Read about the system-provided Access polivy that comes with every Secure access organization. This one policy contains all of the rules and guidliens on how traffic is handled; read about priority, rule organization, and settings that are applied across the tenant.
The Cisco Secure Access policy is the collection of your internet and private access rules, rule defaults, and global settings. The policy displays your configured rule data and allows you to choose how to prioritize the rules in your policy. Once you add a rule, you can edit various components on the rule. You decide how to view and manage your rules that best meets your organization's access controls to resources. For more information, please see the sections below.
Policy Precedence
You can design any number of access policies to protect your identities and manage access to destinations. When you create a policy, you choose which identities to add to a certain policy. Then, you order the policy listing the highest priority policy first. Secure Access evaluates your policies to match an identity and destination using the order which you set. If a match is not found, Secure Access applies to the Default “For all internet Rules” policy for internet access rules. “For Private access rules” the default rule is set to block
Several Umbrella identities integrate with Active Directory (AD). Within the highest ranked access policy, Secure Access first checks for a matching AD user identity. If a match is not found, then Secure Access continues to check for a matching identity and destination. Secure Access considers the AD identities higher priority within a list of identities.
Secure Access checks for known identities in this order:
-
Active Directory (AD) user — AD integration provided by a Virtual Appliance or Roaming Client.
-
Active Directory (AD) computer — AD integration provided by a Virtual Appliance.
-
Internal Network (Site) — AD integration provided by a Virtual Appliance.
-
Umbrella Site — Virtual Appliance with no other identity deployed.
-
Roaming Client — Roaming Client.
-
Network — Uses source IP of the DNS request.
Default Access Rules in your Policy
If your traffic does not match any of the rules in your policy, Secure Access applies the settings on the Default Access rules. For more information, see Edit the Default Access Rules.
Rule Defaults and Global Settings
-
For more information, see Global Settings for Access Rules.
-
For more information, see Rule Defaults: Default Settings for Access Rules.