When reviewing Cisco Secure Access Traffic Steering configuration, the VPN profile settings and XML files do not display destination IP addresses or domains that are configured for traffic steering control. This creates confusion about how the Secure Access client determines traffic destinations for steering decisions and how configuration changes made in the management portal are synchronized to the client.
Specifically, administrators observe that while Traffic Steering settings are configured through the VPN profile management interface, the corresponding VPN profile XML files do not contain visible entries for the destination addresses or domains that should be subject to traffic steering control.
Traffic Steering in Cisco Secure Access operates through a dynamic rule delivery mechanism rather than static entries in the VPN profile XML. The following explains how this process works and how to validate the configuration:
Traffic Steering rules are not stored in the VPN profile XML file that administrators can view. Instead, these rules are dynamically pushed from the Secure Access head-end to the client during VPN connection establishment. The process works as follows:
Changes made to Traffic Steering settings in the management portal follow a specific synchronization pattern:
To validate Traffic Steering configuration changes:
The apparent absence of Traffic Steering destinations in the VPN profile XML is by design. Cisco Secure Access uses a dynamic rule delivery system where Traffic Steering rules are pushed to the client at connection time and implemented through routing table entries rather than being stored as visible configuration elements in the profile XML. This architecture allows for real-time policy updates and centralized control while maintaining security and performance.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
01-May-2026
|
Initial Release |