Configure Secure Access Policy Identity Logic (Private Access)

Introduction

This document describes Secure Access policy identity matching logic for network object and network objects and service objects.

Background Information

Configuring Secure Access policies destinations for private access includes this list of options:

1. Private Resources

2. Private Resources Groups

3. Network Objects and Network Object Groups

4. Service Objects and Service Object Groups

5. Security Group Tags

Options 3 and 4, are having a logic of (AND) where both conditions have to meet in order for the policy to match properly.

Example:

Network Object: 192.168.1.10

Service Object: TCP Port 1024

Connection need to be destined to IP Address: 192.168.1.10 AND TCP port 1024 to match this policy.

Problem: Identity Matching Logic

The Logic in the Identity matching based on the current Dashboard design, can be indicating this matching is an (OR) instead of (AND). since the Network Objects and Service Objects are in separate options. however the logic is (AND) all the time, between the Network and Service Objects. 

Solution: Dashboard Options Enhancements

To Clear this confusion, Secure Access Design Team is making a change on how Network and Service Objects are displayed in destination selection. to make it more clear that the relationship between the two options is (AND) not (OR).

This change is take place end of April to begin of June, 2025. Once this change is made there is no action required on users end. however, API calls need to be updated to include the new logic. 

Related Information

• Secure Access User Guide
• Secure Access Community Page
• Technical Support & Documentation - Cisco Systems