirements. And this is optimal for users where remote access VPN is not an option. It's not a replacement, but it could be considered. Once you install the client, this is what the end user is going to experience.09:04This screenshot right here is what the client looks like once the client isn't enrolled. The enrollment process requires you to have a user database imported to the secure access dashboard as well as a SAML integration.09:24When the users click on enroll, you're gonna be SAML challenged, so you have to have these two components in your dashboard, a database of users and also integration. And the users go through the process, they do the two factor and then the client will enroll.09:42It's going to fetch the the configuration of the cloud and the steering mechanism to private resources will begin immediately. There's another flavor of ZTA that you can use.09:59If you are enabled or you wish not to use the client, you can use or register resources in your dashboard and make them compatible with the ZTA clientless flavor of deployment. The dashboard is going to give you a public URL.10:16To which you would distribute to anybody who needs access to the resource in a clientless mode. No client is needed, you can still perform a small assessment.10:32This this is limited to web apps using ports 84 43I understand there are a few other ports that have been added such as RTP and SSH. Let's look at some of the components of.10:48Secure private access. This is these are some of the components you need when creating a rule. You have to define a role name, a role priority number, which is equivalent to the sequence number on an access list.11:08The source of the traffic, where the traffic is gonna come from. Destination, you must have previously defined or registered private resources and you call them here inside the rule as destinations. Optionally, you can do posture profiles that says the end device that is accessing the resources.11:24IPS is another option you can turn on for private traffic and also to perform step up authentication. We're gonna go through one of these a bit more in detail. For sources, we can use active Directory users and groups.11:43Also, if you configure an IPsec tunnel, you can call that as a source of the traffic and a rule. It is required, of course, if you have an existing integration of Active directory. As per the destinations, you also need to pre register your.12:00Private resources, applications and services that run on premises or in the cloud will put them behind secure access. When adding a private resource, there is a series of checkboxes or options that you need to consider. After you add the resource, you have to tell the cloud.12:19This resource is reachable via IPsec tunnels only for remote access only or ZTA only or all of them. So there are some considerations that you need to take into account when configuring a resource. We're gonna look at this a bit more in depth during the demo.12:36Oh Foster profiles. Optionally but highly suggested. There are three types of profiles you can create. Is that TA client based profiles? This is when you install the client on the end device, we have more visibility of the system and therefore the profile.12:55Offers more features is more rich. You can do a clientless type of profile, it offers less options than the client base. Nonetheless is still good. And for remote access VPN, if you are opening connections with any connects.13:13Then you also have a variety of options to select from when configuring a posturing the profile. Secure private access rules, control and secure access to internal resources and applications.13:32That are private and you shouldn't be accessed by the general public. A zero trust principle is enforced where all the traffic is blocked by default and anything that you want to allow, you have to explicitly allow it through a rule.13:50Good recommendation is planning your rule set to get the results that you're expecting and you are going to assemble rules based on components that you can recycle. If you configure a private resource, you can use it as a destination in multiple rules. So the recycling resources, it's an option and also configuration.14:07On the next few slides, we're going to see a few screenshots of what the creation of the rule looks like. We're just gonna run through this quickly. I'd rather just spend time looking at the demo. On this 1st screenshot, you hover over secure on the nexus policy.14:31And then you'll be taken to our access policies on the far right side, you click on add rule, you'll be offered to create a secure private access or internet access rule. You click on private access in this case, and then you are taken to a form that you have to fill out.14:44On the right side, it looks kinda small, this is the entire form, it's taken into screenshots you to scroll down through it once you're in a dashboard doing the configuration. You will give it a rule name, a rule order is the or the priority is the sequence number.15:05The, from box is your sources, where the traffic is coming from. The destination box that's number four, that's where the traffic is going to. This is where you call your private resources. The rest of the options are optional, but highly suggested.15:22The option number five is ZTA client posture profile. Option six is calling a posture profile for clientless connections. Step up authentication is configured on step number seven. Once you're done with the 1st part of the.15:38Rule configuration and click on next. This takes us to the last bit of the wizard. You can only change the rule name if you if you need to define a sequence number if you need to and also enabled IPS. Once you're done, you can save and the rule will be.15:54Configured. The secure access policy is a collection of both your internet rules and also your private traffic rules. So you don't have a separate place for each. They all are mixed into one single list.16:14At the top of each rule, there is a summary section once you're during the configuration of the rule, the summary displays the current state of of the rule, but the rule is looking like basically as you configure it. If you configure a rule.16:31You can go back and edit it. You can change parameters inside the rule except the action. So if you configure a secure private access rule and you set the action to allow the traffic, you can edit the rule later and the allow action is something you will not be able to change. If you need to craft the.16:49Rule with the same parameters but make it a blocked rule that you need to create a new rule from scratch. The secure access policy displays multiple columns of data you can configure and sort out as you see convenient. There is a drag and drop also at the very beginning in which you can.17:08I believe it's time for the demo, so I'll remain here in the back end continue to use the chat. Our team and myself are eager to get all your questions. You're gonna transition to the demo now.17:34Hi, my name is Juan. Thank you for being here today. The objective of this demo is to show you how to protect your corporate private resources by policing the traffic with Cisco secure private access.17:48Which works under a zero trust principle. We're going to review three different scenarios or flows in which Cisco will help you secure your private data. These flows are spoke to spoke communication.18:01Using Cisco Secure Access Cloud as the hub. 2nd flow is remote access VPN to your private resources. This traffic will traverse the secure access cloud. The last flow will showcase the new.18:17Cisco Secure Client module, zero Trust Access, also known as ZTA. In all the scenarios, it will be required to configure at least one IPsec tunnel. The rest of the requirements for the 1st flow are the configuration of those IPsec tunnels. We will register.18:32Private resources in a dashboard.18:52We create a secure access rule, test connectivity, and I'll show you how to review the logs in activity search. In the remote access VPN flow, after the tunnel is configured, I'll show you where to download and install Cisco secure client.18:55To configure a VPN profile inside the VPN profile configuration, you need to call your IDP provider.19:14In this case, I will use Azure as my SAML provider. We'll add private resources to your dashboard and configure a secure access rule, and we'll test connectivity and review activity search. In the last flow, after the tunnel is configured.19:22I'll show you how to configure the policy based routing, and I'll give you a quick introduction on CGNAT. We'll download and install Cisco Secure Client, and you'll see the enrollment process from an end user perspective.19:41We will add private resources to your dashboard where we configure a secure access rule, put test connectivity and review activity search. Let's get started.19:57We'll begin by opening your favorite browser and then navigating to login.sse.cisco.com.20:20Once you log in, the 1st thing we need to do is configure two IPsec tunnels. To do that, we go to connect and then network connections. Click on 2nd tab, network tunnel groups.20:37Here you can see the list of your existing IPsec tunnels. We're going to add one by clicking on add on the far right side. We'll be met with a four steps wizard, and we need to fill out to register the tunnel.20:56By clicking on the help page, you click on the left side under supported IPsec parameters. You're going to find a chart with all the IKEA two parameters that we support it. Everything in bolt are the recommended settings. If you expand network tunnel configuration on the left side.21:12You'll find a guide for all the devices that we officially support. If you scroll down, you'll see all the steps to configure the IPsec tunnel in your device. Because it is a spoke to spoke flow, we're going to register two IPsec tunnels, one for the ASA and another one for the CSR.21:31Fill out the information of the ASA 1st.21:51Provide a tunnel group name and then select your region. I'm gonna select Canada, and then select the device type. We'll do the ASA 1st, click on next to continue.21:59For the identity, we support email address or the public IP address of your IPsec device. I am going to use the email address and this is going to be my identity. Under the passphrase copy and paste your pressure key in these two boxes. Make sure it is between 16 and 64 characters long. It must inc.22:14Close at least one uppercase letter, one lowercase letter, one number.22:34And it should not include any special characters. Click on next to continue. Under the routing section, you need to specify the network or networks that are behind your IPsec device. In my example for my HQ office, I only have the 182160.22:38A 22 network. So this is the only network that I am going to have. Optionally, you can do a dynamic routing, but this is an advanced feature and it's outside of the scope of the demo.22:58Click on save, and the last step is the summary of all the config. You are gonna be given primary and secondary tunnel IDs, primary and secondary IP addresses, and the pressure key.23:09I would only configure one tunnel. Let me save all these settings. It might not done? Okay, we're done with the 1st tunnel.23:23To scroll down, you'll see the 1st tunnel here. It's currently disconnected. I'm going to register 2nd tunnel quickly. I will name this branch also in the Canada region, and this one is an ISR.23:43Next, this is going to be the identity of my second tunnel, it's an iOS XE device.24:02Copy and paste the pre shared key and specify the network behind my CSR. It is the 18216880 six.zero.24:16I'm going to click on save. This takes me again to the summary. I need to save information from here, the primary tunnel ID. I'll also save the primary IP address.24:33And the pressure key. Click on done, and let me bring the topology that we are going to use for this part of the demo. These two clouds connect the topologies to the internet.24:52This edge device is my ASA. My corporate network is 18216820 two.zero. This domain controller is the device that is going to host my private resources. On the right side, we have the branch office.25:13Corporate network there is 19216880 six.zero, and I'm going to perform the test from this RNA computer. It has a.ten IP. Let's go ahead and configure the actual tunnels. Let's do the ASA 1st.25:29I have a script with all the configuration. I'm just going to copy and paste everything so we can move faster.25:49I need to make sure that the ASA grabs the 22 local network and sends it to the 86 network through this tunnel. We're gonna do that with a policy based routing.26:23Okay, this route map.27:04Uses as a next hop 90 nine.two. This is the adjacent IP to my tunnel interface IP address. The access list called my local network 22 and the remote network 18216886. And I need to add this route map to my inside interface. This is the last step.27:07I can never remember these commands. There you go. I say PBR.27:33Okay, let's see if the tunnel is up.27:48Okay, it's been up for over a hundred seconds. Excellent. Now we move on to 2nd device, the branch router.27:54I also have a script with all the configuration. I'm just going to quickly copy and paste it.28:10Okay Finally, the tunnel interface. Okay, this enables IPsec and I can see the tunnel interface already changed states on.28:45Okay, the tunnel seems to be unactive. It's been up for 14 s. Great. When the traffic is sourced from my branch office, the 86 network and is going to the corporate network 22.29:01I need to tell my router to send the traffic through the tunnel. We're gonna do that with the route map. This is the access list.29:16And this is a route. The excellence has the 86 network as a source, the 22 network as the destination.29:36And I'm using the 90 nine.two as the next hop IP address, which is the adjacent IP to my tunnel interface. The last step is to place this.29:51Route map inside my inside interface. Let's do that.30:09Okay, we're done with the tunnel configuration. This is all for the IPsec tunnel config in both devices. Make sure you save your configuration. It's time to add private resources.30:24To do that, we go to resources and then private resources. This is a list of your private resources. We click on add on the far right side to add a new one. We need to fill all these boxes.30:40Provide a resource name, I'm going to register my DNS server 1st. This is the IP address of my domain controller, and it's been promoted to a DNS server as well. That's the 1st resource. I'm going to add another one.30:57I'll add my domain controller once again with a different name. If you add a resource with an FQDN, you'll be required to configure a DNS server for resolution. This, however, is not necessary for spoke to spoke communication. I'm going to register the IP.31:14The address instead. And on the right side I will open all the ports that I see necessary.31:34This time I will add 443 and 3389. HTTPS and RDP ports. This is all I need for now, so I'm gonna click on save, and I will also register my core switch. Again, provide the IP address of your intern.31:42No resource and call the port that you want to open through the cloud.32:00Yeah. This should be all. Click on save. Now we're ready to configure a secure private access rule.32:08To do that, we go to secure and then access policy. This is the list of all your existing rules. Before adding a new one, it is important to notice at the bottom, we have a default rule for all the private access, which is set to block and this behavior cannot be modified.32:27There's the other default rule for all the internet access and this one you can modify and allow the traffic. This means that all the private traffic is blocked by default, so I need to explicitly allow it. Let's add a new private rule by clicking on add rule in the top right blue button and then private access.32:44This 1st section is a summary of the rule configuration where step number one of two. 1st, let's provide a rule name. This rule order dropdown menu allows you to place the rule on a specific sequence number on the list of rules.33:05This is the behavior what you want the rule to do. I'm gonna set it to allow. In the foreign box, you call your sources. You can browse through these elements and find what you need to call as a source. You can use the keyword at the top as the search. Optionally, you can click on this icon.33:24And use the search assistant at the top. I'm going to find my tunnel. Now I'm going to select the branch as the source of the traffic, and click on done. The next box is the destinations.33:44This is where I called all my private resources. I'm going to expand it by clicking into this icon. And in the search box, I'm going to use a keyword that will help me find all my destinations, my core switch, my domain controller, and the DNS.33:59Click on done. Click on next to move on to the next step. The rule summary tells me I'm in step number two out of two. And I can see the rule name, the action is set to allow NO security controls and all my destinations. You can still change the rule name if you need to and the sequence number. As.34:20Security we can enable IPS, but this feature is outside of the scope of the demo. Click on save.34:40Okay, this is again my topology. The traffic is going to be sourced from these computer.34:48Okay, as you can see, it's the.ten device and it's using my 20 two.one hundred, my domain controller as the DNS server through the IPsec tunnel. 1st I'm going to test.35:05The internal webpage. Okay, great. This resource is reachable through the IPsec tunnel. I have a self signed certificate in my domain controller.35:22I can verify this is indeed like order because of the certificate.35:42Next, I'll try to log into my core switch. This is the IP address, and this traffic should reverse the tunnel. You accept the key and I can log in.35:51Okay, let me show you the SVI. 102 16820 two.two 54, which is the management IP. Great. I can also ping my domain controller by name.36:06Okay, finally, let's go ahead and see everything we did in activity search.36:25Okay go to monitor and then activity search. In this search bar at the top, I'm going to add the source IP of my branch BC.36:41We can see my core switch connection in port 22 and my internal website to my domain controller in port 443. This is all for the 1st part of the demo. I will reset the config and when we come back, we're gonna look into.36:59No access VPN.37:17The 1st thing we need to do is usually is open up your favorite browser, go to login.sse.cisco.com, and we're going to register.37:27One IPsec tunnel. Hover over connect and then network connections. Click on 2nd tab, network tunnel groups. Click on add in the far right side.37:38Inside a tunnel name, a region, any type of device, click on next on 2nd part.37:54Provide a tunnel name or identity. Copy and paste the passphrase in these two boxes. Click on next. Under routing, select the network or networks that are behind your IPsec device.38:20In my case, I will add the 18216820 two.0/ 24. Click and save when you're done.38:35And step number four is a summary of all the config. You get the primary, secondary tunnel ID, data center IDs, and the present key. I'm going to save the tunnel ID, the data center IP address.38:55And appreciate key This is the topology we're going to use. On the left side, we have my.39:13Corporate site, this is my edge devices in ASA, corporate network 18216822, and the domain controller where I'm hosting the private resources. In the right side, we have this user Gordon Freeman.39:33He's a user connecting from home. His home network is 18216850 and the VPN adapter, 1721630 two.zero. Let's go ahead and configure the IPsec tunnel in the ASA.39:48I'm going to copy and paste all the configuration that I have saved.40:09Okay, that's it for the tunnel config. I'll tell the ASA to communicate the 22.40:41Network with the VPN pool network through the tunnel interface.40:51This is the access list from my 22 local network to the VPN pool.41:30This is the PVR that matches the access list PVR, and the next hop IP address is the adjacent IP to my tunnel interface IP. Finally, I'll add this roadmap.41:36In my inside interface and I'll be done with the config.41:54Okay, it's been up for 96 s. Great. We're done with the ASA. Save the changes.42:21I'll set the topology aside, we'll continue the configuration in a dashboard. You can download Cisco Secure Client from the dashboard itself. To do that, head over to connect and then.42:36An end user connectivity. In the top right corner, you'll see a button that allows you to download the client. If you click on it, it'll be presented with different OSs, which is download the one that you need. I have already downloaded it and I've extracted the zip file in.42:49Hi, my testing busy.43:09This is the folder with all the msis. Currently, I don't have any Cisco software installed. I'm going to install the VPN.43:13Okay, here it is in the list. Okay I'll set the client aside. Let's go back to the dashboard and continue with the configuration. Now let's click on.43:30Virtual private network. We need to configure a VPN pool 1st 1st select the region, I'm gonna.43:50Go with Canada and then add a name for this pool, this dropdown menu, you can call any existing DNS server, otherwise you can just add a new one by clicking on add, just fill the spaces at the bottom. We're going to use this one.44:10An IP address of this network range will be used when the anyconnect network adapter is enabled. The management pool functionality is outside of the scope of this demo, but we need to provide a network space here as well.44:32Finally, in this dropdown menu select your authentication server. The functionality and configuration of the triple AAA server is outside of the scope of the demo. Once you have the poll ready, go back to the VPN profiles and let's create a new one.44:511st provide a VPN profile name, provide a display name, a default domain.45:09In this dropdown menu called the DN server, you want to inject to the anyconnect network adapter. I'm gonna go with IPsec.45:32Posture is optional but highly recommended. For simplicity, we're not going to configure it. Click on next. Step number two in the wizard is the authentication piece. It pre selects SAML as the method of authentication, and I'm going to use that method. We need to integrate.45:43Create an IDP provider with this VPN profile. I'm going to use Azure AD. I have already created a enterprise application for this demo.46:02Yeah. This is it.46:18And the 1st box, the basic SAML config needs to be updated. I can update it by feeding the metadata from the secure access dashboard. So I'm just going to download it. There it is. I'm gonna go back to.46:33Azure and I am going to upload the XML data I just downloaded Okay successfully uploaded, save it.46:49And now that it's saved, I can scroll down and download the metadata from Azure, and I need to fit that to my remote access VPN configuration in the dashboard.47:11Let's go back to the secure access dashboard and upload the metadata from Azure. After the metadata exchange is done, the SAML integration is completed. You can click on next.47:27This is the split tunneling mode. By default, this is going to use tunnel all config where all the traffic is going to go to the secure access cloud. Except these domains. Anything you add in this section will be excluded from the tunnel.47:48I'm going to change the way the remote access VPN tunnel works. I'm going to bypass everything by default and only the domains that I add to the list will be sent through the tunnel. My corporate network is the 20 two.0/ 24, so this is.48:03The only network that I want to send through any connector.48:23Click on next. On step number four, we can configure timers, client settings, and also certificate settings. I'm just going to leave everything as it is and click on save to finish the configuration.48:29Once you're done with the config, a profile URL will be created, and this is what the end users need to use to connect to the VPN using any connect. Next, we're going to register some private resources. Go to resources private resources. And I'm going to add my domain.48:50Controller. This is the IP address and under ports I'm gonna choose any TCP and UDP, and I'm going to open.49:08443389 for RDP and also 53 for DNS. Scroll down, make sure the VPN connections check is enabled under endpoint connection methods. This will allow the remote access VPN users to interact with this internal resource.49:22Let's add a second one, which is my core switch. This is the IP address, change to TCP, and I'm only opening port 22. Same as my domain controller. Click on this checkbox, make sure the resource can be reached via the VPN users. Click on save.49:42Now let's go to secure and access policies. It's time to create a secure access policy. You can add rule on the far right side, click on private access rule, provide a rule name, change the sequence number if.50:05Necessary. Set the action to allow, call the user that is going to use the VPN. I'm gonna call Gordon Freedman.50:22Click on done, and then let's go to app destinations. This is where we are calling our private resources. Use any keyword that will help you find your resources. If you hover over these icons.50:40You'll see that the resources are allowed to be conducted via remote access VPN users. On 2nd part of the rule, we can only enable IPS, but this feature is outside of the scope of this demo. Click and save when we're done.50:55You can drag and drop the rule to change its sequence number in the list. You can click on the rule name and expand all the configuration. Optionally, click on the ellipses, you can edit the rule from here or delete it if necessary.51:15I am going to bring the computer that we'll use for testing Grab the profile URL from the dashboard and paste it in this box and click on connect.51:32Connect, you should be redirected to your IDP provider. I have my credentials cache, so I'm just going to use those.51:52Okay, the VPN session is established. If you click on the gear, you go to statistics, you can see the private IP address that was assigned to my network adapter and all the traffic that is traversing the remote access VPN.52:08Connection or tunnel. Let's do some tests. I'll open an incognito page and browse to my private resources. The website I prepared my domain controller only displays this picture.52:27So I can reach out internal resources. That's great. Now let's try RDP self authenticate.52:44Let's fix that. I'll make this user member of the group.53:09Okay, apply the changes and go back and test one more time.53:18Okay, great. Okay I'm not going to log in, but we made it to the login screen. Finally, I'll test SSH to my core switch.53:38Great, this is the prompt of the key authenticate. And I am inside my core switch. This is the management SVI that you can.54:03See here in the topology.54:15Let's see what we've done in the logs. Let's go to monitor and then activity search.54:27We can use the username and the search box to find the VPN loss. This is the AD account, and I can see all the VPN activity.54:41That's excellent. If you scroll to the right side, you'll see more information about the traffic. The further to the right, you can see the rule that is handling all the traffic.54:55Optionally, you can click on the ellipses and then full details to view more information about every log. This concludes 2nd part of the demo. I will reset all the configuration and when I come back, I'll guide you through the ZTI config.55:13Okay, let's start by opening up your favorite browser and navigate to login.sse.cisco.com.55:30We're going to register one IPsec tunnel. We do that in connect the network connections. Go to 2nd tab, network tunnel groups, click on add on the far right side.55:51Let's fill out all the information. Provide our network tunnel group name. Select a region. I will use Canada and the type of device you will use for your IPsec tunnel. I am going to use an ASA. Click on next.56:062nd part, provide a tunnel ID and a passphrase. I will use this as my tunnel identity and I'll copy paste the pressure key. In the routing section at the network or networks.56:25That will be behind your tunnel. I only have the 19216822 network. Oops. There you go. Click and save to finish.56:40And write down the tunnel ID, along with the IP address of our data center and appreciate key. This is the topology that we're using.56:56On the left hand side is my HQ space. My local network there is the 192168220. This is my domain controller that we're going to use for all the tests. In the far right side, this router simulates your home router.57:17The user on the far right will be used to send traffic from the zero Trust access module. But how does that work? The zero Trust Access module works very similar to the SWG module or the umbrella module. Let's see its requirements.57:36So open a new tab on my browser and I'm going to search Cisco secure access network requirements and I'll visit the 1st link.57:53This part of the documentation, you have requirements for multiple functionalities of secure access, and the last one, if you expand it, you're gonna find this network range. This is the carrier grade NAT range. Let's do a little bit of research.58:13Let's visit the Wikipedia link. Okay, we're going to look at only the 1st three lines of the document. Carry grade NAT is used by ISPs to NAT IPv four networks. The reason behind this is based on the IPv four address.58:36Exhaustion.58:54Let's look at a diagram for a second. If you're in a private network or at home, you're going to use IP addresses that fall under the RFC 1918, which are private IPs. When you want to go out to the internet, your edge device at home is going to NAT your private IP to a public.58:55IP and then the traffic will be routable on the internet.59:15Under a similar principle, your source IP can be added to an IP address inside the carrier grade nat. This allows the ISP to be able to NAT your traffic again, if required. And that's all we need to know about carrier grade NAT for now. If you want to know more information, I invite you to look at this document and do a little bit more of research.59:19Now that we understand a little bit more about carrier grade NAT. When an end device with the ZTA client installed attempts to reach corporate resources, the traffic is redirected to the cloud. When the traffic hits the cloud, we're going to use the source IP address from this carrier grade NAT space.59:41Then we will send it to your private space using the IPsec tunnel. In this case your ASA. We have to tell the ASA to route the traffic back using the IPsec tunnel instead of the outside interface. Let's go ahead and configure.01:00:01All the IPsec parameters, the tunnel interface and the route map. I have the script right here. I'm gonna copy and paste all the config Okay that's all the IPsec parameters and the tunnel interface.01:00:18Let's see if the tunnel is up. Okay, it just came up 1 s ago. Perfect. But what we're missing is the route map. I'm going to add this access list.01:00:39And the roadmap. Let me show you what it did. This route map uses this PVR access list.01:00:56The access list calls the 22 as the source of the traffic and the carrier grade net address space as the destination. In the route map I'm using as the next hop, the adjacent FP to the tunnel interface. This route map needs to be placed in the inside interface. This is the last step.01:01:13Let's do that This should be all the tunnel configuration. Okay I will dismiss the topology and we'll continue in the dashboard.01:01:32Connection requests sourced from the ZTA client rely on the cloud being able to resolve the FQDN or the name of those resources. Let's register an internal DNS server. To do that, let's go to connect.01:01:52And then user connectivity. In the top right corner, click on manage DNS servers and add a DNS server here. We're going to use this NO, not really, I guess your IP address.01:02:07We can communicate with this DNS server from the cloud via your IPsec tunnel. Now we need to register private resources. To do that.01:02:28Let's go to resources and then private resources. Click on add in the far right side. Provide a resource name. I'm going to add my domain controller.01:02:39Add the URL or FQDN of your domain controller and open the necessary ports. I'm going to choose any TCP and open HTTPS RDP.01:03:00When you add an FQDN for the private resource, it is required to configure a DNS server for the cloud to be able to resolve the name of the set resource. In this dropdown menu, I am going to call the DNS server that I just registered.01:03:13Under endpoint connection methods, make sure you select the zero trust connection check box. This will allow this resource to be accessed from the ZTA client. And let's add a second resource. I'm going to add my core switch.01:03:29Because I've added an IP address, selecting a DNS server is not necessary and is grayed out. Same as my domain controller, under endpoint connection methods, make sure the zero trust connections checkbox is enabled.01:03:48And then click on save. Now let's add a secure access rule. Click on secure, then access policy. Let's click on add rule in the far right side.01:04:04And then private rule. Under the summary, we're in the step number one, out of two, provide a rule name and their sequence number for this rule in a dropdown menu. The action can be left as allowed.01:04:21Click on this icon to expand the search and let's find the user that will send the traffic. In this case, Isaac clienter. Click on done. For destinations, let's find the resources we just.01:04:37Register, click on done.01:04:53Under endpoint requirements, a posture profile is automatically selected. This default posture profile scans for OS firewall, endpoint security agent, and this encryption in the end device. Because it is an advanced feature.01:05:09And it's outside of the demo, I am going to turn it off, but this is something we highly suggest enabling. Click on next. On 2nd section, IPS is the only configurable item here, but it's also outside of the scope.01:05:27So I'm just going to save the rule, and the ellipses on the right hand side and then click on view to go over the configuration. You can edit the rule or delete it.01:05:42If you need the client, you can get it from the dashboard. Just go to connect and user connectivity. There is a download button in the top right corner that says Cisco secure client. If you click on it, you'll be presented with different OSs. Just select the one you need.01:06:00And then you can install the client. I'm going to bring the machine that we're going to use for testing.01:06:17Yeah, let's install the Cisco secure client 1st and then the ZIPTA module. These are all the contents of the zip file that you can download from the dashboard.01:06:33Just like umbrella or SWG, it is required to install the core VPN because it has dependencies that are needed for the other module to work. So I'm going to install anyconnect VPN 1st.01:06:50And now the ZTI module before we continue with a Roman process, it is required that.01:07:06SAML is already integrated and configured globally in your dashboard. We can verify a SAML configuration under connect users and groups, and then click on configuration management in the top right corner. And the bottom part, the SSO authentication piece, this is.01:07:23There's a SAML instance that will be used to challenge users that are running zero trust client or client less space. Let's bring the computer back. When I open the client, the GUI is going to notify that a one time enrollment process is required.01:07:43I have the credentials of this user cached. It is unlikely that your user is going to exist in two different dashboards, but if that is the case, you select the right dashboard.01:08:02Then provide the credentials. Let me grab my authenticator.01:08:20Okay, the enrollment is completed. Just open the client, go to the gear, zero trust access tab.01:08:37The 1st tab is statistics. 2nd one is advanced. All you can do here is unenroll the client. Under configuration, you can just fetch the latest config from the dashboard and then a message history. Let's go ahead and test access to the resources.01:08:53I'll open a private session and visit my domain controller private website. Okay, great. This is the website that I configure in my.01:09:11Local domain controller. Let's close this. Let's try another resource. I'm going to RDP to my domain controller. I get the login prompt. This indicates there is connectivity.01:09:26Okay, this user is not added to a remote access group. I'm going to close the RFP session.01:09:53We didn't log in, but we get to the login page. That should tell us that there is connectivity. Finally, I'll perform an SSH session to our core switch.01:10:00Okay, I'm inside my core switch. Great. This is the SBI.01:10:18Right here. Perfect. I'm going to exit and dismiss the client in the topology. The last thing I want to show you is what the logs look like.01:10:34So let's go to monitor and then activity search. In the search box, you can filter out by using the username, which is tested with. And here's all the activity. You can see zip DNA client based.01:10:51Connections as well as firewall events. If you click on the ellipses on the farm right side and then full details, you get to see more information about all the events. If you scroll to the right side, you'll see the rule that handled the traffic.01:11:11And the rule action currently, most of this traffic is allowed. Clicking the lipses, this is showing the rule name, the destination, this is my domain controller private IP.01:11:29And all the important details and this is how the Ztia client works. Thank you so much.01:11:46For staying until the end. I hope you like this demo and finding entertaining or educational. Hope to see you again in another webinar. Thank you for coming. See you next time. Alright, thank you so much for staying with us until the end.01:12:01That concludes the demo. Here are some links that are useful for you. Secure access or documentation page.cisco.com Secure access at a glance so you can get a glimpse of what the.01:12:21Product looks like service status portal page in case we're doing maintenance on one of our components goes out the data sheet and the release notes every time we make an upgrade or add features to the solution. This is all.01:12:36For now, again, thank you so much for staying until the end. We truly hopefully enjoy we we we expect you to enjoy the demo and the presentation and thank you so much. We hope to see you again in another webinar.01:12:56I'll Pass it over to my colleague. Thank you so much Juan, and with that, this does conclude our time today. We are grateful, grateful for your participation and for your attendance in today's session. We hope that you found it helpful and impactful. When you exit today's webinar.01:13:13You will receive a brief survey. We do welcome your feedback and this helps us to continually improve, and as Juan had mentioned, we hope to see you at a future session in 2026. With that, we hope you have a great rest of your Wednesday. Take care.01:13:33