Internet Access Rules

Global settings generally apply to all rules. However, some settings apply only to private access rules, not to internet access rules.

Do not change global settings unless you have a specific reason to do so.

If your company uses either of the following, verify that the applicable global settings are correct for your company:

• Microsoft 365 applications

• Applications that use pinned certificates

Decryption-related settings:

• Decryption—For troubleshooting purposes, you can temporarily disable decryption for the specified features, for all private and internet access rules.

• Disable decryption for specific sources—Use this setting to disable decryption from sources on which certificates cannot be installed, such as IOT "internet of things" devices, that need to connect to the internet.

• Decryption Logging—Choose whether to enable or disable logging of decryption events for internet access rules.

For more information about these settings, see Global Settings for Access Rules.

To change default rule settings, see Edit Rule Defaults and Global Settings.

Cisco Secure Access supports configuring security controls for sources and destinations (resources) on internet access rules in the organization's Access policy. You can create access rules by adding components that you or others have previously created or entering network information directly on a rule for sources and destinations. Pre-configured components described in this topic are reusable. You can use the same pre-configured components in multiple access rules.

Before you can add resources in Secure Access, deploy the resources in the organization's environments. Also configure resources for destinations in Secure Access: content categories, destination lists, and application lists. Once you register the resources in Secure Access, you can select these components on the internet access rules.

For example, you can define a set of users as a source, then use the same source in an internet access rule and in a private access rule for the same set of users. Some components are profiles, or groups of settings bundled together that you choose as a unit when configuring a rule.

Sources on internet rules are either pre-configured or composite components. Pre-configured source components such as Registered Networks and Network Tunnel Groups acquire and manage the web traffic in your organization. For information about pre-configured source components, see Reusable Sources in Internet Access Rules.

Composite sources may include IP addresses, CIDR blocks, and wildcard masks, and ports and port ranges. For information about composite source components, see Composite Sources in Internet Access Rules.

You can configure internet access rules for specific source-destination pairs. Sources are the users, groups of users, or other entities that comprise the From end of traffic where Secure Access applies an access rule.

In a rule, you can also specify sources by typing in IP addresses and subnets, but these are not reusable source components. For more information, see Composite Sources in Internet Access Rules

You can use these reusable sources in your internet access rules:

• Users

  You can apply rules to the traffic for the users in the organization.

• Groups and Organizational Units

  You can apply rules to the traffic for users in AD Groups and Google Workspace Organizational Units.

• Roaming Devices

  You can apply rules to traffic originating from managed devices that have the Cisco Secure Client installed, but that may not currently be on the corporate network.

• Network Objects

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Objects.

• Network Object Groups

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Objects in Network Object Groups.

• Endpoint Devices

  You can apply internet access rule security controls to AD devices in Secure Access. Once provisioned, AD devices are available as sources on internet access rules. You can select all AD devices or individual AD devices identified by device name. For more information about AD device provisioning, see Manage Users, Groups, and Endpoints Devices.

• Registered Networks

  You can apply rules to traffic originating from IP addresses in network segments defined by Registered Networks.

  • When on a Registered Network, users devices can send traffic to the Secure Access DNS resolvers and the Secure Web Gateway (SWG) directly. In this scenario, user devices are not required to deploy the Cisco Secure Client with the Internet Security and VPN modules or deploy IPsec tunnels (RAVPN).

  • If the user device has the Cisco Secure Client deployed with the Internet Security and VPN modules, then traffic is sent over IPsec tunnels to Secure Access.

• Sites

  You can apply rules to traffic originating from IP addresses in network segments defined by Secure Access Sites.

• Network Devices

  You can apply rules to traffic originating from network devices.

• Security Group Tags

  You can apply rules to traffic originating from IP addresses in network segments that include Security Group Tags.

• Catalyst SD-WAN Service VPN IDs

  You can apply rules to traffic originating from IP addresses in network segments that include VPN IDs. Be aware that if the same VPN ID (VPN 88 for example) is assigned across different branches, then traffic coming into Secure Access from these branches is subject to the same policy. A Secure Access policy rule cannot differentiate traffic between branches using the same VPN ID.

• Network Tunnel Groups

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Tunnel Groups.

If an internet access rule includes multiple reusable sources, Secure Access applies the sources together using boolean logic.

Secure Access combines all types of reusable sources and all sources within a type using the boolean OR operator. Traffic to each source that you specify in the access rule matches the rule.

For example, if you specify a user group and a network tunnel group as sources, traffic from any member of either group matches the rule.

Organizations can add network address information directly in the source component of an internet access rule. The source component supports IP addresses (IPv4 and IPv6), CIDR blocks, and wildcard masks, and ports and port ranges. For more information, see Add an Internet Access Rule.

Note

Internet access rules that include composite sources support the Allow and Block actions only.

Combining Source Addresses and Ports

Combining IPs, CIDRs, or Wildcard Masks on a Source

When you add the IP addresses and CIDR blocks for a source on an internet access rule, Secure Access creates a single source entry. Secure Access uses the OR operator to combine the IP addresses, CIDR blocks, and wildcard masks that you entered on the rule.

Combining Ports and Port Ranges on a Source

When you add the ports and port ranges for a source on an internet access rule, Secure Access creates a single source entry. Secure Access uses the OR operator to combine the ports and port ranges that you entered on the rule.

Combining IP Addresses and CIDR Blocks With Ports on a Source

Secure Access uses the AND operator to combine the IP addresses and CIDR blocks with the ports and port ranges entered on the source component of the internet access rule.

Destinations on internet rules are either pre-configured or composite components. For information about pre-configured destination components, see Reusable Destinations in Internet Access Rules.

Composite destinations may include IP addresses, CIDR blocks, wildcard masks, fully-qualified domain names (FQDNs), ports and port ranges, and transport protocols. For information about composite destination components, see Composite Destinations in Internet Access Rules.

You can configure internet access rules in the Access policy for specific source-destination pairs. Destinations are the web applications, web sites in particular categories, or other internet destinations that comprise the "To" end of traffic where Secure Access applies an access rule.

In an access rule, you can also enter destination IP addresses and subnets, and ports and protocols directly on the rule. For more information, see Composite Destinations in Internet Access Rules.

You can use these reusable destinations in your internet access rules:

• Destination Lists—Lists that group domains, URLs, IP addresses, and CIDR blocks where you want to apply the same security controls. You can create custom lists of destinations based on any criteria you choose.

• Application Lists—Lists of web-based applications where you want to apply the same policy.

  For example, if you want to apply a single policy to all social media applications, you can create an application list that includes all applications in the Social Networking category.

  For some web-based applications, you can allow access to the application, but block uploads, downloads, and posting or sharing information. You will see these options in each rule when you configure applicable destinations in the rule. For details, see Advanced Application Controls.

• Application Protocols—Select the application protocols for the network destinations where Secure Access applies the rule.

• Content Category Lists—Lists of web sites based on the content or type of the site, so you can control access to a variety of sites as a group. For example, you might create a content category list that includes all sites belonging to the Adult, Child abuse, and Pornography categories.

• Network Objects—Network Objects represent IPv4 and IPv6 addresses, CIDR blocks, ranges of IPv4 addresses, wildcard masks, or fully-qualified domain names (FQDNs). Select the Network Objects on the access rules to apply security controls to the traffic on the networks.

• Network Object Groups—Select the Network Object Groups on the access rules to apply security controls to the traffic on the networks in groups.

• Service Objects—Service Objects represent a port, range of ports, protocol, or traffic on any protocols. Select the Service Objects on the access rules to apply security controls to the services.

• Service Object Groups—Select the Service Object Groups on the access rules to apply security controls to the traffic on the services in groups.

You can define a destination from multiple network address components. A composite destination accepts IP addresses, CIDR blocks, wildcard masks, ports 80 and 443 for web traffic or all ports on non-web traffic, and the TCP, UDP, and ICMP transport protocols. You can choose ANY to select all available protocols on a destination. For more information, see Add an Internet Access Rule.

This option is useful if you need to quickly address a specific issue that arises, for example to immediately allow access to a necessary destination that is being blocked by another rule, or to immediately block access to a problem destination.

If an internet access rule includes multiple destinations, the following boolean logic applies:

• All types of destinations, and all destinations within a type, are treated as using the boolean OR operator. Traffic to each destination that you specify in a rule matches the rule.

  • For example, if you specify a content category and an application list as destinations in a single rule, traffic to any destination that is a member of either group will match the rule.

• If you specify ANY for the protocol, then all traffic on the protocols (TCP, UDP, ICMP) supported by internet rules matches the rule, regardless of any other destinations that you specify.

• If you enter in values of different types (IP address, port, protocol), traffic matches if any of the specified values match the rule.

  • For example, if you specify an IP address and a port, traffic to any IP address on the specified port matches the rule, as does traffic to the specified address on any port.

Security controls make use of profiles and other pre-configured settings.

These security controls apply to internet traffic:

• Intrusion Prevention (IPS)

• Security Profile

• Tenant Controls

Intrusion Prevention protects your network and assets by inspecting traffic for specified threat characteristics.

You will specify a single intrusion prevention profile in each access rule.

You can specify a single Security Profile in an internet access rule. Each security profile includes multiple components that you should pre-configure.

Sets of security security settings grouped into profiles control aspects of security for internet traffic.

Enable these options in a security profile and then choose the security profile in an access rule. For more information, see Add a Security Profile for Internet Access.

• For Decryption (including Do Not Decrypt lists), see Set Up Certificates for Decrypting Internet Traffic and Configure Do Not Decrypt Lists.

• SSO Authentication. For more information, see Security Profiles for Internet Access.

  SSO authentication is required for some web security features.

• Threat Categories. For more information, see Threat Categories.

  Choose the types of web-borne threats to block. Blocking some threat categories may affect legitimate traffic.

• For File inspection, see Manage File Inspection and File Analysis.

  File inspection detects threats using Cisco Advanced Malware Protection and Cisco Secure Malware Analytics.

• For File type blocking, see Manage File Type Control.

  Block files based on their type. For example, you can prevent users from downloading executable files from the web.

• For SafeSearch, see SafeSearch.

  SafeSearch filters out offensive, explicit, unsafe, and harmful results from searches in Google, YouTube, Yahoo, and Bing.

• For AI Supply Chain Blocking, see AI Supply Chain Report.

  AI Supply Chain Blocking controls end user access to files that can pose AI supply chain risk to security and compliance.

• For End-user notifications, see Manage Notification Pages.

  If you do not want to use the default Secure Access-branded notifications, configure the notifications that are:

  • presented to end users who attempt to access internet destinations that are blocked

  • present when users attempt to access destinations that match a rule configured with the Warn action

  End-user notifications require decryption.

  Web pages shown to users who attempt to access blocked destinations or destinations allowed with a warning.

If you have already set up certificates for this purpose for the intrusion prevention feature, you may not need to do anything more.

Internet traffic must be decrypted in order to allow it to be inspected by the intrusion prevention and web security features, to apply acceptable use controls, for rules in which the rule action is Isolate or Warn, and to display end-user notifications when destinations are blocked.

In order to decrypt this traffic, certificates are required.

See Certificates for Internet Decryption.

Secure Access must decrypt internet traffic in order to allow Web Security features to protect your network effectively.

However, decrypting traffic to certain sites, such as health-related or financial sites, may be restricted by confidentiality law in certain geographic regions.

Use a Do Not Decrypt List to specify destinations that should not be decrypted by web security processes. You can create different Do Not Decrypt Lists for different regions or purposes.

You can use the same Do Not Decrypt List that you use for IPS, or create one or more Do Not Decrypt lists to use only for security features included in the security profile.

For details, see Important Information About Do Not Decrypt Lists.

If your company uses Microsoft 365, Slack, Google G-Suite, or Dropbox, see Manage Tenant Control Profiles.

This section includes options to skip enforcement of certain security features, which you may want to do permanently for trusted destinations or temporarily to troubleshoot an issue.

This section includes the ability to access files without decrypting them (sometimes known as "protected file bypass") and the ability to not enforce certain web security features for this rule.

In general, you should allow access to encrypted files only for trusted destinations, because encrypted files cannot be effectively assessed for threats. By default, access to encrypted files is not enabled.

Disable security features only when you have a specific reason to do so.

For more information, see Manage Advanced Security Controls .

To ensure specific egress IP addresses for traffic to specific SaaS internet destinations outside your network, such as YourCompany.OtherCompany.com, see Zero Trust Access to Internet Destinations.

In order to ensure that internet rules match encrypted traffic as expected, you must add an extra rule to decrypt the traffic. Essentially, traffic cannot be inspected until after it is decrypted, and cannot match a rule until it can be inspected, and a single rule cannot both decrypt and inspect a transaction.

This situation is best explained using the following example scenario.

Scenario

A Network ("Network1") source makes a web request to URL https://www.mydomain.com/myurl.

Rule does not match the traffic:

Top rule: Source: Any. Destination: https://www.mydomain.com/myurl. Decryption is enabled.

2nd Rule: Source Any. Destination: Any. Decryption is disabled.

Result: The 2nd rule will apply.

Explanation: The top rule specifies a destination that can only be identified if decryption has occurred for the request. However, because the only place decryption is enabled is in that same rule, that rule will never be matched and therefore decryption will not occur.

Rule matches the traffic:

Top rule: Source: Any. Destination: https://www.mydomain.com/myurl. Decryption can be enabled or disabled.

2nd Rule: Source Any. Destination: Any. Decryption is enabled.

Result: The top rule will apply.

Explanation: The 2nd rule triggers decryption, giving Secure Access visibility to the URL being requested, but does not match the rule. The rules are then re-run, top down, with the URL information. This results in matching the top rule.

To prevent users from accessing web sites hosted in certain countries, you can specify a geolocation destination on an internet access rule. This option is available only when the rule action is Block and the rule includes no destinations other than geolocations. Secure Access logs all traffic that is blocked based on configured geolocation.

The location of a site is determined by its public IP address.

Note

Blocked Internet Access

Traffic to a blocked destination may be allowed if a domain resolves to multiple IP addresses corresponding to different countries.

To block access by site location:

1. Create an internet access rule.

2. (Recommended) Position geolocation rules at the top of the rule list and place any exceptions above the general geolocation rules.

3. Choose Block as the rule action.

4. Choose Geolocations as the Destination.

5. Select continents and countries as applicable.

6. In the security controls section, choose a security profile in which decryption is enabled. You can also specify in this profile a notification page that will be displayed to end users who attempt to access destinations blocked by this rule.