Get Started With Private Access Rules

Private access rules control and secure access to internal resources and applications that are private and should not be accessed by the general public.

Traffic to private destinations is blocked by default. You must create rules to allow traffic to private destinations.

1. Plan your private access rules

   Plan your rules so that you get the results you expect. For example, factors such as rule order impact traffic handling.

2. Create rule components.

   Assemble rules largely from components, including but not limited to source, destination, endpoint posture, and security control components. See Components for Private Access Rules for more information.

3. Specify rule defaults.

   New rules will use the default security controls and other settings that you specify on the Rule Defaults page. See Default Settings for Private Access Rules for more information.

4. Add private access rules

   Generally, you will create rules to allow access to private resources. See Add a Private Access Rule for more information.

5. Configure logging for the default private access rule

   Traffic to private destinations that does not match any other private access rule in the policy will be handled by the default private access rule. Traffic that matches this rule is blocked. For more information, see View or Edit the Default Access Rules for more information.

6. Edit the global settings

   See Global Settings for Private Access Rules for more information.

7. Review the rule order

   Make sure the order of the rules on the Policy page will have the results you expect. See Edit the Order of the Rules on the Policy Page for more information.

8. Distribute dummy access URLs to end users

   For rules allowing access to private resources using browser-based connections, distribute the remotely accessible dummy URL to the users who will use it to connect to the resource. You configure a URL for each resource when configuring the resource. For more information, see Add a Private Resource for more information.

You can choose default settings that will automatically populate newly created access rules by default.

Configure these settings on the Rule Defaults page: Navigate to Secure > Access Policy, click Global Settings and Rule Defaults, then click the Rule Defaults tab.

The following settings apply to private access rules:

• Zero Trust Connection Endpoint Posture Profiles - Posture profiles specify end-user device requirements when connecting to private resources using zero-trust access. Specify default requirements for connections from devices on which the Cisco Secure Client is installed and from devices on which the client is not installed.

  When choosing default posture profiles, keep in mind that if endpoints do not meet the requirements specified in the profile selected in a rule, the rule will not match the traffic. For more information about these posture profiles, see Manage Zero Trust Access Posture Profiles.

• Zero Trust Access: User Authentication Interval - Specify the frequency with which end user must sign in to the network, in order to connect to any private resource using client-based zero trust access. When disabled, users are not prompted to re-authenticate to the network. For details, see Network Authentication for Zero Trust Access.

• Intrusion Prevention (IPS) Profile - Specify the traffic-inspection behavior to use by default in new access rules.

  This setting applies to both private access rules and internet access rules. For more information about IPS Profiles, see Manage IPS Profiles.

• Security Profile - Specify default file inspection and file type blocking behavior for private traffic by choosing the default security profile for private access. You may need to create this profile before you can select it. For more information, see Security Profiles for Private Access.

The other settings on the Rule Defaults page apply only to internet access rules.

To edit default settings, see See Edit Rule Defaults and Global Settings.

Choose rule defaults carefully; changing these settings later may impact existing rules. See Important Information About Changing Rule Defaults.

Global settings generally apply to all rules. However, some settings apply only to internet access rules, not to private access rules.

The following global settings apply to private access rules:

• Decryption - Intrusion prevention, file inspection, and file type blocking require decryption in order to be effective. For troubleshooting purposes, you can temporarily disable decryption for all access rules. This setting applies to both private access rules and internet access rules, but the functionality to which it applies is different in each case.

• Decryption Logging - Determine whether to enable or disable logging of decryption events for private access rules.

For more information about these settings, see Global Settings for Access Rules.

To change default rule settings, see Edit Rule Defaults and Global Settings.

You can create access rules by adding rule components that you or others have configured to a rule. Components described in this topic are reusable. You can use the same component (such as a source) in multiple rules, speeding and simplifying rule creation. For example, you can define a set of users as a source, then use the same source in an internet access rule and in a private access rule for the same set of users. Some components are profiles, or groups of settings bundled together that you choose as a unit when configuring a rule.

Sources on private access rules are either pre-configured or composite components. Pre-configured source components such as Registered Networks and Network Tunnel Groups acquire and manage the web traffic in your organization.

Composite sources may include IP addresses, CIDR blocks, and wildcard masks, and ports and port ranges.

If you see an option to Select All, this selects all existing items in the group at the time you select it, but the rule will not include items added to the group in the future.

You can configure private access rules for specific source-destination pairs. Sources are the users, groups of users, and other entities that comprise the From end of traffic where Secure Access applies an access rule.

In a rule, you can also specify sources by typing in IP addresses and subnets, and ports and port ranges, but these network entities are not reusable source components. For more information, see Composite Sources for Private Access Rules

You can use these reusable sources in your private access rules:

• Users

  You can apply rules to the traffic for the users in the organization.

• Groups

  You can apply rules to the traffic for the groups of users in the organization.

• Endpoint Devices

  You can apply security controls on private access rules to any endpoint device in Secure Access. Endpoint devices in Secure Access include the following:

  • Any user device provisioned from an on-premise Active Directory (AD) domain controller (DC) integrated with Secure Access.

  • Any user device that has enrolled with Zero Trust Access on the Cisco Secure Client.

  • Be aware that rule-level security features (Intrusion Prevention (IPS) or Security Profile) are not compatible with access rules that have ZTA-enrolled devices as a source. We do not recommend configuring access rules with this combination.

  • Once enrolled or provisioned, user devices are available as sources in private access rules. You can select all endpoint devices in the organization, any AD device, any ZTA enrolled device, ZTA enrolled devices with specific host operating systems (macOS, Windows, iOS, or Android), or individual endpoint devices identified by device name.

  For information about the Cisco Secure Client and enrolling in Zero Trust Access, see Manage Zero Trust Access using Cisco Secure Client on Windows and macOS Devices.

  For information about AD device provisioning, see Manage Users, Groups, and Endpoints Devices.

• Security Group Tags

  You can apply rules to traffic originating from IP addresses in network segments that include Security Group Tags. Note that RA-VPNs do not receive SGT mappings directly through RADIUS.

  If you integrated Secure Access with ISE, you can use SGTs configured in the ISE application as a source in a access rule.

• Network Tunnel Groups

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Tunnel Groups.

  When you select Network Tunnel Groups, Secure Access secures and controls traffic from IPsec tunnels established by your supported network devices. If you need to know what tunnels are included in a group, navigate to Connect > Network Connections > Network Tunnel Groups and look at the group configuration.

• Network Objects

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Objects.

• Network Object Groups

  You can apply rules to the traffic originating from IP addresses in network segments defined by Network Objects in Network Object Groups.

If a private access rule includes multiple sources, Secure Access combines all types of sources and all sources within a type using the boolean OR operator. Traffic to each source that you specify in a rule matches the rule. For example, if you specify a user group and a network tunnel group as sources, traffic from any member of either group matches the rule.

You can define a source using multiple network address components. A composite source accepts IP addresses, CIDR blocks, and wildcard masks directly in a private access rule.

Note

If you will allow access from a branch network, and you specify users or user groups, you must also configure SAML authentication for those users.

<IP address One> OR <CIDR block ONE> OR <IP address Three>

Destinations on private access rules are either pre-configured or composite components. For information about pre-configured destination components, see Reusable Destinations in Private Access Rules.

Composite destinations may include IP addresses, CIDR blocks, wildcard masks, fully-qualified domain names (FQDNs), ports and port ranges, and transport protocols. For information about composite destination components, see Composite Destinations in Private Access Rules.

You can configure private access rules in the Access policy for specific source-destination pairs. Destinations are the private applications, application categories, or other private destinations that comprise the "To" end of traffic where Secure Access applies an access rule.

In an access rule, you can also enter destination IP addresses and subnets, and ports and protocols. For more information, see Composite Destinations in Private Access Rules

You can use these reusable destinations in your private access rules:

You can define a destination using multiple network address components. All destinations allow connections from authenticated users on the network, including branch networks.

Composite destinations are useful if you need to quickly address a specific issue that arises, for example to immediately allow access to a destination that is being blocked by another rule, or to immediately block access to a problem destination.

Zero-trust connections are not available for destinations that are not configured as private resources.

Private access rules with composite destinations only support the Allow and Block actions.

These security controls do not apply to traffic for destinations added directly into a rule:

• Endpoint posture requirements

• Intrusion prevention (IPS)

If destinations include both configured private resources or groups and destinations typed directly into a rule, security controls are applied only to the configured private resources or groups.

If a private access rule includes multiple destinations, the following boolean logic applies:

• Secure Access combines all types of destinations and all destinations within a type using the boolean OR operator. Traffic to each destination that you specify in a rule matches the rule. For example, if you specify a content category and an application list as destinations in a single rule, traffic to any destination that is a member of either group will match the rule.

• If you specify ANY for the protocol, then all traffic on the protocols (TCP, UDP, ICMP) supported by the private access rule matches the rule, regardless of any other destinations that you specify.

You can require endpoints to meet requirements such as operating system version, firewall, and disk encryption before connecting to a network or resource. _These requirements are rule-matching criteria that determine whether a rule matches the traffic. _

Endpoint requirements are defined in posture profiles. There are several types of posture profile, depending on the type of connection and characteristics of the end-user device:

• Client-based zero-trust posture profiles: For end-user devices on which the Cisco Secure Client is installed

• Browser-based zero-trust posture profiles: For end-user devices on which the Cisco Secure Client is NOT installed

• VPN posture profiles: For end-user devices that are connected to the network using remote access VPN.

When you configure a private resource, you will specify which of the above types of connections are allowed for that resource.

When you create a private access rule, you will specify a posture profile with device requirements for each type of connection allowed by the private resources specified as destinations in the rule.

You can create different posture profiles, each with a different set of requirements, then choose appropriate profiles for each rule.

You can specify default posture profiles for zero-trust access connections (client-based and browser-based.) Create a profile with the desired default endpoint requirements for each connection type, then specify the default profiles on the Rule Defaults page. See Rule Defaults and Edit Rule Defaults and Global Settings.

Posture profile options apply only to User and User Group sources.

VPN posture is evaluated when the user connects to the network, which occurs before access rules evaluate the traffic.

Endpoint posture is not evaluated for branch connections.

See Manage Endpoint Security.

Private access rules have (and need) less varied security controls than internet access rules.

Intrusion Prevention protects your network and assets by inspecting traffic for specified threat characteristics. Threat signatures are collected into collections called IPS Profiles.

When you configure an access rule, you can choose a predefined IPS profile such as Balanced Security and Connectivity or Maximum Security, or create a custom profile using Snort signatures that you choose. You can also choose whether to block or just monitor traffic that matches an IPS profile.

You can specify a default IPS profile on the Rule Defaults page that is automatically selected in each new rule. Default settings apply to both private access rules and internet access rules. See Rule Defaults and See Edit Rule Defaults and Global Settings.

See Manage IPS Profiles.

Prevent upload and download of malicious files or file types such as executables in traffic to private resources by configuring at least one security profile for private access and selecting that profile in private access rules.

See Security Profiles for Private Access.

Important note about traffic handling

If endpoints do not meet the requirements specified in posture profiles, traffic is handled differently for zero trust connections and VPN connections:

• For zero trust connections, if endpoints do not meet the requirements in the posture profile specified in a private access rule, the rule will not match the traffic.

  If no other rule matches the traffic, Secure Access applies the default private access rule, which will block the traffic. The default private access rule appears at the bottom of the list of rules on the Access Policy listing page.

• For VPN connections, posture is evaluated at the time the device connects to the network. If endpoints do not meet the requirements specified in the VPN posture profile, the device cannot connect to the network.

For more information about posture profiles, see Manage Endpoint Security.