Ingress IP Addresses for the Secure Web Gateway

Login

Cisco Secure Access DNS Defense Help

Cisco Secure Access - DNS Defense Help
- Welcome to Cisco Secure Access – DNS Defense
  - Sign into Secure Access – DNS Defense with Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Find Your Organization ID
    - Prerequisites
    - Procedure
  - Determine Your Current Package
  - View Cloud Security Service Status
    - Cloud Security Service Status
      - Cisco Secure Access Services
      - Secure Access Service Status
    - Past Incidents
  - Contact Cisco Secure Access Support
- Secure Access Single Sign-On Authentication
  - Configure Single Sign-On Authentication
    - Prerequisites
      - Add Your Organization's Identity Provider in Security Cloud Sign On
      - Add Administrators to Secure Access
    - Procedure
  - Troubleshoot Single Sign On Authentication
- Get Started
  - Begin Secure Access Onboarding Workflow
  - Step 1 – Configure Network Connections
    - Prerequisites
    - Task 1 – Add Network Connections
      - Add Network Tunnel Groups
      - Add Resource Connectors and Connector Groups
    - Task 2 – Provision Users and Groups
    - Task 3 – Configure Integrations with SAML Identity Providers
    - What's Next
  - Step 2 – Configure Access to Resources
    - Prerequisites
    - Task 1 – Set Up Private Resources
    - Task 2 – Configure Rule Defaults and Global Settings
      - Manage Rule Defaults
      - Manage Global Settings
    - Task 3 – Add a Policy Rule
    - What's Next
  - Step 3 - Configure End User Connectivity
    - Prerequisites
    - Task 1 – Configure Zero Trust
    - Task 2 – Configure Virtual Private Networks
    - Task 3 – Configure Internet Security
    - Task 4 - Configure Endpoints and Networks
  - Step 4 – Configure Endpoints and Network Sources
    - Prerequisites
    - Add Networks to Secure Access
    - Set Up the Cisco Secure Client
    - Add IPS Profiles
    - Configure Rule Profiles
  - Secure Access Overview Dashboard
    - Prerequisites
    - Get Started Workflow
    - Connectivity
    - Data Transfer
    - Security
      - Security Activity
      - Top Security Categories
    - Users and Groups
    - Private Resources
- Limitations and Range Limits
  - Internet Protocol Versions
  - Secure Access Components
  - Identity Integrations
  - Users and Roles
  - Reporting
  - Data Retention
  - Monthly DNS Query Average
- Network Requirements for Secure Access
  - Secure Access DNS Resolvers
    - Best Practices
    - Cisco Secure Client
    - Cisco Secure Client and External DNS Resolution
  - Secure Access Encrypted DNS Queries
  - Secure Access DNS, Web, and Block Pages
  - Secure Access DNS and Web – Client Configuration Services
    - Windows Only
  - Secure Access DNS and Web – Client Sync Services
  - Secure Access DNS and Web – Client Certificate Revocation Services
  - Cisco Secure Client and Captive Portal Detection
  - Cisco Secure Client and Device Hostnames
  - Transport Layer Security Protocol Requirements
    - TLS 1.2 Support in Windows
    - TLS 1.2 Support in macOS
  - Secure Access Secure Web Gateway Services
    - Egress IP Addresses for the Secure Web Gateway
    - Ingress IP Addresses for the Secure Web Gateway
  - Secure Access Encrypted Web Requests
  - Secure Access Realtime DLP Secure ICAP
  - Secure Access SaaS Tenants
    - Microsoft 365
  - Secure Access SAML Gateway Services
    - Active Directory Federation Service SAML Identity Provider
  - Secure Access SAML Identity Provider Domains
    - Azure AD SAML Identity Provider
  - Secure Access SAML Gateway Client Certificate Revocation Services
  - Secure Access VPN Services
  - Secure Access VPN Client Certificate Revocation Services
  - Secure Access Zero Trust Client-Based Enrollment Services
  - Secure Access Zero Trust Client-Based Proxy Services
    - Known Network Restrictions for Zero Trust Clients
  - Secure Access Zero Trust Client-Based Proxy – Client Certificate Revocation Services
  - Secure Access Zero Trust Proxy Services – Unmanaged Devices
  - Secure Access Zero Trust Services and Connector Groups
- Manage Network Connections
  - Comparison of Network Connection Methods
    - Resource Connectors (Deployed in Connector Groups)
    - Network Tunnels (Deployed in Network Tunnel Groups)
- Manage Network Tunnel Groups
  - Device Compatibility and Network Tunnels
    - IPsec Tunnel Requirements
    - Supported Devices for Setting Up IPsec Tunnels
  - Add a Network Tunnel Group
    - Prerequisites
    - Procedure
      - Configure Tunnel on Network Device
      - Verify Tunnel Traffic in Secure Access
  - Delete a Network Tunnel Group
    - Prerequisites
    - Procedure
  - Edit a Network Tunnel Group
    - Prerequisites
    - Procedure
  - View Network Tunnel Group Details
    - Prerequisites
    - Procedure
    - Network Tunnel Overview
      - List Tunnel Status
  - Supported IPsec Parameters
- Network Tunnel Configuration
  - Establish a Tunnel
    - Maximum Transmission Unit (MTU) Size
    - Tunnel Size
    - Client Reachable Prefixes
    - Throughput and Multiple Tunnels
  - Configure Tunnels with Catalyst SD-WAN cEdge and vEdge
    - Prerequisites
    - Step 1: Add a Network Tunnel Group in Secure Access
    - Step 2: Configure Cisco Catalyst SD-WAN Templates
      - Define the Feature Template
      - Add the IPsec Interface Template
    - Configure Static Routes
    - Verify Tunnel Status
  - Configure Tunnels with Cisco ISR
    - Prerequisites
      - Licensing and Hardware
      - Network Access
    - Configure Tunnels in Secure Access
    - Configure ISR (G2, 4K) or CSR
    - Test Your Configuration
      - Check Tunnel Status
      - Manually Trigger the Tunnel
      - Verify Tunnel Status
  - Configure Tunnels with Cisco Adaptive Security Appliance
    - Prerequisites
      - Licensing and Hardware
      - Network Access
    - Configure Tunnels in Secure Access
    - Configure ASA
    - Test and Verify
  - Configure Tunnels with Meraki MX
    - Prerequisites
    - Caveats and Considerations
    - Supported Use Cases and Requirements
      - Remote Access VPN and ZTA
      - Branch-to-Branch through Secure Access
      - Secure Internet Access with Non-Meraki VPN
    - Step 1: Add a Network Tunnel Group in Secure Access
    - Step 2: Configure a Tunnel in Meraki MX
    - Verification and Troubleshooting
    - Optional Configurations
- Manage Resource Connectors and Connector Groups
  - Overview: Setting Up Resource Connectors and Connector Groups
  - Requirements and Prerequisites for Resource Connectors and Connector Groups
    - Guidelines for Connector Groups
      - Connector Group Region
      - Redundancy Across Connector Groups
    - Requirements and Guidelines for Connectors
    - Connectivity Requirements
    - Capacity Requirements
  - Allow Resource Connector Traffic to Secure Access
    - Region-Specific Destinations
    - Destinations For All Regions
  - Add Resource Connector Groups
    - Prerequisites
    - Guidelines for Configuring Domains and DNS Servers on Connectors Groups
    - Procedure
      - Configure Connector Group Name and Region
      - Estimate the Volume of Traffic to Your Resource Connectors
      - (Optional) Add Domains and DNS Servers for the Connector Group
    - What's Next
  - Add Connectors to a Connector Group
    - Prerequisites
    - Procedure
      - Step 1 – Deploy Secure Access Resource Connectors
      - Step 2 – Confirm Connectors
      - Step 3 – Assign Private Resources to Connector Group
  - Obtain the Connector Image
    - Requirements
    - Get the Connector Image for AWS
    - Get the Connector Image for Microsoft Azure
    - Download the Connector Image for VMware
  - Provisioning Keys for Resource Connectors
    - Important Information about Provisioning Keys
    - Prerequisites
    - Procedure
      - Copy the Provisioning Key for a Connector Group
  - Deploy a Connector in VMware
    - Prerequisites
      - Add a Connector Group
      - Obtain the Connector Image
      - Disk Encryption
      - SSH Key Generation
    - UEFI Secure Boot Environment for Resource Connector Images
      - Requirements for the UEFI Secure Boot Environment
    - Procedure
    - Step 1 – Extract the Connector Image for VMware Tar File
    - Step 2 – Verify the Integrity of the Image
      - Validate the Signature
      - Verify the Checksum of the Signing Key
    - Step 3 – Deploy the OVF Template
    - Step 4 – Power on Connector Instances
    - Step 5 – Confirm Connectors
  - Deploy a Connector in AWS
    - Prerequisites
    - Get Connector Images on the AWS Marketplace
    - UEFI Secure Boot Environment for Resource Connector Images
      - Requirements for the UEFI Secure Boot Environment
    - Procedure
      - Step 1 – Launch an Amazon Machine Image for the Connector Instance
      - Step 2 – Configure the Connector
      - Step 3 – Launch the Connector Instance
  - Deploy a Connector in Azure
    - Prerequisites
    - UEFI Secure Boot Environment for Resource Connector Images
    - Deployment Requirements
    - Procedure
      - Step 1 – Get Connector Images on Microsoft Azure Marketplace
      - Step 2 – Configure the Resource Connector Virtual Machine
      - Step 3 – Connect to the Resource Connector Instance
  - Determine the Number of Connectors Needed in a Connector Group
    - Prerequisites
    - Procedure
  - Assign Private Resources to a Connector Group
    - Guidelines for Assigning a Private Resource to a Connector Group
    - Prerequisites
    - Procedure
  - View a Connector Group's Connectors and Assigned Resources
    - Prerequisites
    - Procedure
  - Disable, Revoke, or Delete Resource Connectors and Groups
    - About Disabling a Resource Connector
    - About Revoking a Resource Connector
    - About Deleting a Resource Connector
    - Disable, Revoke, or Delete a Connector
    - Disable or Delete a Resource Connector Group
  - Maintain and Monitor Resource Connectors and Connector Groups
    - Resource Connector Software Updates
      - Troubleshooting Connector Software Updates
    - Connector Platform Operating System (OS) Updates
    - Monitor Connector and Connector Group Status
      - Check Connector Group Status on the Overview Page
      - Check Connector Group Status on the Connector Groups Page
      - Check Connector Status
    - Increase Connector Group Capacity
    - Check Connector CPU Load
  - Troubleshoot Resource Connectors and Connector Groups
    - General Troubleshooting
    - About Resource Connector Issues
    - Throughput Capacity is Less Than Expected
    - Users Cannot Connect to Private Resources
    - Connector Software Auto-Upgrade Fails
    - Connector Operating System (OS) Version has Security Vulnerabilities
      - Manage Access Control and Vulnerabilities for Containers
    - Connector is Expired
      - Check the Status of Your Connector
      - (VMware Only) View Connector Diagnostic Information
      - Check for an Expired Connector in Secure Access
      - Clean Up an Expired Connector
      - Delete the Connector Container
    - Stop a Connector
      - Stop the Connector Container
    - Unable to Revoke or Delete a Connector
    - Unable to Sync
    - Connector-Related Status Graphs are not Current
    - (Container Only) Connector Troubleshooting Tools
      - Supported Linux Commands
      - Run Diagnostic or Techsupport Scripts
      - Troubleshoot Container Deployments
    - (VM Only) Connector Diagnostics (CLI)
      - Supported Commands
      - Run the Diagnostic Command
    - Diagnostic Codes
      - Diagnostic Codes for Connector Update Issues
      - Diagnostic Codes for Other Connector Issues
      - Supported Standard Linux Troubleshooting Commands
- Manage Users and Groups
  - Import Users and Groups from CSV File
    - Prerequisites
      - CSV File Format
      - CSV File Fields
    - Procedure
    - View Provisioned Users and Groups in Secure Access
  - Provision Token for Identity Provider
    - Prerequisites
    - Procedure
    - Configure Identity Providers
  - Provision Users and Groups from Okta
    - Prerequisites
    - Limitations
    - Supported Features
    - Import the ObjectGUID Attribute from Okta to Secure Access
    - Configure the Cisco Secure Access App
      - Step 1 – Add the App to Okta
      - Step 2 – Add the Secure Access SCIM Token to the App
      - Step 3 – Configure the Required User Options
      - Step 4 – (Optional) Add a New Attribute and Create the User Profile Mapping
      - Step 5 – Assign Users and Groups in the App
      - Step 6 – View Logs in the App
    - View Provisioned Users and Groups in Secure Access
    - Refresh SCIM Token
  - Provision Users and Groups from Azure AD
    - Prerequisites
    - Limitations
    - Procedure
    - Configure the Cisco User Management for Secure Access App
    - View Users and Groups Provisioned from Azure
    - Refresh the SCIM Token
  - Provision Users and Groups from Google Workspace
  - View User Details
    - Prerequisites
    - Procedure
    - User Details
      - General User Details
      - Device Connectivity
      - Groups and Events
      - Associated Rules
  - View Group Details
    - Prerequisites
    - Procedure
    - Group Details
      - General Group Details
      - Users and Events
      - Associated Rules
  - View Endpoint Device Details
    - Prerequisites
    - Procedure
  - Unenroll Devices for Client-Based Zero Trust Access
    - Reenroll the User Device on the Secure Client
    - Prerequisites
    - Procedure
  - Disconnect Remote Access VPN Sessions
    - Prerequisites
    - Procedure
  - Provision Users, Groups and Endpoint Devices from Active Directory
    - Prerequisites for AD Connectors
      - Connector Server
      - Outbound Network Access to Secure Access
      - Connector Account
    - Connect Active Directory to Secure Access
      - Prerequisites
        
        Connector Server
        
        Outbound Network Access to Cisco Secure Access
        
        Connector Account
      - Step 1 – Choose a Provisioning Method
      - Step 2 – Register a Domain Controller or Domain in Secure Access
        
        Register a Domain Controller
        
        Register a Domain
      - Step 3 – Install the Secure Access AD Connector
      - Step 4 – Configure Updates on Deployed AD Connectors
      - Step 5 – Verify that the Connector Syncs with Secure Access
      - Specify AD Groups of Interest
        
        Supported Organizational Units
        
        Unsupported Organizational Units
        
        Sample File Entries
        
        Total Number of Groups Selected for Synchronization
    - Connect Multiple Active Directory Domains
    - Change the Connector Account Password
      - Prerequisites
        
        Connector Server
        
        Outbound Network Access to Cisco Secure Access
        
        Connector Account
      - Procedure
    - AD Connector Communication Flow and Troubleshooting
      - Communication Flow
      - Troubleshooting
        
        Firewall or Access Control Requirements
    - View AD Components in Secure Access
      - Prerequisites
      - Procedure
        
        View AD Components in Secure Access
- Configure Integrations with SAML Identity Providers
  - Use Cases
    - Secure Internet Access—Networks and Network Tunnels
    - Zero Trust Access with the Cisco Secure Client
    - Zero Trust Access with an Unmanaged Device
  - Configure Identity Providers for SAML Authentication
  - Prerequisites for SAML Authentication
    - Secure Access Service Provider Metadata
    - Requirements
      - Enable SAML and HTTPS Inspection in the Web Profile
      - Encrypted SAML assertions
  - Configure Azure AD for SAML
    - Prerequisites
      - Bypass Domains from SSL Decryption
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Azure AD
      - Step 3c – Add the Azure SAML Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - Configure Okta for SAML
    - Prerequisites
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Configure the Identity Provider's SAML Metadata
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Okta
      - Step 3c – Add the Okta SAML Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - Configure AD FS for SAML
    - Prerequisites
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add the Secure Access Service Provider Metadata to AD FS
      - Step 3c – Add the AD FS SAML Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - Configure Duo Security for SAML
    - Prerequisites
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Duo Security
      - Step 3c – Add the Duo Security SAML Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - Configure Ping Identity for SAML
    - Prerequisites
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add the Identity Provider's SAML Metadata
      - Step 3c – Add the Ping Identity SAML Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - Configure OpenAM for SAML
    - Prerequisites
    - Procedure
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to OpenAM
      - Step 3c – Add the OpenAM Metadata to Secure Access
    - Test the Identity Provider Integration
    - View the SAML Certificates in Secure Access
  - SAML Certificate Renewal Options
    - Known Limitations
    - Automatic Configuration Through the Fixed Metadata URL
      - Prerequisites
    - Manual Import of the Secure Access SAML Certificate
  - Test SAML Identity Provider Integration
    - Prerequisites
    - Procedure
  - Delete SAML Identity Provider Integration
    - Prerequisites
    - Procedure
- Manage End-User Connectivity
  - DNS Servers
  - Traffic Steering for Cisco Secure Client Connections
  - Virtual Private Networks Settings and Profiles
  - Internet Security
- Manage DNS Servers
  - Prerequisites
  - About DNS Server Configuration
  - Add a DNS Server
  - View DNS Servers
  - Edit a DNS Server
  - Delete a DNS Server
  - Map DNS Servers to Regions
    - Prerequisites
    - Procedure
- Traffic Steering for Zero Trust Access Client-Based Connections
  - Best Practices
  - Using Wildcards to Configure Traffic Steering for Private Destinations
    - Exception
    - Prerequisites
    - Procedure
- Manage Virtual Private Networks
  - FQDNs for Network Connections
    - About Fully Qualified Domain Names (FQDNs)
    - Secure Access Global FQDN
    - Secure Access Regional FQDNs
    - Secure Access VPN FQDNs
  - Manage IP Pools
  - Add an IP Pool
    - Prerequisites
    - Procedure
      - Add an IP Pool
      - Add a RADIUS Group (optional)
  - Manage VPN Profiles
  - Add VPN Profiles
    - Prerequisites
    - Step 1 – General Settings
    - Step 2 – Authentication, Authorization, and Accounting
      - SAML
      - SAML Configuration
      - SAML Metadata XML Configuration
      - Manual Configuration
      - RADIUS
      - Certificate
    - Step 3 – Traffic Steering (Split Tunnel)
    - Step 4 – Cisco Secure Client Configuration
  - Add a RADIUS Group
    - Prerequisites
    - Procedure
- Manage Internet Security
  - Download Cisco Secure Client or Roaming Client
  - Add Bypass Domains and Set Up Internet Security
  - Next Steps
  - Set Up Internet Security on User Devices
    - Prerequisites
      - Visibility of User Identities in Policy Rules
    - Procedure
      - Download the Secure Client (OrgInfo.json)
      - Download the Roaming Client
  - Manage Internet Security Bypass
    - Prerequisites
    - Procedure
      - Steer Traffic to Secure Access or Bypass Domains
      - List Bypass Domains in Secure Access
  - Configure Cisco Secure Client Settings
    - Prerequisites
    - Procedure
      - Configure Advanced Security Settings
      - Use Active Directory for Access Policy
      - Third Party VPN Compatibility
      - Client settings
      - DNS Backoff Settings
- Manage Domains
  - Add Internal Domains
    - Prerequisites
    - Procedure
- Internal Networks Setup Guide
  - Provision a Subnet for Your Virtual Appliance
    - Prerequisites
    - Procedure
  - Manage Sites
    - Prerequisites
    - Before You Begin
    - Procedure
  - Manage Internal Networks
    - Prerequisites
    - Before You Begin
    - Procedure
    - Apply DNS Policies to Internal Network
  - Assign a Policy to Your Site
- Manage a Network Device
  - Prerequisites
  - Procedure
    - Step 1: Create a Network Devices API Key
    - Step 2: Register a Network Device
    - Step 3: Add Network Device to a DNS Policy
    - Step 4: Test Your Network Device Integration
  - Delete a Network Device
    - Prerequisites
    - Procedure
- Manage Registered Networks
  - Add Network Resources
    - Prerequisites
      - Dynamic IP Address—IPv4 Only
    - Procedure
      - Step 1 – Select the Network
      - Step 2 – Configure the Network Resource
      - Step 3 – Change the DNS Settings on Your Relevant Network Device
      - Step 4 – Apply a Policy Rule to the Network Resource
      - Step 5 – Test Your Network
  - Point Your DNS to Cisco Secure Access
    - Cisco Secure Access DNS Resolvers – IP addresses
    - Cisco Secure Access DNS Resolvers – Anycast IP Addresses
    - Prerequisites
    - Procedure
      - Step 1 – Identify Where Your Public DNS Server Addresses are Configured
      - Step 2 – Log Into the Server or Router Where DNS is Configured
      - Step 3 – Change Your DNS Server Addresses
        
        Primary and Secondary Servers
      - Step 4 – Test Your New DNS Settings
  - Clear Your DNS Cache
    - Prerequisites
    - Clear Your DNS Cache on Computers and Servers
      - Windows 7 and Earlier
      - Windows 8 and Newer
      - OS X 10.4 TIGER
      - OS X 10.5 and 10.6 LEOPARD
      - OS X 10.7 and 10.8 Lion
      - OS X 10.9 and 10.10
      - Linux
      - Ubuntu Linux
    - Clear Your DNS Cache on Browsers
      - Internet Explorer 8 and Newer – Windows
      - Mozilla Firefox – Windows
      - Apple Safari – macOS
      - Apple Safari – macOS
      - Google Chrome – Windows
      - Google Chrome – macOS
  - Update a Network Resource
    - Prerequisites
    - Edit the Registered Network Resource Name
    - Update the Registered Network Resource
  - Delete a Network Resource
    - Prerequisites
    - Procedure
- Manage Roaming Devices
  - View Internet Security Settings for Roaming Devices
    - Prerequisites
    - Procedure
      - Host Information
  - Edit Internet Security Settings for Roaming Devices
    - Prerequisites
    - Procedure
      - Edit the Auto-Delete Interval for Roaming Devices
  - Delete a Roaming Device
    - Prerequisites
    - Procedure
- Manage Destination Lists
  - Best Practices
  - How to Format Your Destination List
  - Add a Destination List
    - Prerequisites
    - Procedure
  - Edit a Destination List
    - Prerequisites
    - Procedure
  - Add Destinations in Bulk
    - Prerequisites
    - Procedure
  - Download Destinations to a CSV File
    - Prerequisites
    - Procedure
  - Control Access to Custom URLs
    - Prerequisites
      - Enable the Intelligent Proxy
      - Install a Root Certificate
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Punycode Domain Name to Destination List
    - What is Punycode?
    - Examples of Unicode and Punycode Encoded Strings
  - Test Your Destinations (Hidden in SSE/SSE DNS)
  - Search for a Destination List
  - Troubleshoot Destination Lists
    - Destination Lists and Common Error Conditions
- Manage Internet and SaaS Resources
- Manage Application Lists
  - Add an Application List
    - Prerequisites
    - Procedure
  - Application Categories
    - Category Descriptions
  - Delete an Application List
    - Prerequisites
    - Procedure
- Manage Content Category Lists
  - Available Content Categories
  - Add a Content Category List
    - Prerequisites
    - Procedure
  - Request a Category for an Uncategorized Destination
    - Prerequisites
    - Procedure
  - Dispute a Content Category
    - Prerequisites
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - View Content Categories in Reports
    - Prerequisites
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
- Manage Private Resources
  - Step 1 – Configure Private Resources
    - Optional Configuration for Private Resources
  - Step 2 — Set Up Network Connections, VPN Profiles, and Certificates
  - Step 3 — Add Private Resources in Private Access Rules
  - Step 4 — Set Up the Cisco Secure Client and Distribute URLs
  - Add a Private Resource
    - Prerequisites
    - Procedure
      - Communication with Secure Access Cloud
      - Endpoint Connection Methods
      - Resource Connector Groups
      - Decryption
      - Associated Rules
      - What's Next
  - Add a Private Resource Group
    - Prerequisites
    - Procedure
  - Private Resource Configuration Examples
    - Private Resource located in multiple locations
    - Catch-All Private Resource to Prevent Exposing Internal Networks
- Manage AAA Servers
- Manage Connections to Private Destinations
  - Comparison of Zero Trust Access and VPN
  - Comparison of Client-Based and Browser-Based Zero Trust Access Connections
    - Client-based connections:
    - Browser-based connections:
  - Requirements for Zero Trust Access
    - Resource requirements for client-based zero trust access
    - Resource requirements for browser-based zero trust access
    - Network Requirements for Zero Trust Access
  - Network Authentication for Zero Trust Access
  - Manage Branch Connections
    - Endpoint Connection Methods
    - Branch Networks in Private Access Rules
      - Users and Groups Connections to Private Resources
      - Sources for Branch Network Connections
      - Destinations for Branch Network Connections
      - Source Connections to Destinations
    - Add an IPS Profile on Private Access Rules
    - Log Connections From Branch Networks to Private Resources
- Manage the Access Policy
  - About the Access Policy
    - Best Practices
    - Default Rule Data
  - Show Additional Data on Your Access Rules
    - Prerequisites
    - Procedure
  - Edit the Order of the Rules in Your Access Policy
  - Rule Defaults: Default Settings for Access Rules
    - Zero Trust Access: Endpoint Posture Profiles
    - Zero Trust Access: User Authentication Interval
    - Intrusion Prevention (IPS)
  - Global Settings for Access Rules
    - Global Settings for Access Rules
    - Decryption Logging
  - Edit Rule Defaults and Global Settings
    - Prerequisites
    - Procedure
  - Edit the Default Access Rule
    - Default Internet Access Rule
    - Default Private Access Rule
    - To View or Edit Default Access Rules
- Get Started With Private Access Rules
  - Components for Private Access Rules
    - Sources
    - Destinations
      - Private Resources
      - Private Resource Groups
    - Endpoint Posture Profiles (for Endpoint Requirements)
    - Security Controls
  - Default Settings for Private Access Rules
  - Add a Private Access Rule
    - Prerequisites
    - Set Up the Private Access Rule
      - Enable the Rule and Edit Your Logging Settings
      - Add a Rule Name
      - Choose a Rule Order
    - Step 1 — Specify Access Options
      - Rule Action
      - Sources
      - Destinations
      - Endpoint Requirements
      - User Authentication Requirements
    - Step 2 — Configure Security Control Options
      - Intrusion Prevention (IPS)
    - Summary
  - About Configuring Sources in Private Access Rules
    - Source Components for Private Access Rules
    - Composite Sources for Private Access Rules
      - Limitations of Composite Sources
      - IP Addresses, CIDR Blocks, and Wildcard Masks
      - Add Composite Sources
      - Combining IPs, CIDRs, or Wildcard Masks on a Source
    - Use Wildcard Masks in Composite Sources
      - Guidelines
      - Examples of Wildcard Masks
    - Combining Multiple Sources in a Rule (Boolean logic)
  - About Configuring Destinations in Private Access Rules
    - Destination components for Private Access Rules
    - Composite Destinations for Private Access Rules
      - IP Addresses, CIDR Blocks, and Wildcard Masks
      - Ports
      - Protocols
      - Add Composite Destinations
      - Combining Destination Components as a Single Destination
    - Use Wildcard Masks in Composite Destinations
      - Guidelines
      - Examples of Wildcard Masks
    - Combining Multiple Destinations in a Rule (Boolean Logic)
  - About Endpoint Requirements in Access Rules
  - Allowing Traffic from Users and Devices on the Network
  - Global Settings for Private Access Rules
  - View Rules Associated with a Private Resource
  - Troubleshoot Private Access Rules
    - General Troubleshooting Tips
    - Problems While Creating a Rule
      - Next button is not available
    - Problems After Creating a Rule
      - Traffic is unexpectedly blocked
      - Traffic is unexpectedly allowed
      - Rule does not match traffic as expected
- Get Started With Internet Access Policy
  - Components for Internet Access Rules
    - Sources
    - Destinations
    - Security Controls
      - Security Profile
        
        Configure Threat Category Settings
        
        Set Up Certificates for Decrypting Internet Traffic
        
        Configure Do Not Decrypt Lists
        
        (Optional) Configure Custom End-User Block and Warn Notifications
        
        Configure Security Profiles for Internet Access
  - Default Settings for Internet Access Rules
  - Add an Internet Access Rule
    - Prerequisites
    - Procedure
    - Access Options
      - Disable or Enable the rule
      - Logging settings
      - Summary
      - Rule name
      - Rule order
      - Rule action
      - Pre-Configured Sources
      - Composite Sources
      - Pre-Configured Destinations
      - Composite Destinations
      - App Risk Profile
      - Advanced Application Controls
    - Security Control Options
      - Security Profile
    - Next Steps
  - About Configuring Sources in Internet Access Rules
    - Source Components for Internet Access Rules
    - Composite Sources for Internet Access Rules
      - Limitations of Composite Sources in Internet Rules
      - IP Addresses, CIDR Blocks, and Wildcard Masks
      - Adding Composite Sources
      - Combining IPs, CIDRs, or Wildcard Masks on a Source
    - Combining Multiple Sources in a Rule (Boolean logic)
  - About Configuring Destinations in Internet Access Rules
    - Destination Components for Internet Access Rules
    - Pre-Configured Destinations on an Internet Rule
    - Application Lists and Application Categories on an Internet Rule
    - Application Protocols on an Internet Rule
      - How Application Protocols Combine with Composite Destinations
    - Composite Destinations for Internet Access Rules
      - Limitations of Composite Destinations
      - IP Addresses, CIDR Blocks, and Wildcard Masks
      - Ports
      - Adding Composite Destinations
      - Combining Destination Components as a Single Destination
    - Combining Multiple Destinations in a Rule (Boolean Logic)
    - Number of Destinations in a Rule
  - Ensure Rule Matching for Encrypted Internet Traffic
  - Block Internet Access to Geographic Locations
  - Advanced Application Controls
    - Applications with Advanced Controls
      - Cloud Storage
      - Collaboration
      - Content Management
      - Media
      - Office Productivity
      - P2P
      - Social Networking
    - Prerequisites
    - Procedure
    - Troubleshooting
  - Global Settings for Internet Access Rules
  - About Isolated Destinations
    - Prerequisites
      - Secure Access Prerequisites
      - Browser Prerequisites
    - Secure Access Package Support for RBI and Isolation Rules
      - Isolate Any
      - Isolate Risky
    - Verifying Isolation
    - Limitations of Isolation
  - Troubleshoot Internet Access Rules
    - General troubleshooting tips
    - Problems while creating the rule
      - The Next button is unavailable
    - Problems after creating a rule
      - Internet traffic is unexpectedly blocked
      - Internet traffic is unexpectedly allowed
      - Internet Access rule is not matching traffic as expected
  - Zero Trust Access to Internet Destinations
    - Solution Overview
- Manage File Inspection for Internet Policy
  - How File Inspection Works
    - How is a File Inspected?
      - Cisco Advanced Malware Protection (AMP) Scanning
      - Antivirus Scanning
  - Enable File Inspection
    - Prerequisites
    - Procedure
  - Test File Inspection
    - Prerequisites
    - Procedure
  - Troubleshooting
    - Contact Support
  - File Inspection Reports
    - Security Activity Report for File Inspection
    - Security Activity Report for Activity Search
- Manage File Inspection and File Analysis for Private Access Rules
  - Overview of Configuring File Inspection and Analysis
  - File Inspection Details
    - Cisco Advanced Malware Protection (AMP)
    - Antivirus Scanner
  - Cisco Secure Malware Analytics (formerly Threat Grid) Details
    - Supported Files and File Limitations
    - Secure Malware Analytics Sandbox
  - Enable File Inspection
    - Prerequisites
    - Procedure
  - Enable File Analysis by Cisco Secure Malware Analytics
    - Prerequisites
    - Procedure
  - Test File Inspection
    - Prerequisites
    - Procedure
      - Block Page Diagnostic Information
  - Monitor File Inspection and Analysis Activity
    - Monitor and Review File Inspection and Analytics
    - Monitor and Review Secure Malware Analytics
      - Monitor File Submission Limits
  - Troubleshoot and Monitor File Inspection and Analysis
    - General Troubleshooting
- Manage File Type Controls
- Manage the Intelligent Proxy
  - How the Intelligent Proxy Works
  - Advantages of Using the Intelligent Proxy
  - Sites That are Not Proxied by the Intelligent Proxy
  - Best Practices
  - SSL Decryption Requirements and Implementation
  - Do Not Decrypt Lists
  - Enable the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test Selective Decryption
    - Prerequisites
    - Procedure
  - Review the Intelligent Proxy Through Reports
    - Prerequisites
    - Procedure
  - Enable SSL Decryption
    - Root Certificate Requirement
    - Prerequisites
    - Procedure
- Manage Endpoint Security
  - About Endpoint Posture
  - About Posture Profiles
  - Endpoint Posture Assessment
  - Endpoint Attributes
    - Supported Operating Systems
      - Zero Trust Connections
      - VPN Connections
    - Endpoint Security Agents
    - System Password Enforcement
    - Disk Encryption
    - Supported Browsers
    - Windows Registry Conditions
    - File Conditions
    - Process Conditions
    - Certificate Conditions
- Manage Zero Trust Access Posture Profiles
  - Zero Trust Access Posture Attributes
  - Add a Client-Based Zero Trust Access Posture Profile
    - Prerequisites
    - Procedure
  - Add a Browser-Based Zero Trust Access Posture Profile
    - Prerequisites
    - Procedure
- Manage VPN Connection Posture Profiles
  - VPN Posture Attributes
  - Add a VPN Connection Posture Profile
    - Prerequisites
    - Procedure
- Manage IPS Profiles for Private Access
  - How IPS Works
    - Hit Counts
    - Cisco-Provided IPS Signature Lists
  - Decryption is Required for Effective Intrusion Prevention
- Manage Security Profiles
  - Security Profiles for Internet Access
    - Functionality Included in a Security Profile for Internet Access
    - Decryption
    - SSO Authentication
      - Requirements for Enabling OIDC Authentication
      - Requirements for Enabling SAML Authentication
      - Requirements for Disabling SAML Authentication
    - Security and Acceptable Use Controls
    - End-User Notifications
    - Get Started: Security Profiles for Internet Access
  - Add a Security Profile for Internet Access
    - Prerequisites
    - Procedure
    - Add a Security Profile
    - Security and Acceptable Use Controls
      - Threat Categories
      - File Inspection
      - SafeSearch
      - Intelligent Proxy
    - Configure End-User Notifications
    - View Security Profiles
    - Configure Additional Security Options
    - Add a Security Profile on Internet Access Rules
    - Edit a Security Profile
    - Delete a Security Profile
  - Enable SafeSearch
    - Enable SafeSearch
    - Confirm That SafeSearch is Working
      - Google
      - YouTube
      - Yahoo
      - Bing
  - Security Profiles for Private Access
  - Add a Security Profile for Private Access
    - Prerequisites
    - Procedure
    - Next steps
- Manage Threat Categories
  - Threat Category Descriptions
  - Add a Threat Category List
    - Prerequisites
    - Procedure
  - Dispute a Threat Categorization
    - Prerequisites
    - Procedure
  - Threat Intelligence Feeds
  - Add Threat Intelligence Feeds
    - Prerequisites
    - Additional Prerequisites for Cisco AMP Threat Grid
    - Enable Third-Party Platform Feeds
    - Add a Threat Intelligence Feed
    - Add Threat Intelligence Feeds to Internet Access Rule
      - List the Blocked Domains
    - Logging and Reports
      - View Reports
      - View Admin Audit Log
      - Access Logs in S3
  - Custom Feed Best Practices
    - Known Domains and Destination Lists
    - Delete a Domain from Custom Destination Block List
- Manage Notification Pages
  - View Notification Pages Displayed to End Users
  - Display Custom Notification Pages to End Users
  - About Block Pages for Private Access Traffic
  - Preview Notification Pages
    - Prerequisites
    - Procedure
  - Create Custom Block pages
    - Prerequisites
    - Create Custom Block pages
    - Link a Custom Notification Page Appearance to a Security Profile
    - Next Steps
  - Allow Users to Contact an Administrator
    - Prerequisites
    - Procedure
  - Block Page IP Addresses
    - IP Addresses for Secure Access Block Pages
    - Domains for Secure Access Block Pages
- Manage Traffic Decryption
  - Internet Access Features Requiring Decryption
  - Internet Traffic That Should Not Be Decrypted
  - Decryption in Private Access Rules
  - Decryption Settings
  - Decryption Requires Certificates
  - Decryption Logging
  - Troubleshooting Decryption
  - Important Information About Do Not Decrypt Lists
    - The System-Provided Do Not Decrypt List
    - Limitation: Do Not Decrypt Based on Content Category
  - Add a Do Not Decrypt List
    - Prerequisites
    - Procedure
- Manage Certificates
  - Certificate Installation Methods
  - Manage the Cisco Umbrella Root Certificate
    - Why Install a Certificate?
  - Manage the Secure Access Root Certificate
    - Certificate Installation Methods
  - View the Cisco Trusted Root Store
    - Prerequisites
      - Download the Cisco Trusted Union Root Bundle
    - Extract the Certificates
      - Step 1: Extract the Signing Certificate
      - Step 2: Extract Certificate Bundle as Message
      - Step 3: Extract PEM-Formatted Certificates From Bundle
      - Step 4: Generate Individual Certificate Files
        
        Linux
        
        macOS
    - View an Individual Certificate File
  - Certificates for Internet Decryption
    - Certificates for Displaying Notifications
    - Certificates for Decrypting Internet Traffic
      - Option 1: Distribute Self-Signed Certificates to End-User Devices
      - Option 2: Use a Signed Certificate for Decrypting Internet Traffic
  - Manage Certificates for Private Resource Decryption
    - Prerequisites
      - Install a Certificate Authority Certificate on a Private Resource
    - Procedure
      - View Notifications About Expired Private Resource Certificates
      - Upload Private Resource Certificates
        
        Option 1: Upload or enter a certificate-key pair directly to the private resource
        
        Option 2: Upload a certificate and key to the Certificates page
  - Certificates for Private Resource Decryption
  - Certificates for SAML Authentication
  - Manage SAML Certificates for Service Providers
    - Prerequisites
    - Procedure
      - View Notifications About Expired Service Provider Certificates
      - Download Zero Trust Service Provider Certificates
      - Download Virtual Private Network Service Provider Certificates
  - Manage SAML VPN Service Provider Certificate Rotation
    - Prerequisites
    - Procedure
      - View Notifications About Expired Service Provider Certificates
      - Activate a New VPN Service Provider Certificate
  - Manage SAML Certificates for Identity Providers
    - Prerequisites
    - Procedure
      - View Notifications About Expired Identity Provider Certificates
      - Manage Zero Trust Identity Provider Certificates
      - Manage Virtual Private Network Identity Provider Certificates
  - VPN Certificates for User and Device Authentication
  - Push the Cisco Root Certificate to Managed Devices
    - Prerequisites
    - Procedure
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Edit Account Settings
    - Prerequisites
    - Procedure
  - Delete an Account
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-identification
    - Disable De-identification
    - Limitations
- Manage SaaS API Data Loss Prevention
  - Enable SaaS API Data Loss Prevention
    - Prerequisites
    - Procedure
  - Revoke SaaS API Data Loss Prevention for a Platform
    - Prerequisites
    - Procedure
  - Enable SaaS API Data Loss Prevention for Google Drive Tenants
    - Prerequisites
    - Validation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Webex Teams Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Microsoft 365 Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Dropbox Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Box Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable SaaS API Data Loss Prevention for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
- Manage Cloud Malware Protection
  - Cloud Access Security Broker Protection for Google Drive and Microsoft 365
  - Enable Cloud Malware Protection
    - Prerequisites
    - Procedure
  - Revoke Authorization for a Platform
    - Prerequisites
    - Procedure
  - Enable Cloud Malware Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize a Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable Cloud Malware Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable Cloud Malware Protection for Box Tenants
    - Prerequisites
    - Limitations
    - Verify Box Application Settings
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Dropbox Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Microsoft 365 Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Webex Teams
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Google Drive
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
- Manage API Keys
  - Add Secure Access API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Add KeyAdmin API Keys
    - Use Cases
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Log Management
  - Where are Logs Stored?
    - Logging to the Secure Access Data Warehouse
    - Logging to Amazon S3
    - Advantages and Disadvantages of Configuring a Cisco-Managed Bucket
  - Enable Logging
    - Prerequisites
    - Procedure
      - Private Access Rules:
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites
      - JSON Bucket Policy
    - Procedure
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
      - Prerequisites
  - Enable Logging to a Cisco-managed S3 Bucket
    - Prerequisites
    - Procedure
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
      - Prerequisites
      - Best Practices: Download Files From the S3 Bucket
  - Change the Location of Event Data Logs
  - Stop Logging
    - Prerequisites
    - Procedure
  - Delete Logs
    - Prerequisites
    - Procedure
  - Log Formats and Versioning
    - Prerequisites
    - Log File Name Formats
      - Subfolders
      - Find Your Log Schema Version
        
        Log Schema Versions
        
        View Your Log Schema Version and Last Sync Time
      - Log File Fields
      - Estimate the Size of a Log
      - Estimate the Size of an Exported Report
    - Reports and CSV Formats
      - Activity Search Report
        
        Zero Trust Access Activity Search Fields
      - Top Categories Report
      - Top Destinations Report
      - Top Resources Report
    - Admin Audit Log Formats
      - Examples
        
        V8, V9 Log Samples
      - Order of Fields in Admin Audit Log
        
        V8, V9 Log Formats
    - Cloud Firewall Log Formats
      - Examples
        
        V8, V9 Log Samples
      - Order of Fields in the Cloud Firewall Log
        
        V8, V9 Log Formats
    - DNS Log Formats
      - Examples
        
        V8, V9 Log Samples
      - Order of Fields in the DNS Log
        
        V8, V9 Log Formats
    - IPS Log Formats
      - Examples
        
        V9 Log Sample
        
        V8 Log Sample
      - Order of Fields in the IPS Log
        
        V9 Log Format
        
        V8 Log Format
    - Remote Access VPN Log Formats
      - Examples
        
        Connect VPN Log Sample
        
        Disconnect VPN Log Sample
        
        Authorization Check Failure VPN Log Sample
        
        Certificate Authorization Check Failure VPN Log Sample
      - Order of Fields in the RAVPN Log
        
        V9 Log Format
    - Web Log Formats
      - Examples
        
        V8, V9 Log Samples
      - Order of Fields in the Web Log
        
        V9 Log Format
        
        V8 Log Format
    - Zero Trust Access Log Formats
      - Examples
        
        V9 Log Samples
      - Order of Fields in Zero Trust Access Logs
        
        V9 Log Format
Reports
- Monitor Secure Access with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
    - Prerequisites
    - Procedure
  - Report Retention
  - Report Scheduling
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Check Your Spam Folder
      - Unsubscribe From a Scheduled Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Remote Access Log Report
  - View the Remote Access Log Report
    - Prerequisites
    - Procedure
    - View the Remote Access Log Report
    - View Details
- Activity Search Report
  - View and Customize the Activity Search Report
    - Prerequisites
    - View the Activity Search Report
    - Customize the Activity Search Report
    - Save Activity Search Report columns and filters for future use
    - Customize and Manage Saved Searches
  - View Zero Trust Events in Activity Search Report
    - Prerequisites
    - Procedure
      - Access Details
      - Block Details
      - Endpoint Details
  - View Activity Search Report Actions
    - Prerequisites
    - See Full Details
    - Filter Views
  - Schedule an Activity Search Report
  - Use Search and Advanced Search
    - Prerequisites
    - Search
    - Wildcards
      - Domains
      - URLs
      - File Names
    - Advanced Search
- Security Activity Report
  - View Activity and Details by Filters
    - Prerequisites
    - Procedure
  - View Activity and Details by Event Type or Security Category
    - Prerequisites
    - Procedure
      - Group Security Categories
  - View an Event's Details
    - Prerequisites
    - Procedure
  - Search for Security Activity
    - Prerequisites
    - Procedure
      - Advanced Search
- Total Requests Report
  - Prerequisites
  - Procedure
- Activity Volume Report
  - Prerequisites
  - View Requests by Activity Volume
  - View Activity Volume by Threat Category
    - Prevent
    - Contain
  - View Activity Volume by Policy Traffic
  - View Trends Over Time
- App Discovery Report
  - Prerequisites
  - Procedure
  - View the App Discovery Report
    - Prerequisites
    - View the App Discovery Report
  - View the Highest Risk Apps
    - Prerequisites
    - Procedure
  - Review Apps in the Apps Grid
    - Prerequisites
    - Procedure
    - Configure Columns to Display
    - Change an App Label
  - View App Details
    - Prerequisites
    - Procedure
  - Change App Details
    - Prerequisites
    - Change the Risk Score for an App
    - Change the Label of an App
  - Control Apps
    - Prerequisites
    - Procedure
    - Control Application Lists
  - Control Advanced Apps
    - Prerequisites
    - Procedure
- Top Destinations Report
  - Prerequisites
  - View the Top Destinations Report
  - View Further Details
  - Destination Details
    - Prerequisites
    - View the Destination Details
    - View the Request Traffic
      - View Requests by Blocked or Allowed
      - View Requests Through Global Traffic %
    - View the Access and Policy Details
    - View Recent Activity
    - View the Most Visited URL Paths
- Top Categories Report
  - Prerequisites
  - View the Top Categories Report
    - Sort by Traffic
    - Ascending or Descending Order
  - Top Categories Quick View
  - View Category in Other Reports
  - Category Details
    - Prerequisites
    - View a Category's Details Overview
    - View a Category's Traffic
      - View the Activity Breakdown
      - View the Traffic Bandwidth
    - View a Category's Identities
    - View the Category's Top Domains
- Third-Party Apps Report
  - Prerequisites
  - View the Third-Party Apps Report
  - Search the Third-Party Apps Report
  - Export the Third-Party Apps Report
- Cloud Malware Report
  - Prerequisites
  - View the Cloud Malware Report
  - Use the Cloud Malware Report
    - Quarantine a Malicious File
    - Delete a Malicious File
    - Dismiss an Item from the Report
    - Export the Report
- Admin Audit Log Report
  - Prerequisites
  - Generate Admin Audit Log Report
  - Export Admin Audit Log Report to an S3 Bucket
    - Prerequisites
    - Procedure
- Top Threats Report
  - View the Threats Report
  - View Top Threat Types
  - View How Threats Impact Your Environment
  - Search for Threats in Activity Search
  - Threat Type Details
    - Prerequisites
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Top Identities Report
  - Prerequisites
  - View the Top Identities Report
  - View Identity in Other Reports
  - Identity Details
    - Prerequisites
    - View an Identity Report
      - Total Requests Graph
      - Top Destinations report
      - Top Categories report
      - Recent Activity table
DNS Forwarders
- Virtual Appliance Introduction
  - How Secure Access Virtual Appliances Work
  - Benefits of Virtual Appliances
  - Prerequisites
    - Virtual Appliance Requirements
      - VMware Requirements
      - Microsoft Hyper-V Requirements
      - Cloud Platform Requirements
      - KVM Requirements
      - Nutanix Requirements
    - Networking Requirements
      - SSH Support Tunnel
      - Networking: Additional Considerations
    - DNSCrypt
  - Deployment Guidelines
    - Virtual Appliance Deployment Best Practices
      - Redundancy
      - Multiple DNS Egresses
      - Single DNS Egress
      - Double NAT
  - Importance of Running Two VAs
    - Benefits of Two VAs
- Deploy Virtual Appliances
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Procedural Overview
    - 1. Download the Hyper-V Installer
      - 2. Import the Virtual Appliance
      - 3. Copy and Rename Image Files
      - 4. Select Network Adapter
      - 5. Select Hard Drive
      - 6. Power on the Virtual Machine
      - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Procedural Overview
    - 1. Download OVF Template
      - 2. Deploy OVF Template
      - 3. Deploy a Second Virtual Appliance
      - 4. Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
      - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
    - Procedural Overview
    - 1. Prepare the Virtual Appliance Amazon Machine Image
      - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
    - Procedural Overview
    - Prepare the Virtual Appliance Instance Template on GCP
      - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
    - Procedural Overview
    - 1. Create the qcow2 files for KVM
      - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
    - Procedure
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is a Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Secure Access Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Secure Access Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Support Tunnel From the VA
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed in Azure
  - Troubleshoot DNS Resolution in Configuration Mode
  - Troubleshoot DNS Resolution Failures Behind a Firewall
  - Troubleshoot Egress Network Connectivity From VA
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure DNS Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Anycast
        
        Configure Anycast over BGP on the VA
        
        Configure Load Balancing
        
        Configure Identity Association Timeouts
- Active Directory Integration with the Virtual Appliances
  - Network Diagram for VA Deployments
  - Prerequisites
    - Connector Server
    - Outbound Network Access to Cisco Secure Access
    - Connector Account
  - Active Directory User Exceptions
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
    - Set Up Active Directory User Exceptions
    - Set Up Active Directory Group Exceptions
    - Set Up Active Directory IP Address Exceptions
  - Prepare Your Active Directory Environment
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
    - Step 1 – Choose a Provisioning Method
    - Step 2 – Register a Domain Controller or Domain in Secure Access
      - Register a Domain Controller
      - Register a Domain
    - Step 3 – Install the Secure Access AD Connector
    - Step 4 – Configure Updates on Deployed AD Connectors
    - Step 5 – Verify that the Connector Syncs with Secure Access
    - Specify AD Groups of Interest
      - Supported Organizational Units
      - Unsupported Organizational Units
      - Sample File Entries
      - Total Number of Groups Selected for Synchronization
  - Connect Active Directory to Umbrella VAs
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Specify AD Groups of Interest
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Multiple Active Directory and Secure Access Sites
    - Active Directory Sites and Secure Access Sites
      - Active Directory Sites and Services
      - Secure Access Sites
      - When to Use Secure Access Sites
      - Caveats
    - Use Secure Access Sites
      - Assign a Site to a Component
  - Change the Connector Account Password
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco ecure Access
      - Connector Account
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
Managed iOS Device
- Cisco Security Connector—Secure Access Setup Guide
  - Requirements
    - Optionally
  - Getting Started
  - Quick Start
    - Prerequisites
    - Procedure
      - 1. Install the Cisco Security Connector App
      - 2. Add an Organization Administrator's Email Address
      - 3. Register Your iOS Device Through Your MDM to Secure Access
      - Unregister a Mobile Device
- Meraki Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Push of Profile Config
    - Anonymize Your Device
    - Verify Secure Access on Your Device
- Verify Secure Access with Meraki
  - Prerequisites
  - Procedure
    - Verify Local Operation on the iOS Device
    - Verify Secure Access
    - Verify Clarity
    - Upgrade the Cisco Security Connector
    - Uninstall the Cisco Security Connector
- Meraki Documentation
- Apple Configurator 2 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your Device
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Secure Access on Your iOS Device
  - Install Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS device
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Secure Access on Your iOS device
  - Install Umbrella Root Certificate
  - MobileIron Configuration
    - MobileIron Procedure
    - MobileIron Cloud Configuration
    - MobileIron On-Prem Configuration
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Register an iOS Device Through a Generic MDM System
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify That Your Device is Protected by Secure Access
  - Install Root Certificate
- Apply Secure Access Policies to Your Mobile Device
  - Prerequisites
  - Procedure
  - Secure Access Reporting
    - Activity Search Report
    - Security Activity Report
    - App Discovery Report
- Anonymize Devices
  - Prerequisites
  - Procedure
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Troubleshooting
  - Prerequisites
  - Generate Diagnostics and Email the Secure Access Reports
  - Generate Diagnostics and Share the Secure Access Reports
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Umbrella Certificate
  - Android Configuration Download
    - Procedure
      - Fail Close/Open Scenario
  - Cisco Meraki MDM
    - Add App to Cisco Meraki
    - Add Configuration for App
    - Push the App to Devices
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - MobileIron MDM
    - Configure the App
    - Push the App
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - VMware Workspace ONE
    - Prerequisites for Deployment
    - Deployment Procedure
      - Create an Always On VPN Profile
    - Add and Publish the Cisco Secure Client Application
  - Microsoft Intune MDM
    - Publish the Umbrella AnyConnect app to Managed Android Devices
    - Configure Secure Access
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Samsung Knox MDM
    - Register with the Enterprise Mobile Manager (EMM)
    - Enroll Android Devices
    - Push the App
    - Set Managed Configuration
    - Create Profile in Knox Manage
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Manage Pop-Ups and App Controls
    - App Settings and First-Time Launch
      - Benefits of Enabling Always-On VPN with Secure Access
    - Configure the App for Secure Access DNS and Remote VPN
      - Configure the App for Secure Access Without Remote VPN
      - Configure the App for Secure Access With Remote VPN
    - Add Android Restriction
    - Additional Notes
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access the User Identities on the Secure Access Dashboard
    - Configure Policy Based on User Identity
    - Monitor User Activity
- Troubleshooting
  - Is this a VPN to Secure Access?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Unmanaged Mobile Device Protection
- Secure Access Unmanaged Mobile Device Protection
- Administrator Actions
  - Prerequisites
  - Procedure
- End-User Actions
  - Android
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment
    - Enrollment by QR code
    - Enrollment without Camera Access
    - Registration and Activation
  - iOS
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment by Link
    - Enrollment by QR code
    - Registration and Activation
Cisco Secure Client
- Cisco Secure Client Overview
- Get Started and Manage Client-based Zero Trust Access from Mobile Devices
  - Set up the Zero Trust Access App for iOS Devices
    - System Requirements
    - Guidelines and Limitations
    - Configure Settings in Cisco Secure Access
    - Install the App
    - Have End Users Enroll in Zero Trust Access
    - Notes for administrators
  - Set up the Zero Trust Access App for Android on Samsung Devices
    - Requirements and Prerequisites
    - Configure Cisco Secure Access
    - Install the App
    - (Optional) Set up the Android device for Zero Trust Access using MDM
      - Add the app to MDM
      - Set up the App on the Samsung Device
    - Enroll the Device in Zero Trust Access
    - Notes for administrators
  - Monitor and Troubleshoot the Zero Trust Access App from Mobile Devices
    - Monitor Activity
    - General Troubleshooting
    - Troubleshoot iOS Devices
    - Troubleshoot Samsung Devices Running Android OS
    - Troubleshoot access issues
- Get Started with Cisco Secure Client on Windows and macOS Devices
  - Prerequisites
    - Secure Access Requirements
      - Download the Cisco Secure Client Pre-Deployment Package
    - Install Cisco Secure Client
  - Download Cisco Secure Client
    - Step 1 - Navigate to the Download Cisco Secure Client window
    - Step 2 - Download Cisco Secure Client
      - Download the latest version of Secure Client from Secure Access
      - Download the cloud-managed version of Secure Client
      - Download a previous version of Secure Client from Cisco Secure Central
    - Step 3 - Download configuration files
    - Step 4 - Install Secure Client
      - ThousandEyes Endpoint Agent Module
  - Download the OrgInfo.json File
    - Prerequisites
    - Procedure
      - Step 1 – Download the OrgInfo.json File
      - Step 2 – Copy the OrgInfo.json File to the Target Directory
  - Manual Installation of Cisco Secure Client (Windows and macOS)
  - Mass Deployment Overview
  - Contents
  - Remote Installation
    - Profile Installation
    - Customization Options
  - Mass Deployment (Windows)
  - Contents
    - (Optional) Package Customization
      - Add Umbrella Profile
    - Automated Installation (Windows)
      - Install Cisco Secure Client
      - Install the Umbrella Profile
      - (Optional) Disable VPN Functionality (Post installation)
  - Customize Windows Installation of Cisco Secure Client
    - Requirements
    - Prerequisites
    - Procedure
      - Deploy the Cisco Secure Client VPN Module
      - Deploy the Cisco Secure Client Umbrella Roaming Security Module
      - (Optional) Deploy the Cisco Secure Client DART Module
      - Hide Cisco Secure Client from Add/Remove Programs List
    - Optional OrgInfo.json Configurations
  - Mass Deployment (macOS)
  - Contents
    - (Optional) Package Customization
      - Add Umbrella Profile
      - (Optional) Disable VPN Functionality
      - Save the .dmg image
    - Automated Installation (macOS)
      - Installation (Pre-Deployment Package)
      - Installation (Web Deployment Package)
      - Install Umbrella Profile
      - (Optional) Disable VPN Functionality (Post-Installation)
      - Allow Secure Client System Extensions
  - Customize macOS Installation of Cisco Secure Client
    - Requirements
    - Prerequisites
    - Procedure
    - Step 1 – Make the DMG Package Writeable
    - Step 2 – Generate the Module Installation Configuration File
      - Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
      - Step 4 – (Optional) Hide the VPN Module
        
        Step 5 – Customize the Cisco Secure Client Installation Modules
        
        Example – Customize Cisco Secure Client Modules
        
        Step 6 – Set Up the Correct Extension Permission Settings
        
        Step 7 – Install Cisco Secure Client with Selected Modules
  - VPN Headend Deployment
  - Meraki Systems Manager (SM) Deployment
  - Migration from Umbrella Roaming Client
  - Install the Root Certificate for All Browsers
    - Inspect and Decrypt HTTPS Traffic
    - Render Notification Pages
  - Cloud Management
  - Contents
  - Overview
  - Deploying Cisco Secure Client
  - Profiles
  - Uploading the Orginfo.json profile
  - Create a Deployment
  - Post Deployment
    - Additional Reference
  - Additional References
  - Remote Monitoring and Management Deployment Tutorials
- Manage Internet Security on Cisco Secure Client
  - Umbrella Roaming Security Module Requirements
    - System Requirements
    - Network Requirements
      - Secure Access DNS Block Pages
      - Secure Access and SAML Identity Provider Domains
    - Transport Layer Security Protocol
    - Network Access
      - Host Names
      - Secure Access DNS Resolvers
      - Encrypted DNS
      - External DNS Resolution
      - HTTP and HTTPS
      - Secure Access DNS – Client Configuration Services
      - Secure Access DNS – Client Sync Services
      - Secure Access DNS and Web – Client Certificate Revocation Services
    - Roaming Security DNS Requirements
    - Internal Domains
  - Domain Management
    - Internal Domains List
    - DNS Suffixes
    - Operational Flow
      - Configure Internal Domains
      - Cisco Secure Client and External Queries
      - Cisco Secure Client and Internal Queries
    - Advanced Topics
      - Unencrypted
      - DNS Suffixes (Continued)
  - Interpret Internet Security Diagnostics
    - Prerequisites
    - Procedure
      - Generate the Diagnostic Report from the Cisco Secure Client
      - Generate the Diagnostic Report on the Command Line
  - IPv4 and IPv6 DNS Protection Status
    - Prerequisites
    - Procedure
    - DNS and IP Layer State Descriptions
- Manage Zero Trust Access on Cisco Secure Client
  - Invite Users to Enroll in Zero Trust Access for Secure Client
    - Prerequisites
    - Recommended: Use MFA Authentication and Biometric Identity
    - Procedure
  - Requirements for Secure Client with Zero Trust Access
  - Troubleshoot Client-Based Zero Trust Access
    - Pre-Enrollment Errors
    - Enrollment Errors
    - Post-Enrollment Errors
    - Requests to Reauthenticate
  - Unenroll a Device from Zero Trust Access
- Manage Virtual Private Networks on Cisco Secure Client
  - Prerequisites
  - Download the Virtual Private Network XML Profile
    - Prerequisites
    - Procedure
      - Step 1 – Download the Cisco Secure Client VPN Profile
      - Step 2 – Copy the VPN Profile to the Target Directory
Cisco Security for Chromebook Client
- About Cisco Security for Chromebooks
  - Key benefits
- Prerequisites for Cisco Security for Chromebooks Client
- Limitations for Cisco Security for Chromebooks
- Integrate the Google Workspace Identity Service
  - Limitations
  - Prerequisites
  - Procedure
- Deploy the Cisco Security for Chromebooks Client
  - About DNS-Layer Protection
  - High-Level Steps for Deploying Cisco Security for Chromebook Client
    - Step 1. In Secure Access:
    - Step 2. In the Google Admin console
  - Procedure
    - Step 1
    - Step 2
  - Bypass Internal Domains from DNS-over-HTTPS (DoH)
    - Procedure
      - Verification
  - Enable Reporting for Private IP Address of Chromebook Device
    - Prerequisites
    - Procedure
  - Verify Cisco Security for Chromebooks Client Deployment
    - Procedure
  - Export Device Data to CSV
    - Procedure
  - Troubleshoot Cisco Security for Chromebooks Client Deployment
    - Procedure
- View Protection Status of Chromebook Devices
  - Procedure
- Add Policies to a Chromebook Device
  - Prerequisites
  - Procedure
- Cisco Security for Chromebooks Client FAQ
- Google Workspace Identity Service FAQ

Cisco Secure Access - DNS Defense Help Network Requirements for Secure Access Secure Access Secure Web Gateway Services Ingress IP Addresses for the Secure Web Gateway

Last updated: Jan 30, 2026

Previous topic Egress IP Addresses for the Secure Web Gateway Next topic Secure Access Encrypted Web Requests