Cisco Secure Access Documentation Changes

PDF

Cisco Secure Access Documentation Changes

Cisco Secure Access Documentation Changes 2026-09-28

Updated: September 22, 2026

Want to summarize with AI?

Log in

Lists changes to Cisco Secure Access documentation published on September 28, 2026.

Summary

Changed Pages

Manage the Access Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/access-policies-intro/manage-access-policy.html

  • Added: For users implementing Kerberos authentication with AD, we recommend reviewing the appropriate Microsoft documentation about configuring the correct ports and private resources to plan for for AD communication. to understand how to optimize the location of a domain controller, see this documentation.

Manage Client-Based Zero Trust Access in Secure Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zero-trust-access-intro/manage-client-based-zta-overview.html

  • Added: Multi-site Environments

  • Added: If you organization has multiple Active Directory sites then the IP address of the client (the LDAP source IP) can affect the resultant selection of AD Site and therefore the selected domain controllers.

  • Added: Consider the IP address of the client in different deployment modes:

  • Added: Network Tunnels - In Network Tunnel mode the client IP will be affected by NAT.

  • Added: The source IP will be replaced with an IP address from the CGNAT IP address range.

  • Added: Therefore clients will typically be associated with the “Default Site” in Active Directory.

  • Added: The Domain Controllers in the default site must be accessible in the Access Policy.

  • Added: Resource Connectors - In Resource Connector mode the client IP will be affected by NAT.

  • Added: The source IP will be the Resource Connector IP address.

  • Added: The IP address of the resource connector(s) should be assigned to an appropriate AD Site in Active Directory Sites & Services.

  • Added: The Domain Controllers in this site must be accessible in the Access Policy.

  • Removed: Traffic Steering: Secure Internet Access for specific interenet destinations

  • Added: Traffic Steering: Secure Internet Access for specific internet destinations

  • Removed: Traffic Steering: Secure Internet Access for specific interenet destinations

  • Removed: Traffic Steering: Secure Internet Access for all interenet destinations

  • Added: Traffic Steering: Secure Internet Access for specific internet destinations

  • Added: Traffic Steering: Secure Internet Access for all internet destinations

  • Removed: Traffic Steering: Secure Internet Access for specific interenet destinations

  • Added: Traffic Steering: Secure Internet Access for specific internet destinations

  • Removed: Traffic Steering: Secure Internet Access for all interenet destinations

  • Added: Traffic Steering: Secure Internet Access for all internet destinations

Traffic Steering for Zero Trust Access Client-Based Connections

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zero-trust-access-intro/traffic_steering_for_zero_trust_access_client-based_connections.html

  • Added: If you are implementing Kerberos authentication wit Active Directory (AD), we strongly recommend adding the AD DNS SRV recorcd names to the DNS Steering you just created.

  • Added: For more information from Microsoft, see How to verify that SRV DNS records have been created for a domain controller for more information.

  • Added: Microsoft documents specific SRV DNS records for you, see 6.3.2.3 SRV Records sepcifically for more information.

  • Removed: Full Admin user role.

  • Removed: For more information, see Manage Accounts.

  • Added: Zero Trust Access profiles provides distinct access experiences for different users and groups​.

  • Added: You can view, edit, and delete the profiles for private and internet access.

  • Added: Wildcard matching in ZTA profiles does not include exact-domain matchinng; it can represent only one token and cannot represent multiple tokens.

  • Added: When you add a domain like google.com to an allow list, it implicitly allows all subdomains like *.google.com, but if you want to block only a specific subdomain such as news.google.com, you must add the entire FQDN as your DNS steering destination.

  • Added: For users implementing Kerberos authentication with AD, we recommend reviewing the appropriate Microsoft documentation about configuring the correct ports and private resources to plan for for AD communication. to understand how to optimize the location of a domain controller, see this documentation.

  • Added: Be aware of the ZTA limitations when creating a profile.

  • Added: See Limitations and Range Limits for more information.

  • Added: You must be a Full Admin to proceed with this procedure.

  • Added: See Manage Accounts for more information.

  • Added: Zero Trust Access profiles are an ordered list where the order of profiles determines their priority.

  • Added: The last profile in the list is always the Default ZTA Profile.

  • Added: A user’s Zero Trust Access client receives settings from the first matching Zero Trust Access profile in profile order.

  • Added: The profile must match both the user’s membership and the endpoint operating system.

  • Added: Default profile includes all users in the org and all client Zero Trust Access enabled private and internet resources​.

  • Added: Use the following procedure to modify the user's access:

Add a Real Time Rule to the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/add_a_real_time_rule_to_the_data_loss_prevention_policy.html

  • Added: Note: Files encrypted with Digital Rights Management (DRM) or Microsoft Sensitivity Labels cannot be decrypted for deep content inspection or text extraction.

  • Added: Because content cannot be extracted from encrypted files, DLP content and pattern-matching rules cannot be evaluated against the file body.

  • Added: As a result, these files are allowed by default unless explicitly governed by supported metadata or transport-level policies.

Endpoint Data Loss Prevention using Cisco Secure Client

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/edlp-secure-client-intro.html

  • Added: Troubleshoot Endpoint Data Loss Prevention for Linux

  • Added: This concept describes how to locate Endpoint DLP logs and troubleshoot common enrollment errors on Linux devices.

  • Added: Uninstall Cisco Secure Client Endpoint DLP on Linux

  • Added: Use this procedure to uninstall the Cisco Secure Client - Endpoint Data Loss Prevention (DLP) module from your Linux device.

  • Added: This guide provides the specific command-line instructions required to remove the software from both Ubuntu and Enterprise Linux distributions effectively.

Manage Endpoint Data Loss Prevention Using Cisco Secure Client for Windows and Mac

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/edlp-secure-client-intro/c_Manage_EDLP_Using_Cisco_Secure_Client__1.html

  • Removed: Versions: macOS 15, macOS 26

  • Added: Versions: macOS 15, macOS 26, macOS 27

  • Removed: Step 4 - Deployment on user devices

  • Removed: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices for macOS

  • Removed: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices for Linux

  • Added: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices

  • Added: Step 4a - Install the User Certificate and Enrollment Choice File on User Devices for Windows

  • Added: Step 4b - Install the User Certificate and Enrollment Choice File on User Devices for macOS

  • Added: Step 4c - Install the User Certificate and Enrollment Choice File on User Devices for Linux

  • Removed: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices for Windows

  • Added: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices

  • Added: The Endpoint DLP module uses information from the choice file to enroll itself to the Secure Access cloud using the user identity certificate and additional device information.

  • Added: Ensure you store the choice file in a secure location.

  • Added: Step 4a - Install the User Certificate and Enrollment Choice File on User Devices for Windows

  • Removed: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices for macOS

  • Added: Step 4b - Install the User Certificate and Enrollment Choice File on User Devices for macOS

  • Removed: Step 4 - Install the User Certificate and Enrollment Choice File on User Devices for Linux

  • Added: Step 4c - Install the User Certificate and Enrollment Choice File on User Devices for Linux

Cisco Endpoint Diagnostic Tool

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/endpoint-diagnostic-tool-intro/t_client_endpoint_diagnostic_tool.html

  • Removed: Use the Cisco Endpoint Diagnostic Tool (CEDT) to collect diagnostic data from your macOS or Windows endpoint.

  • Removed: This tool helps you troubleshoot issues related to Cisco Secure Access modules.

  • Removed: It gathers system information, application logs, and network diagnostic data relevant only to Cisco Secure Access components.

  • Removed: CEDT automatically detects installed Cisco Secure Access modules on your system, including Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), and Remote Access Virtual Private Network (RAVPN).

  • Removed: This data helps Cisco Technical Assistance Center (TAC) engineers analyze your endpoint connectivity and configuration issues.

  • Added: Use the Cisco Endpoint Diagnostic Tool (CEDT) to collect diagnostic data from macOS or Windows endpoints and troubleshoot Cisco Secure Access modules.

  • Added: CEDT provides these capabilities:

  • Added: System scanning: Detects installed Cisco Secure Access modules.

  • Added: Application logs: Collects diagnostic logs generated by client software and the service infrastructure.

  • Added: System data: Securely collects and encrypts system data related only to Cisco Secure Access diagnostics.

  • Added: Network diagnostics: Collects network diagnostic data relevant to Cisco Secure Access components.

  • Added: CEDT packages the collected data into a diagnostic archive that you can save locally or upload directly to a Cisco TAC support case.

  • Added: The tool does not capture personal data.

  • Added: CEDT automatically detects installed Cisco Secure Access modules and displays each module with its version number.

  • Added: The detected components can include Zero Trust Access (ZTNA), Secure Web Gateway (SWG), Remote Access VPN (RAVPN), and Common System Information.

  • Added: Install Google Chrome if you plan to run HAR capture.

  • Added: CEDT does not currently support HAR capture inFirefox or Safari.

  • Added: System Data Collected

  • Added: The tool collects this system data, organized by category.

  • Added: No personal data of any kind is captured.

  • Added: General System Information

  • Added: Data

  • Added: macOS

  • Added: Windows

  • Added: OS, hardware, CPU, RAM, storage

  • Added: system_profiler SPSoftwareDataType SPHardwareDataType

  • Added: systeminfo, WMI classes(Win32_OperatingSystem,Win32_ComputerSystem,Win32_BIOS)

  • Added: Kernel parameters

  • Added: sysctl-a

  • Added: N/A

  • Added: Network Configuration

  • Added: Data

  • Added: macOS

  • Added: Windows

  • Added: Network interfaces & IP addresses

  • Added: ifconfig-a

  • Added: ipconfig/all

  • Added: Routing table

  • Added: netstat--rn

  • Added: netsat-rn

  • Added: DNS configuration

  • Added: scutil--dns

  • Added: (include in ipconfig/all)

  • Added: Network services

  • Added: networksetup-listallnetworkservices

  • Added: netsh interface show interface

  • Added: WiFi profiles

  • Added: N/A

  • Added: netsh wlan show profiles

  • Added: Product Information

  • Added: Data

  • Added: macOS

  • Added: Windows

  • Added: Cisco preferences/config files

  • Added: /Library/Preferences/com.cisco*

  • Added: Registry exports (HKLM\SOFTWARE\Cisco, HKCU\SOFTWARE\Cisco, acsock service)

  • Added: Installation directions

  • Added: 1s-1as/opt/cisco

  • Added: %ProgramFiles%\Cisco,%ProgramFiles(x86)%\Cisco%ProgramData%\Cisco

  • Added: Running Cisco processes

  • Added: ps aux \|grep -i cisco

  • Added: tasklist\|findstr/icisco, WMI Win32_Process

  • Added: Installed Cisco products

  • Added: mdfind for Cisco apps

  • Added: WMI Win32_Product(Vendor Cisco)

  • Added: Application logs

  • Added: Cisco Secure Client log directories

  • Added: %ProgramData%\Cisco\Cisco Secure Client\Logs

  • Added: Event logs

  • Added: N/A

  • Added: Windows Event Log (Cisco Secure Client - Zero Trust Access, Application provider *Cisco*)

  • Added: Crash reports

  • Added: ~/Library/Logs/DignosticReports/Cisco*

  • Added: N/A

  • Removed: The welcome screen scans the system and lists installed Cisco Secure Access modules, such as Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), and Remote Access Virtual Private Network (RAVPN).

  • Removed: The Common System Information checkbox is enabled by default.

  • Added: On the welcome screen, review the detected modules and their version numbers.

  • Added: CEDT can display Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA), Remote Access Virtual Private Network (RAVPN) and Common System Information.

  • Added: Select or deselect the modules that you want to diagnose, and then click Let’s Start.

  • Added: On the Diagnostic Data Collection screen, select the connectivity tests to run.

  • Added: DNS Lookup—Tests DNS resolution for specified hosts.

  • Added: You can specify custom resolver IP addresses.CEDT saves the consolidated results in dns/dns_lookups.txt.

  • Added: Packet Capture — Captures network packets for a specified duration.

  • Added: This test requires administratorprivileges.

  • Added: Ping Hosts—Pings specified hosts to verify connectivity.

  • Added: Policy Test Output—Tests policy enforcement for up to 10 specified URLs throughpolicy.test.sse.cisco.com.

  • Added: The results include structured policy output and automatically captured HARdata.

  • Added: Network Speed Test—Measures download speed, upload speed, latency, and jitter throughspeed.test.sse.cisco.com.

  • Added: CEDT saves the results in JSON and text-summary formats.

  • Added: URL Reachability—Uses HTTP GET requests to test up to 20 URLs, with a 30-second timeout for eachURL.

  • Added: The results include reachability, HTTP status, response time, content length, resolved IP address,TLS version, and timestamp.

  • Added: Select the data-collection and debugging options to include.

  • Added: HAR Capture—Records browser-session network data.

  • Added: CEDT currently supports Google Chrome only.

  • Added: DART Bundle Collection—Collects a DART bundle from Cisco Secure Client, including logs from allinstalled modules.

  • Added: Reserved IP—Runs reserved-IP traceroute or tracert and DNS diagnostics.

  • Added: Enable Debug Flags—Collects detailed endpoint-activity logs.

  • Added: This option is available only when at leastone detected Cisco Secure Access product is selected.

  • Added: DebugView Capture—Enables debug logging for the Windows Secure Endpoint Connector.

  • Added: This optionis available only on Windows.

  • Removed: Configure the settings displayed on the screen as required for the selected diagnostic tests.

  • Removed: Example: If you selected DNS Lookup, enter the DNS Lookup Settings, such as Hosts to look up and Resolver IPs (optional).

  • Added: Configure the settings for each selected test.

  • Added: CEDT displays settings only for the tests that you selected.

  • Added: For DNS Lookup, enter one or more hostnames and, optionally, custom resolver IP addresses.

  • Added: For Packet Capture, select the interfaces, packet count, and capture duration.

  • Added: For Ping Hosts, enter one or more hosts.

  • Added: For URL Reachability, enter the URLs to test.

  • Added: HTTP uses port 80 and HTTPS uses port 443 by default.Include the port in the URL when you use a nonstandard port.

  • Added: For Policy Test Output, enter up to 10 host URLs.

  • Added: For HAR Capture, enter the target URLs and ensure that Google Chrome is installed.

  • Added: Configure any selected KDF, reserved-IP, performance, certificate-store, or debug-page-load settings.

  • Removed: If you selected network diagnostic options such as Packet capture or Debug flags, the Diagnostics Paused window appears.

  • Removed: This pause allows you to trigger the issue while detailed logging is active, ensuring the support team receives comprehensive data for effective troubleshooting.

  • Added: If CEDT pauses during advanced troubleshooting, reproduce the issue while detailed logging is active.

  • Added: Donot close CEDT while the diagnostic run is paused.

  • Added: Click Continue after you reproduce the issue.

  • Added: Reconnect to the VPN.

  • Added: Open the internal application that is failing.

  • Added: Repeat the steps that cause the error.

  • Removed: Click Continue to collect the diagnostic files and turn logging back to normal.

  • Removed: Enter the Case ID and Token, and then click Upload to send the diagnostic archive to your Cisco Technical Assistance Center (TAC) case.

  • Added: Wait for all selected diagnostic tasks to complete.

  • Added: The progress bar displays the overall status.

  • Added: Do not close CEDT while diagnostics are running.

  • Added: When the run completes, review the archive filename, file size, and SHA-256 checksum.

  • Added: To upload the archive directly, enter the Cisco TACCase ID and Token, and then click Upload to send the diagnostic archive to your Cisco Technical Assistance Center (TAC) case.

  • Added: To retain the archive without uploading it, click Skip.

  • Added: After a successful upload, click Run Again to start another diagnostic run or click Close to exit CEDT.

Network Connectivity Log

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/network-connectivity-log-intro/network_connectivity_log.html

  • Removed: The exported CSV file of Network Connectivity Logs includes the following columns: Network Tunnel Group, Data Center, IP Address, Hub Type, Region, Severity, Service, Device Type, Details, and Time (UTC).

  • Removed: Use filters to refine results and help identify security.

  • Added: The exported CSV file of Network Connectivity Log includes the following columns: Network Tunnel Group, Data Center, IP Address, Hub Type, Region, Severity, Service, Device Type, Details, and Time (UTC).

  • Added: Use filters to refine results and identify connectivity or configuration issues.

  • Removed: Any filters applied in the Network Connectivity Logs view, such as network tunnel group, event details, or identities, are reflected in the scheduled report, ensuring only relevant data is included.

  • Added: Any filters applied in the Network Connectivity Log view, such as network tunnel group, event details, or identities, are reflected in the scheduled report, ensuring only relevant data is included.

Added Pages