Activation - DUO/Zero Trust - Secure Internet Access – Cisco Activation as a Service

Onboarding Implement Use Engage Adopt

Onboarding

Steps:

Step 1: Learn about Cisco Secure Access
- Task 1: View the Secure Access page on Cisco.com
- Link
- Task 2: Register for a virtual event, available on Cisco Community
- Link
Step 2: Get started with Cisco Secure Access
- Task 3: Log in to the Cisco Secure Access dashboard
- Log in
- Task 4: Determine your current licensing package
- Link
- Task 5: Define additional users and their roles
- Link

Implement

Steps

Step 1: Configure infrastructure
- Task 1: Provision users and groups
- Link
Step 2: Configure connectivity to Secure Access
- Task 2: Deploy Secure Client with roaming module
- Link
- Task 3: Deploy VPN module
- Link
- Task 4: Configure proxy auto-config (PAC) for initial set of users
- Link
- Task 5: Configure Internet Protocol Security (IPSEC) tunnel from a branch to Cisco Secure Access
- Link
Step 3: Deploy Cisco Secure Access Root Certificate Authority Rollout
- Task 6: Download Cisco Secure Access root certificate and deploy to end user devices
- Link
Step 4: Configure Device Network Servers (DNS) policy and traffic redirection to Secure Access
- Task 7: Register your public network to Cisco Secure Access
- Link
- Task 8: Configure Device Network Servers (DNS) servers to point to Cisco Secure Access (Umbrella) DNS Servers (Client setting, network device settings, DHCP settings)
- Link
- Task 9: Browse activity report in Cisco Secure Access dashboard and validate DNS traffic is coming to Cisco Secure Access
- Link
Step 5: Configure default web profile
- Task 10: Enable the default profile and enable/disable Security Assertion Markup Language (SAML) authentication
- Link
- Task 11: Confirm threat categories
- Link
- Task 12: Enable or disable File Inspection
- Link
- Task 13: Enable or disable File Type Blocking
- Manage File Type
- Enable File Type
- Task 14: Enable or disable SafeSearch
- Link
- Task 15: Customize notification pages
- Link
Step 6: Configure default Intrusion Prevention System (IPS) profile
- Task 16: Configure the default IPS profile for internet access
- Manage IPS Profiles
- View Settings
Step 7: Configure default VPN profile
- Task 17: Configure authentication, client posture, and traffic steering for VPN
- Manage VPNs
- Manage VPN Posture Profiles
Step 8: Create destination lists
- Task 18: Create initial Destination Lists based on domains and URLs
- Link
Step 9: Configure default internet access rules
- Task 19: Configure rule actions, sources for the rules, destinations for the rules, predefined categories for the rules, application lists for custom rules, the IPS Profile, and the Web Profile
- Link
Step 10: Validate default internet access rules
- Task 9: Browse the Activity Search Report and validate that selected threat categories are blocked and allowed destinations are accessible
- Link

Use

Steps

Step 1: Configure custom internet access rules
- Task 1: Configure rules for Secure Internet Access
- Link
Step 2: Monitor Secure Access using reports
- Task 2: Review the pre-defined reports such as Security Overview, Security Activity, Activity Search, etc.
- Link
- Task 3: Schedule customizable reports that can be emailed to stakeholders
- Link

Engage

Steps

Step 1: Configure Single Sign-On authentication
- Task 1: Enable Security Assertion Markup Language (SAML) based Single Sign-On authentication
- Link
Step 2: Create internal networks
- Task 2: Define internal networks for creating internet access policies based on internal networks (subnets)
- Link
Step 3: Validate rule efficacy
- Task 3: Validate selected threat categories are blocked
- Link

Adopt

Steps

Step 1: Monitor Secure Access using reports
- Task 1: Review the pre-defined reports such as Security Overview, Security Activity, Activity Search, etc.
- Link
Step 2: Configure Tenants Software as a Service (SaaS applications)
- Task 2: Configure Tenants as used by the customer
- Link
Step 3: Configure Data Loss Prevention policies (requires Advantage License)
- Task 3: Use built-in data classification and configure custom data classification
- Link
Step 4: Configure Inline Data Loss Prevention (requires Advantage License)
- Task 4: Configure inline rules for selected destination lists/applications or all web traffic
- Link
Step 5: Configure Software as a Service (SaaS) API rules
- Task 5: Configure rules and policies for SaaS applications (Tenants)
Link
Step 6: Configure security integrations
- Task 6: Configure integration with Cisco Malware Analysis for web traffic and SaaS applications
- Link
Step 7: Configure Remote Browser Isolation (requires Advantage License)
- Task 7: Configure destination lists, content categories, and custom internet access policies for RBI
- Link
Step 8: Continue to increase user traffic
- Task 8: Review and increase the list of sites to be decrypted according to business needs
- Link

Reference Guided Resources

Related articles