Procedure for Pointing Your DNS to Cisco Secure Access

Login

Cisco Secure Access DNS Defense Help

Cisco Secure Access - DNS Defense Help
- Welcome to Cisco Secure Access – DNS Defense
  - Sign into Secure Access – DNS Defense with Security Cloud Sign On
  - Find Your Organization ID
  - Determine Your Current Package
  - View Cloud Security Service Status
    - Secure Access Service Status
    - Past Incidents
- Secure Access Single Sign-On Authentication
  - Configure Single Sign-On Authentication
    - Procedure for Configuring Single Sing-on Authentication
- Get Started
  - Begin Secure Access Onboarding Workflow
  - Step 1 – Configure Network Connections
    - Task 1 – Add Network Connections
    - Task 2 – Provision Users and Groups
    - Task 3 – Configure Integrations with SAML Identity Providers
  - Step 2 – Configure Access to Resources
    - Task 1 – Set Up Private Resources
    - Task 2 – Configure Rule Defaults and Global Settings
    - Task 3 – Add a Policy Rule
  - Step 3 - Configure End User Connectivity
  - Step 4 – Configure Endpoints and Network Sources
  - Secure Access Overview Dashboard
    - Get Started Workflow
    - Connectivity
    - Data Transfer
    - Security
    - Users and Groups
    - Private Resources
- Limitations and Range Limits
  - Internet Protocol Versions
  - Secure Access Components
  - Identity Integrations
  - Users and Roles
  - Reporting
  - Data Retention
  - Monthly DNS Query Average
- Network Requirements for Secure Access
  - Secure Access DNS Resolvers
    - Best Practices
    - Cisco Secure Client
    - Cisco Secure Client and External DNS Resolution
  - Secure Access Encrypted DNS Queries
  - Secure Access DNS, Web, and Block Pages
  - Secure Access DNS and Web – Client Configuration Services
  - Secure Access DNS and Web – Client Sync Services
  - Secure Access DNS and Web – Client Certificate Revocation Services
  - Cisco Secure Client and Captive Portal Detection
  - Transport Layer Security Protocol Requirements
  - Secure Access Secure Web Gateway Services
  - Secure Access Encrypted Web Requests
  - Secure Access Realtime DLP Secure ICAP
  - Secure Access SaaS Tenants
  - Secure Access SAML Gateway Services
  - Secure Access SAML Identity Provider Domains
    - Azure AD SAML Identity Provider
  - Secure Access SAML Gateway Client Certificate Revocation Services
  - Secure Access VPN Services
  - Secure Access VPN Client Certificate Revocation Services
  - Secure Access Zero Trust Client-Based Enrollment Services
  - Secure Access Zero Trust Client-Based Proxy Services
  - Secure Access Zero Trust Client-Based Proxy – Client Certificate Revocation Services
  - Secure Access Zero Trust Proxy Services – Unmanaged Devices
  - Secure Access Zero Trust Services and Connector Groups
- Manage Network Connections
  - Comparison of Network Connection Methods
- Manage Network Tunnel Groups
  - Device Compatibility and Network Tunnels
  - Add a Network Tunnel Group
    - Procedure for Adding a Network Tunnel Group
      - Configure Tunnel on Network Device
  - Delete a Network Tunnel Group
  - Edit a Network Tunnel Group
  - View Network Tunnel Group Details
  - Supported IPsec Parameters
- Network Tunnel Configuration
  - Establish a Tunnel
    - Maximum Transmission Unit (MTU) Size
    - Tunnel Size
    - Client Reachable Prefixes
    - Throughput and Multiple Tunnels
  - Configure Tunnels with Catalyst SD-WAN cEdge and vEdge
    - Step 1: Add a Network Tunnel Group in Secure Access
    - Step 2: Configure Cisco Catalyst SD-WAN Templates
      - Define the Feature Template
      - Add the IPsec Interface Template
    - Configure Static Routes
    - Verify Tunnel Status
  - Configure Tunnels with Cisco ISR
    - Configure Tunnels in Secure Access
    - Configure ISR (G2, 4K) or CSR
    - Test Your Configuration
  - Configure Tunnels with Cisco Adaptive Security Appliance
    - Configure Tunnels in Secure Access
    - Configure ASA
    - Test and Verify
  - Configure Tunnels with Meraki MX
    - Caveats and Considerations
    - Supported Use Cases and Requirements
    - Step 1: Add a Network Tunnel Group in Secure Access
    - Step 2: Configure a Tunnel in Meraki MX
    - Verification and Troubleshooting
    - Optional Configurations
- Manage Resource Connectors and Connector Groups
  - Overview: Setting Up Resource Connectors and Connector Groups
  - Requirements and Prerequisites for Resource Connectors and Connector Groups
    - Requirements and Guidelines for Connectors
    - Connectivity Requirements
    - Capacity Requirements
  - Allow Resource Connector Traffic to Secure Access
  - Add Resource Connector Groups
    - Prerequisites
    - Guidelines for Configuring Domains and DNS Servers on Connectors Groups
    - Procedure
      - Configure Connector Group Name and Region
      - Estimate the Volume of Traffic to Your Resource Connectors
      - (Optional) Add Domains and DNS Servers for the Connector Group
    - What's Next
  - Add Connectors to a Connector Group
    - Step 1 – Deploy Secure Access Resource Connectors
    - Step 2 – Confirm Connectors
    - Step 3 – Assign Private Resources to Connector Group
  - Obtain the Connector Image
    - Get the Connector Image for AWS
    - Get the Connector Image for Microsoft Azure
    - Download the Connector Image for VMware
  - Provisioning Keys for Resource Connectors
    - Copy the Provisioning Key for a Connector Group
  - Deploy a Connector in VMware
    - Add a Connector Group
    - Obtain the Connector Image
    - Disk Encryption
    - UEFI Secure Boot Environment for Resource Connector Images
    - Procedure for Deploying a Connector in VMware
    - Step 1 – Extract the Connector Image for VMware Tar File
    - Step 2 – Verify the Integrity of the Image
    - Step 3 – Deploy the OVF Template
    - Step 4 – Power on Connector Instances
    - Step 5 – Confirm Connectors
  - Deploy a Connector in AWS
    - Get Connector Images on the AWS Marketplace
    - UEFI Secure Boot Environment for Resource Connector Images
    - Procedure
      - Step 1 – Launch an Amazon Machine Image for the Connector Instance
      - Step 2 – Configure the Connector
      - Step 3 – Launch the Connector Instance
  - Deploy a Connector in Azure
    - Prerequisites for Deploying a Connector in Azure
    - Procedure
      - Step 1 – Get Connector Images on Microsoft Azure Marketplace
      - Step 2 – Configure the Resource Connector Virtual Machine
      - Step 3 – Connect to the Resource Connector Instance
  - Determine the Number of Connectors Needed in a Connector Group
    - Procedure for Determine the Number of Connectors Needed in a Connector Group
  - Assign Private Resources to a Connector Group
    - Procedure for Assigning Private Resources to a Connector Group
  - View a Connector Group's Connectors and Assigned Resources
  - Disable, Revoke, or Delete Resource Connectors and Groups
    - Disable, Revoke, or Delete a Connector
    - Disable or Delete a Resource Connector Group
  - Maintain and Monitor Resource Connectors and Connector Groups
    - Connector Platform Operating System (OS) Updates
    - Monitor Connector and Connector Group Status
      - Check Connector Group Status on the Overview Page
      - Check Connector Group Status on the Connector Groups Page
      - Check Connector Status
    - Increase Connector Group Capacity
    - Check Connector CPU Load
  - Troubleshoot Resource Connectors and Connector Groups
    - General Troubleshooting
    - About Resource Connector Issues
    - Throughput Capacity is Less Than Expected
    - Users Cannot Connect to Private Resources
    - Connector Software Auto-Upgrade Fails
    - Connector Operating System (OS) Version has Security Vulnerabilities
    - Connector is Expired
      - Check the Status of Your Connector
      - (VMware Only) View Connector Diagnostic Information
      - Check for an Expired Connector in Secure Access
      - Clean Up an Expired Connector
    - Stop a Connector
    - Unable to Revoke or Delete a Connector
    - (Container Only) Connector Troubleshooting Tools
    - (VM Only) Connector Diagnostics (CLI)
      - Run the Diagnostic Command
    - Diagnostic Codes
      - Diagnostic Codes for Connector Update Issues
      - Diagnostic Codes for Other Connector Issues
      - Supported Standard Linux Troubleshooting Commands
- Manage Users and Groups
  - Import Users and Groups from CSV File
    - CSV File Format
    - CSV File Fields
    - Procedure for Importing Users and Groups from CSV file
    - View Provisioned Users and Groups in Secure Access
  - Provision Token for Identity Provider
    - Procedure for Provisioning a Token for Identity Provider
    - Configure Identity Providers
  - Provision Users and Groups from Okta
    - Prerequisites for Provision Users and Groups from Okta
    - Limitations
    - Supported Features
    - Import the ObjectGUID Attribute from Okta to Secure Access
    - Configure the Cisco Secure Access App
      - Step 2 – Add the Secure Access SCIM Token to the App
      - Step 3 – Configure the Required User Options
      - Step 4 – (Optional) Add a New Attribute and Create the User Profile Mapping
      - Step 5 – Assign Users and Groups in the App
      - Step 6 – View Logs in the App
    - View Provisioned Users and Groups in Secure Access
  - Provision Users and Groups from Azure AD
    - Prerequisites for Provisioning Users and Groups from Azure AD
    - Limitations
    - Procedure for Provisioning Users and Groups from Azure AD
    - Configure the Cisco User Management for Secure Access App
    - View Users and Groups Provisioned from Azure
  - Provision Users and Groups from Google Workspace
  - View User Details
    - User Details
  - View Group Details
    - Procedure for Viewing Group Details
    - Group Details
  - View Endpoint Device Details
  - Unenroll Devices for Client-Based Zero Trust Access
    - Procedure to Unenroll Devices for Client-Based Zero Trust Access
  - Disconnect Remote Access VPN Sessions
    - Procedure for Disconnecting Remote Access VPN Sessions
  - Provision Users, Groups and Endpoint Devices from Active Directory
    - Prerequisites for AD Connectors
      - Connector Server
      - Outbound Network Access to Secure Access
      - Connector Account
    - Connect Active Directory to Secure Access
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
      - Step 1 – Choose a Provisioning Method
      - Step 2 – Register a Domain Controller or Domain in Secure Access
        
        Register a Domain Controller
        
        Register a Domain
      - Step 3 – Install the Secure Access AD Connector
      - Step 4 – Configure Updates on Deployed AD Connectors
      - Step 5 – Verify that the Connector Syncs with Secure Access
      - Specify AD Groups of Interest
        
        Sample File Entries
        
        Total Number of Groups Selected for Synchronization
    - Connect Multiple Active Directory Domains
    - Change the Connector Account Password
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
      - Procedure for Changing the Connector Account Password
    - AD Connector Communication Flow and Troubleshooting
      - Troubleshooting
    - View AD Components in Secure Access
      - View AD Components in Secure Access
- Configure Integrations with SAML Identity Providers
  - Use Cases
  - Configure Identity Providers for SAML Authentication
  - Prerequisites for SAML Authentication
    - Requirements
  - Configure Azure AD for SAML
    - Procedure for Configuring Azure AD for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Azure AD
      - Step 3c – Add the Azure SAML Metadata to Secure Access
    - Test the Identity Provider Integration
  - Configure Okta for SAML
    - Procedure for Configuring Okta for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Configure the Identity Provider's SAML Metadata
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Okta
      - Step 3c – Add the Okta SAML Metadata to Secure Access
    - Test the Identity Provider Integration
  - Configure AD FS for SAML
    - Procedure for Configuring AD FS for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add the Secure Access Service Provider Metadata to AD FS
      - Step 3c – Add the AD FS SAML Metadata to Secure Access
    - Test the Identity Provider Integration
  - Configure Duo Security for SAML
    - Procedure for Configuring Duo Security for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to Duo Security
      - Step 3c – Add the Duo Security SAML Metadata to Secure Access
    - Test the Identity Provider Integration
  - Configure Ping Identity for SAML
    - Procedure for Configuring Ping Identity for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add the Identity Provider's SAML Metadata
      - Step 3c – Add the Ping Identity SAML Metadata to Secure Access
    - Test the Identity Provider Integration
  - Configure OpenAM for SAML
    - Procedure for Configuring OpenAM for SAML
    - Step 1 – Choose an Authentication Method
    - Step 2 – Add an Identity Provider
    - Step 3 – Add the Identity Provider's SAML Metadata to Secure Access
      - Step 3a – Download the Secure Access Service Provider files
      - Step 3b – Add Secure Access Service Provider Metadata to OpenAM
      - Step 3c – Add the OpenAM Metadata to Secure Access
    - Test the Identity Provider Integration
  - SAML Certificate Renewal Options
    - Prerequisites for SAML Certificate Renewal Options
    - Manual Import of the Secure Access SAML Certificate
  - Test SAML Identity Provider Integration
    - Procedure for Testing SAML Identity Provider Integration
  - Delete SAML Identity Provider Integration
    - Procedure for Deleting SAML Identity Provider Integration
- Manage End-User Connectivity
- Manage DNS Servers
  - Add a DNS Server
  - View DNS Servers
  - Edit a DNS Server
  - Delete a DNS Server
  - Map DNS Servers to Regions
- Traffic Steering for Zero Trust Access Client-Based Connections
  - Using Wildcards to Configure Traffic Steering for Private Destinations
    - Procedure for Configuring Traffic Steering for Private Destinations
- Manage Virtual Private Networks
  - FQDNs for Network Connections
  - Manage IP Pools
  - Add an IP Pool
    - Add an IP Pool
    - Add a RADIUS Group (optional)
  - Manage VPN Profiles
  - Add VPN Profiles
    - Step 1 – General Settings
    - Step 2 – Authentication, Authorization, and Accounting
      - SAML
      - SAML Configuration
      - SAML Metadata XML Configuration
      - Manual Configuration
      - RADIUS
      - Certificate
    - Step 3 – Traffic Steering (Split Tunnel)
    - Step 4 – Cisco Secure Client Configuration
  - Add a RADIUS Group
- Manage Internet Security
  - Next Steps
  - Set Up Internet Security on User Devices
    - Download the Secure Client (OrgInfo.json)
    - Download the Roaming Client
  - Manage Internet Security
    - Steer Traffic to Secure Access or Bypass Domains
    - List Bypass Domains in Secure Access
  - Configure Cisco Secure Client Settings
    - Configure Advanced Security Settings
    - Use Active Directory for Access Policy
    - Third Party VPN Compatibility
    - Client settings
    - DNS Backoff Settings
- Manage Domains
  - Add Internal Domains
    - Procedure for Adding Internal Domains
- Internal Networks Setup Guide
  - Provision a Subnet for Your Virtual Appliance
  - Manage Sites
    - Procedure for Managing Sites
  - Manage Internal Networks
    - Procedure for Managing Internal Networks
    - Apply DNS Policies to Internal Network
  - Assign a Policy to Your Site
- Manage a Network Device
  - Procedure for Managing a Network Device
  - Delete a Network Device
- Manage Registered Networks
  - Add Network Resources
    - Dynamic IP Address—IPv4 Only
    - Procedure for Adding Network Resources
      - Step 1 – Select the Network
      - Step 2 – Configure the Network Resource
      - Step 3 – Change the DNS Settings on Your Relevant Network Device
      - Step 4 – Apply a Policy Rule to the Network Resource
      - Step 5 – Test Your Network
  - Point Your DNS to Cisco Secure Access
    - Procedure for Pointing Your DNS to Cisco Secure Access
      - Step 1 – Identify Where Your Public DNS Server Addresses are Configured
      - Step 2 – Log Into the Server or Router Where DNS is Configured
      - Step 3 – Change Your DNS Server Addresses
        
        Primary and Secondary Servers
      - Step 4 – Test Your New DNS Settings
  - Clear Your DNS Cache
    - Clear Your DNS Cache on Computers and Servers
    - Clear Your DNS Cache on Browsers
  - Update a Network Resource
    - Prerequisites
    - Edit the Registered Network Resource Name
    - Update the Registered Network Resource
  - Delete a Network Resource
- Manage Roaming Devices
  - View Internet Security Settings for Roaming Devices
    - Procedure for Viewing Internet Security Settings for Roaming Devices
    - Host Information
  - Edit Internet Security Settings for Roaming Devices
    - Edit the Auto-Delete Interval for Roaming Devices
  - Delete a Roaming Device
- Manage Destination Lists
  - Best Practices
  - How to Format Your Destination List
  - Add a Destination List
    - Procedure for Adding a Destination List
  - Edit a Destination List
    - Procedure for Editing a Destination List
  - Add Destinations in Bulk
    - Procedure for Adding Destinations in Bulk
  - Download Destinations to a CSV File
    - Procedure for Downloading Destinations to a CSV File
  - Control Access to Custom URLs
    - Prerequisites for Controlling Access to Custom URLs
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Punycode Domain Name to Destination List
  - Test Your Destinations (Hidden in SSE/SSE DNS)
  - Search for a Destination List
  - Troubleshoot Destination Lists
- Manage Internet and SaaS Resources
- Manage Application Lists
  - Add an Application List
    - Procedure for Adding an Application List
  - Application Categories
  - Delete an Application List
- Manage Content Category Lists
  - Available Content Categories
  - Add a Content Category List
    - Procedure for Adding a Content Category List
  - Request a Category for an Uncategorized Destination
  - Dispute a Content Category
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - View Content Categories in Reports
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
- Manage Private Resources
  - Step 1 – Configure Private Resources
    - Optional Configuration for Private Resources
  - Step 2 — Set Up Network Connections, VPN Profiles, and Certificates
  - Step 3 — Add Private Resources in Private Access Rules
  - Step 4 — Set Up the Cisco Secure Client and Distribute URLs
  - Add a Private Resource
    - Prerequisites for Adding a Private Resource
    - Procedure for Adding a Private Resource
      - Communication with Secure Access Cloud
      - Endpoint Connection Methods
      - Resource Connector Groups
      - Decryption
      - Associated Rules
      - What's Next
  - Add a Private Resource Group
    - Procedure for Adding a Private Resource Group
  - Private Resource Configuration Examples
- Manage AAA Servers
- Manage Connections to Private Destinations
  - Comparison of Zero Trust Access and VPN
  - Comparison of Client-Based and Browser-Based Zero Trust Access Connections
  - Requirements for Zero Trust Access
  - Network Authentication for Zero Trust Access
  - Manage Branch Connections
    - Endpoint Connection Methods
    - Branch Networks in Private Access Rules
      - Users and Groups Connections to Private Resources
      - Sources for Branch Network Connections
      - Destinations for Branch Network Connections
      - Source Connections to Destinations
    - Add an IPS Profile on Private Access Rules
    - Log Connections From Branch Networks to Private Resources
- Manage the Access Policy
  - About the Access Policy
    - Best Practices
    - Default Rule Data
  - Show Additional Data on Your Access Rules
    - Procedure for Showing Additional Data on Your Access Rules
  - Edit the Order of the Rules in Your Access Policy
  - Rule Defaults: Default Settings for Access Rules
    - Zero Trust Access: Endpoint Posture Profiles
    - Zero Trust Access: User Authentication Interval
    - Intrusion Prevention (IPS)
  - Global Settings for Access Rules
  - Edit Rule Defaults and Global Settings
    - Prerequisites for Editing Rule Defaults and Global Settings
    - Procedure for Editing Rule Defaults and Global Settings
  - Edit the Default Access Rule
    - Default Internet Access Rule
    - Default Private Access Rule
    - To View or Edit Default Access Rules
- Get Started with the Cisco Assistant
  - Procedure for Getting Started with the Cisco Assistant
  - Cisco Assistant Navigation
  - What's Next
  - Add Rules with the Cisco Assistant
  - Enter a Natural Language Prompt to Generate Policy Rules
  - Cisco Assistant Rule Examples
  - Contextual Conversations
  - Find Documented Answers with the Cisco Assistant
    - Best Practices for Prompts
    - Contextual Conversations
  - Troubleshoot with the Cisco Assistant
  - Messages Generated by the Cisco Assistant
    - Examples of Cisco Assistant Responses to Prompts
  - Optimize Access Policies with Cisco AI Assistant
    - Procedure
  - Create TAC Cases with Cisco AI Assistant
    - Procedure
- Get Started With Private Access Rules
  - Components for Private Access Rules
    - Sources
    - Destinations
      - Private Resources
      - Private Resource Groups
    - Endpoint Posture Profiles (for Endpoint Requirements)
  - Default Settings for Private Access Rules
  - Add a Private Access Rule
    - Prerequisites for Adding a Private Access Rule
    - Set Up the Private Access Rule
      - Enable the Rule and Edit Your Logging Settings
      - Add a Rule Name
      - Choose a Rule Order
    - Step 1 — Specify Access Options
      - Rule Action
      - Sources
      - Destinations
      - Endpoint Requirements
      - User Authentication Requirements
    - Step 2 — Configure Security Control Options
    - Summary
  - About Configuring Sources in Private Access Rules
    - Composite Sources for Private Access Rules
      - IP Addresses, CIDR Blocks, and Wildcard Masks
      - Add Composite Sources
      - Combining IPs, CIDRs, or Wildcard Masks on a Source
    - Use Wildcard Masks in Composite Sources
      - Guidelines
      - Examples of Wildcard Masks
    - Combining Multiple Sources in a Rule (Boolean logic)
  - About Configuring Destinations in Private Access Rules
    - Destination components for Private Access Rules
    - Composite Destinations for Private Access Rules
      - Add Composite Destinations
      - Combining Destination Components as a Single Destination
    - Use Wildcard Masks in Composite Destinations
      - Guidelines
      - Examples of Wildcard Masks
    - Combining Multiple Destinations in a Rule (Boolean Logic)
  - About Endpoint Requirements in Access Rules
  - Allowing Traffic from Users and Devices on the Network
  - Global Settings for Private Access Rules
  - View Rules Associated with a Private Resource
  - Troubleshoot Private Access Rules
    - Problems While Creating a Rule
    - Problems After Creating a Rule
      - Traffic is unexpectedly blocked
      - Traffic is unexpectedly allowed
      - Rule does not match traffic as expected
- Get Started With Internet Access Policy
  - Components for Internet Access Rules
    - Sources
    - Destinations
    - Security Controls
      - Security Profile
        
        Configure Threat Category Settings
        
        Set Up Certificates for Decrypting Internet Traffic
        
        Configure Do Not Decrypt Lists
        
        (Optional) Configure Custom End-User Block and Warn Notifications
        
        Configure Security Profiles for Internet Access
  - Default Settings for Internet Access Rules
  - Add an Internet Access Rule
    - Prerequisites for Adding an Internet Access Rule
    - Procedure for Adding an Internet Access Rule
    - Access Options
      - Disable or Enable the rule
      - Logging settings
      - Summary
      - Rule name
      - Rule order
      - Rule action
      - Pre-Configured Sources
      - Composite Sources
      - Pre-Configured Destinations
      - Composite Destinations
      - App Risk Profile
      - Advanced Application Controls
    - Security Control Options
      - Security Profile
    - Next Steps
  - About Configuring Sources in Internet Access Rules
    - Source Components for Internet Access Rules
    - Composite Sources for Internet Access Rules
    - Combining Multiple Sources in a Rule (Boolean logic)
  - About Configuring Destinations in Internet Access Rules
    - Destination Components for Internet Access Rules
    - Pre-Configured Destinations on an Internet Rule
    - Application Lists and Application Categories on an Internet Rule
    - Application Protocols on an Internet Rule
      - How Application Protocols Combine with Composite Destinations
    - Composite Destinations for Internet Access Rules
      - Combining Destination Components as a Single Destination
    - Combining Multiple Destinations in a Rule (Boolean Logic)
    - Number of Destinations in a Rule
  - Ensure Rule Matching for Encrypted Internet Traffic
  - Block Internet Access to Geographic Locations
  - Advanced Application Controls
    - Applications with Advanced Controls
      - Cloud Storage
      - Collaboration
      - Content Management
      - Media
      - Office Productivity
      - P2P
      - Social Networking
    - Procedure for Advanced Application Controls
    - Troubleshooting
  - Global Settings for Internet Access Rules
  - About Isolated Destinations
    - Prerequisites for About Isolated Destinations
    - Secure Access Package Support for RBI and Isolation Rules
    - Verifying Isolation
    - Limitations of Isolation
  - Troubleshoot Internet Access Rules
    - Problems while creating the rule
    - Problems after creating a rule
      - Internet traffic is unexpectedly blocked
      - Internet traffic is unexpectedly allowed
      - Internet Access rule is not matching traffic as expected
  - Zero Trust Access to Internet Destinations
    - Solution Overview
- Manage File Inspection for Internet Policy
  - How File Inspection Works
    - How is a File Inspected?
      - Cisco Advanced Malware Protection (AMP) Scanning
      - Antivirus Scanning
  - Enable File Inspection
    - Procedure for enabling file inspection
  - Test File Inspection
  - Troubleshooting
    - Contact Support
  - File Inspection Reports
    - Security Activity Report for File Inspection
    - Security Activity Report for Activity Search
- Manage File Inspection and File Analysis for Private Access Rules
  - Overview of Configuring File Inspection and Analysis
  - File Inspection Details
    - Cisco Advanced Malware Protection (AMP)
    - Antivirus Scanner
  - Cisco Secure Malware Analytics (formerly Threat Grid) Details
    - Supported Files and File Limitations
    - Secure Malware Analytics Sandbox
  - Enable File Inspection
    - Prerequisites for Enabling File Inspection
    - Procedure
  - Enable File Analysis by Cisco Secure Malware Analytics
    - Prerequisites for Enabling File Analysis by Cisco Secure Malware Analytics
    - Procedure for Enabling File Analysis by Cisco Secure Malware Analytics
  - Test File Inspection
    - Procedure for Testing File Inspection
      - Block Page Diagnostic Information
  - Monitor File Inspection and Analysis Activity
    - Monitor and Review Secure Malware Analytics
      - Monitor File Submission Limits
  - Troubleshoot and Monitor File Inspection and Analysis
- Manage File Type Controls
- Manage the Intelligent Proxy
  - How the Intelligent Proxy Works
  - Advantages of Using the Intelligent Proxy
  - Sites That are Not Proxied by the Intelligent Proxy
  - Best Practices
  - SSL Decryption Requirements and Implementation
  - Do Not Decrypt Lists
  - Enable the Intelligent Proxy
    - Procedure for Enabling the Intelligent Proxy
  - Test the Intelligent Proxy
    - Procedure for Testing the Intelligent Proxy
  - Test Selective Decryption
    - Procedure for Testing Selective Decryption
  - Review the Intelligent Proxy Through Reports
    - Procedure for Reviewing the Intelligent Proxy Through Reports
  - Enable SSL Decryption
    - Root Certificate Requirement
    - Prerequisites for Enabling SSL Decryption
    - Procedure for Enabling SSL Decryption
- Manage Endpoint Security
  - Endpoint Attributes
    - Supported Operating Systems
- Manage Zero Trust Access Posture Profiles
  - Add a Client-Based Zero Trust Access Posture Profile
    - Procedure for Adding a Client-Based Zero Trust Access Posture Profile
  - Add a Browser-Based Zero Trust Access Posture Profile
    - Procedure for Adding a Browser-Based Zero Trust Access Posture Profile
- Manage VPN Connection Posture Profiles
  - Add a VPN Connection Posture Profile
    - Procedure for Adding a VPN Connection Posture Profile
- Manage IPS Profiles for Private Access
  - Cisco-Provided IPS Signature Lists
  - Decryption is Required for Effective Intrusion Prevention
- Manage Security Profiles
  - Security Profiles for Internet Access
    - Functionality Included in a Security Profile for Internet Access
    - Decryption
    - SSO Authentication
      - Requirements for Enabling OIDC Authentication
      - Requirements for Enabling SAML Authentication
      - Requirements for Disabling SAML Authentication
    - Security and Acceptable Use Controls
    - End-User Notifications
    - Get Started: Security Profiles for Internet Access
  - Add a Security Profile for Internet Access
    - Prerequisites
    - Procedure
    - Add a Security Profile
    - Security and Acceptable Use Controls
      - Threat Categories
      - File Inspection
      - SafeSearch
      - Intelligent Proxy
    - Configure End-User Notifications
    - View Security Profiles
    - Configure Additional Security Options
    - Add a Security Profile on Internet Access Rules
    - Edit a Security Profile
    - Delete a Security Profile
  - Enable SafeSearch
    - Enable SafeSearch
    - Confirm That SafeSearch is Working
      - Google
      - YouTube
      - Yahoo
      - Bing
  - Security Profiles for Private Access
  - Add a Security Profile for Private Access
    - Prerequisites
    - Procedure
    - Next steps
- Manage Threat Categories
  - Threat Category Descriptions
  - Add a Threat Category List
    - Prerequisites
    - Procedure
  - Dispute a Threat Categorization
    - Prerequisites
    - Procedure
  - Threat Intelligence Feeds
  - Add Threat Intelligence Feeds
    - Prerequisites
    - Additional Prerequisites for Cisco AMP Threat Grid
    - Enable Third-Party Platform Feeds
    - Add a Threat Intelligence Feed
    - Add Threat Intelligence Feeds to Internet Access Rule
      - List the Blocked Domains
    - Logging and Reports
      - View Reports
      - View Admin Audit Log
      - Access Logs in S3
  - Custom Feed Best Practices
    - Known Domains and Destination Lists
    - Delete a Domain from Custom Destination Block List
- Manage Notification Pages
  - Display Custom Notification Pages to End Users
  - Preview Notification Pages
    - Procedure for Previewing Notification Pages
  - Create Custom Block pages
    - Create Custom Block pages
    - Link a Custom Notification Page Appearance to a Security Profile
    - Next Steps
  - Allow Users to Contact an Administrator
    - Procedure for Allowing Users to Contact an Administrator
  - Block Page IP Addresses
    - IP Addresses for Secure Access Block Pages
- Manage Traffic Decryption
  - Internet Access Features Requiring Decryption
  - Internet Traffic That Should Not Be Decrypted
  - Decryption in Private Access Rules
  - Decryption Settings
  - Decryption Requires Certificates
  - Troubleshooting Decryption
  - Important Information About Do Not Decrypt Lists
  - Add a Do Not Decrypt List
    - Procedure for Adding a Do Not Decrypt List
- Manage Certificates
  - Certificate Installation Methods
  - Manage the Cisco Umbrella Root Certificate
    - Why Install a Certificate?
    - Install the Cisco Umbrella Root Certificate
      - Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)
        
        Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
        
        Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
        
        Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy
        
        Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console
      - Manually Install the Cisco Umbrella Root Certificate (Single Computer)
        
        Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows
        
        Install the Cisco Umbrella Root Certificate in Firefox on Windows
        
        Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X
        
        Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line
        
        Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux
  - Manage the Secure Access Root Certificate
    - Certificate Installation Methods
    - Install the Cisco Secure Access Root Certificate
      - Automatically Install the Cisco Secure Access Root Certificate (For an Active Directory Network)
        
        Install the Cisco Secure Access Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
        
        Install the Cisco Secure Access Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
      - Install the Cisco Secure Access Root Certificate in Firefox Using Group Policy
      - Install the Cisco Secure Access Root Certificate on Chromebooks Using the Google Admin Console
      - Manually Install the Cisco Secure Access Root Certificate (Single Computer)
        
        Install the Cisco Secure Access Root Certificate in Edge or Chrome on Windows
        
        Install the Cisco Secure Access Root Certificate in Firefox on Windows
        
        Install the Cisco Secure Access Root Certificate in All Browsers on Mac OS X
        
        Install the Cisco Secure Access Root Certificate on Mac OS X Through the Command Line
        
        Install the Cisco Secure Access Root Certificate in Chromium or Chrome on Linux
  - View the Cisco Trusted Root Store
    - Prerequisites
      - Download the Cisco Trusted Union Root Bundle
    - Extract the Certificates
      - Step 1: Extract the Signing Certificate
      - Step 2: Extract Certificate Bundle as Message
      - Step 3: Extract PEM-Formatted Certificates From Bundle
      - Step 4: Generate Individual Certificate Files
        
        Linux
        
        macOS
    - View an Individual Certificate File
  - Certificates for Internet Decryption
    - Certificates for Displaying Notifications
    - Certificates for Decrypting Internet Traffic
      - Option 1: Distribute Self-Signed Certificates to End-User Devices
      - Option 2: Use a Signed Certificate for Decrypting Internet Traffic
  - Manage Certificates for Private Resource Decryption
    - Prerequisites
      - Install a Certificate Authority Certificate on a Private Resource
    - Procedure
      - View Notifications About Expired Private Resource Certificates
      - Upload Private Resource Certificates
        
        Option 1: Upload or enter a certificate-key pair directly to the private resource
        
        Option 2: Upload a certificate and key to the Certificates page
  - Certificates for Private Resource Decryption
  - Certificates for SAML Authentication
  - Manage SAML Certificates for Service Providers
    - Prerequisites
    - Procedure
      - View Notifications About Expired Service Provider Certificates
      - Download Zero Trust Service Provider Certificates
      - Download Virtual Private Network Service Provider Certificates
  - Manage SAML VPN Service Provider Certificate Rotation
    - Prerequisites
    - Procedure
      - View Notifications About Expired Service Provider Certificates
      - Activate a New VPN Service Provider Certificate
  - Manage SAML Certificates for Identity Providers
    - Prerequisites
    - Procedure
      - View Notifications About Expired Identity Provider Certificates
      - Manage Zero Trust Identity Provider Certificates
      - Manage Virtual Private Network Identity Provider Certificates
  - VPN Certificates for User and Device Authentication
  - Push the Cisco Root Certificate to Managed Devices
    - Prerequisites
    - Procedure
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Edit Account Settings
    - Prerequisites
    - Procedure
  - Delete an Account
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-identification
    - Disable De-identification
    - Limitations
- Manage SaaS API Data Loss Prevention
  - Enable SaaS API Data Loss Prevention
    - Prerequisites
    - Procedure
  - Revoke SaaS API Data Loss Prevention for a Platform
    - Prerequisites
    - Procedure
  - Enable SaaS API Data Loss Prevention for Google Drive Tenants
    - Prerequisites
    - Validation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Webex Teams Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Microsoft 365 Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Dropbox Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Box Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable SaaS API Data Loss Prevention for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
- Manage Cloud Malware Protection
  - Cloud Access Security Broker Protection for Google Drive and Microsoft 365
  - Enable Cloud Malware Protection
    - Prerequisites
    - Procedure
  - Revoke Authorization for a Platform
    - Prerequisites
    - Procedure
  - Enable Cloud Malware Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize a Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable Cloud Malware Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable Cloud Malware Protection for Box Tenants
    - Prerequisites
    - Limitations
    - Verify Box Application Settings
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Dropbox Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Microsoft 365 Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Webex Teams
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Google Drive
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
- Manage API Keys
  - Add Secure Access API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Add KeyAdmin API Keys
    - Use Cases
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Log Management
  - Where are Logs Stored?
    - Logging to Amazon S3
    - Advantages and Disadvantages of Configuring a Cisco-Managed Bucket
  - Enable Logging
    - Procedure for Enabling Logging
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites for Enabling Logging to Your Own S3 Bucket
    - Procedure for Enabling Logging to Your Own S3 Bucket
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
  - Enable Logging to a Cisco-managed S3 Bucket
    - Procedure for Enabling Logging to a Cisco-managed S3 Bucket
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
  - Change the Location of Event Data Logs
  - Stop Logging
  - Delete Logs
    - Procedure for Deleting Logs
  - Log Formats and Versioning
    - Log File Name Formats
      - Find Your Log Schema Version
        
        View Your Log Schema Version and Last Sync Time
      - Log File Fields
      - Estimate the Size of a Log
      - Estimate the Size of an Exported Report
    - Reports and CSV Formats
      - Activity Search Report
        
        Zero Trust Access Activity Search Fields
      - Top Categories Report
      - Top Destinations Report
      - Top Resources Report
    - Admin Audit Log Formats
    - Cloud Firewall Log Formats
    - DNS Log Formats
    - IPS Log Formats
    - Remote Access VPN Log Formats
    - Web Log Formats
    - Zero Trust Access Log Formats
Reports
- Monitor Secure Access with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
    - Prerequisites
    - Procedure
  - Report Retention
  - Report Scheduling
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Check Your Spam Folder
      - Unsubscribe From a Scheduled Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Remote Access Log Report
  - View the Remote Access Log Report
    - Prerequisites
    - Procedure
    - View the Remote Access Log Report
    - View Details
- Activity Search Report
  - View and Customize the Activity Search Report
    - Prerequisites
    - View the Activity Search Report
    - Customize the Activity Search Report
    - Save Activity Search Report columns and filters for future use
    - Customize and Manage Saved Searches
  - View Zero Trust Events in Activity Search Report
    - Prerequisites
    - Procedure
      - Access Details
      - Block Details
      - Endpoint Details
  - View Activity Search Report Actions
    - Prerequisites
    - See Full Details
    - Filter Views
  - Schedule an Activity Search Report
  - Use Search and Advanced Search
    - Prerequisites
    - Search
    - Wildcards
      - Domains
      - URLs
      - File Names
    - Advanced Search
- Security Activity Report
  - View Activity and Details by Filters
    - Prerequisites
    - Procedure
  - View Activity and Details by Event Type or Security Category
    - Prerequisites
    - Procedure
      - Group Security Categories
  - View an Event's Details
    - Prerequisites
    - Procedure
  - Search for Security Activity
    - Prerequisites
    - Procedure
      - Advanced Search
- Total Requests Report
  - Prerequisites
  - Procedure
- Activity Volume Report
  - Prerequisites
  - View Requests by Activity Volume
  - View Activity Volume by Threat Category
    - Prevent
    - Contain
  - View Activity Volume by Policy Traffic
  - View Trends Over Time
- App Discovery Report
  - Prerequisites
  - Procedure
  - View the App Discovery Report
    - Prerequisites
    - View the App Discovery Report
  - View the Highest Risk Apps
    - Prerequisites
    - Procedure
  - Review Apps in the Apps Grid
    - Prerequisites
    - Procedure
    - Configure Columns to Display
    - Change an App Label
  - View App Details
    - Prerequisites
    - Procedure
  - Change App Details
    - Prerequisites
    - Change the Risk Score for an App
    - Change the Label of an App
  - Control Apps
    - Prerequisites
    - Procedure
    - Control Application Lists
  - Control Advanced Apps
    - Prerequisites
    - Procedure
- Top Destinations Report
  - Prerequisites
  - View the Top Destinations Report
  - View Further Details
  - Destination Details
    - Prerequisites
    - View the Destination Details
    - View the Request Traffic
      - View Requests by Blocked or Allowed
      - View Requests Through Global Traffic %
    - View the Access and Policy Details
    - View Recent Activity
    - View the Most Visited URL Paths
- Top Categories Report
  - Prerequisites
  - View the Top Categories Report
    - Sort by Traffic
    - Ascending or Descending Order
  - Top Categories Quick View
  - View Category in Other Reports
  - Category Details
    - Prerequisites
    - View a Category's Details Overview
    - View a Category's Traffic
      - View the Activity Breakdown
      - View the Traffic Bandwidth
    - View a Category's Identities
    - View the Category's Top Domains
- Third-Party Apps Report
  - Prerequisites
  - View the Third-Party Apps Report
  - Search the Third-Party Apps Report
  - Export the Third-Party Apps Report
- Cloud Malware Report
  - Prerequisites
  - View the Cloud Malware Report
  - Use the Cloud Malware Report
    - Quarantine a Malicious File
    - Delete a Malicious File
    - Dismiss an Item from the Report
    - Export the Report
- Admin Audit Log Report
  - Prerequisites
  - Generate Admin Audit Log Report
  - Export Admin Audit Log Report to an S3 Bucket
    - Prerequisites
    - Procedure
- Top Threats Report
  - View the Threats Report
  - View Top Threat Types
  - View How Threats Impact Your Environment
  - Search for Threats in Activity Search
  - Threat Type Details
    - Prerequisites
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Top Identities Report
  - Prerequisites
  - View the Top Identities Report
  - View Identity in Other Reports
  - Identity Details
    - Prerequisites
    - View an Identity Report
      - Total Requests Graph
      - Top Destinations report
      - Top Categories report
      - Recent Activity table
DNS Forwarders
- Virtual Appliance Introduction
  - How Secure Access Virtual Appliances Work
  - Benefits of Virtual Appliances
  - Prerequisites
    - Virtual Appliance Requirements
      - VMware Requirements
      - Microsoft Hyper-V Requirements
      - Cloud Platform Requirements
      - KVM Requirements
      - Nutanix Requirements
    - Networking Requirements
      - SSH Support Tunnel
      - Networking: Additional Considerations
    - DNSCrypt
  - Deployment Guidelines
    - Virtual Appliance Deployment Best Practices
      - Redundancy
      - Multiple DNS Egresses
      - Single DNS Egress
      - Double NAT
  - Importance of Running Two VAs
    - Benefits of Two VAs
- Deploy Virtual Appliances
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Procedural Overview
    - 1. Download the Hyper-V Installer
      - 2. Import the Virtual Appliance
      - 3. Copy and Rename Image Files
      - 4. Select Network Adapter
      - 5. Select Hard Drive
      - 6. Power on the Virtual Machine
      - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Procedural Overview
    - 1. Download OVF Template
      - 2. Deploy OVF Template
      - 3. Deploy a Second Virtual Appliance
      - 4. Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
      - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
    - Procedural Overview
    - 1. Prepare the Virtual Appliance Amazon Machine Image
      - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
    - Procedural Overview
    - Prepare the Virtual Appliance Instance Template on GCP
      - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
    - Procedural Overview
    - 1. Create the qcow2 files for KVM
      - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
    - Procedure
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is a Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Secure Access Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Secure Access Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Support Tunnel From the VA
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed in Azure
  - Troubleshoot DNS Resolution in Configuration Mode
  - Troubleshoot DNS Resolution Failures Behind a Firewall
  - Troubleshoot Egress Network Connectivity From VA
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure DNS Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Anycast
        
        Configure Anycast over BGP on the VA
        
        Configure Load Balancing
        
        Configure Identity Association Timeouts
- Active Directory Integration with the Virtual Appliances
  - Network Diagram for VA Deployments
  - Prerequisites
    - Connector Server
    - Outbound Network Access to Cisco Secure Access
    - Connector Account
  - Active Directory User Exceptions
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
    - Set Up Active Directory User Exceptions
    - Set Up Active Directory Group Exceptions
    - Set Up Active Directory IP Address Exceptions
  - Prepare Your Active Directory Environment
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Secure Access
      - Connector Account
    - Step 1 – Choose a Provisioning Method
    - Step 2 – Register a Domain Controller or Domain in Secure Access
      - Register a Domain Controller
      - Register a Domain
    - Step 3 – Install the Secure Access AD Connector
    - Step 4 – Configure Updates on Deployed AD Connectors
    - Step 5 – Verify that the Connector Syncs with Secure Access
    - Specify AD Groups of Interest
      - Supported Organizational Units
      - Unsupported Organizational Units
      - Sample File Entries
      - Total Number of Groups Selected for Synchronization
  - Connect Active Directory to Umbrella VAs
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Specify AD Groups of Interest
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Multiple Active Directory and Secure Access Sites
    - Active Directory Sites and Secure Access Sites
      - Active Directory Sites and Services
      - Secure Access Sites
      - When to Use Secure Access Sites
      - Caveats
    - Use Secure Access Sites
      - Assign a Site to a Component
  - Change the Connector Account Password
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco ecure Access
      - Connector Account
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
Managed iOS Device
- Cisco Security Connector—Secure Access Setup Guide
  - Requirements
    - Optionally
  - Getting Started
  - Quick Start
    - Prerequisites
    - Procedure
      - 1. Install the Cisco Security Connector App
      - 2. Add an Organization Administrator's Email Address
      - 3. Register Your iOS Device Through Your MDM to Secure Access
      - Unregister a Mobile Device
- Meraki Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Push of Profile Config
    - Anonymize Your Device
    - Verify Secure Access on Your Device
- Verify Secure Access with Meraki
  - Prerequisites
  - Procedure
    - Verify Local Operation on the iOS Device
    - Verify Secure Access
    - Verify Clarity
    - Upgrade the Cisco Security Connector
    - Uninstall the Cisco Security Connector
- Meraki Documentation
- Apple Configurator 2 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your Device
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Secure Access on Your iOS Device
  - Install Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS device
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Secure Access on Your iOS device
  - Install Umbrella Root Certificate
  - MobileIron Configuration
    - MobileIron Procedure
    - MobileIron Cloud Configuration
    - MobileIron On-Prem Configuration
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Verify Secure Access on Your iOS Device
- Register an iOS Device Through a Generic MDM System
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify That Your Device is Protected by Secure Access
  - Install Root Certificate
- Apply Secure Access Policies to Your Mobile Device
  - Prerequisites
  - Procedure
  - Secure Access Reporting
    - Activity Search Report
    - Security Activity Report
    - App Discovery Report
- Anonymize Devices
  - Prerequisites
  - Procedure
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Troubleshooting
  - Prerequisites
  - Generate Diagnostics and Email the Secure Access Reports
  - Generate Diagnostics and Share the Secure Access Reports
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Umbrella Certificate
  - Android Configuration Download
    - Procedure
      - Fail Close/Open Scenario
  - Cisco Meraki MDM
    - Add App to Cisco Meraki
    - Add Configuration for App
    - Push the App to Devices
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - MobileIron MDM
    - Configure the App
    - Push the App
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - VMware Workspace ONE
    - Prerequisites for Deployment
    - Deployment Procedure
      - Create an Always On VPN Profile
    - Add and Publish the Cisco Secure Client Application
  - Microsoft Intune MDM
    - Publish the Umbrella AnyConnect app to Managed Android Devices
    - Configure Secure Access
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Samsung Knox MDM
    - Register with the Enterprise Mobile Manager (EMM)
    - Enroll Android Devices
    - Push the App
    - Set Managed Configuration
    - Create Profile in Knox Manage
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Manage Pop-Ups and App Controls
    - App Settings and First-Time Launch
      - Benefits of Enabling Always-On VPN with Secure Access
    - Configure the App for Secure Access DNS and Remote VPN
      - Configure the App for Secure Access Without Remote VPN
      - Configure the App for Secure Access With Remote VPN
    - Add Android Restriction
    - Additional Notes
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access the User Identities on the Secure Access Dashboard
    - Configure Policy Based on User Identity
    - Monitor User Activity
- Troubleshooting
  - Is this a VPN to Secure Access?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Unmanaged Mobile Device Protection
- Secure Access Unmanaged Mobile Device Protection
- Administrator Actions
  - Prerequisites
  - Procedure
- End-User Actions
  - Android
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment
    - Enrollment by QR code
    - Enrollment without Camera Access
    - Registration and Activation
  - iOS
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment by Link
    - Enrollment by QR code
    - Registration and Activation
Cisco Secure Client
- Cisco Secure Client Overview
- Get Started and Manage Client-based Zero Trust Access from Mobile Devices
  - Set up the Zero Trust Access App for iOS Devices
    - System Requirements
    - Guidelines and Limitations
    - Configure Settings in Cisco Secure Access
    - Install the App
    - Have End Users Enroll in Zero Trust Access
    - Notes for administrators
  - Set up the Zero Trust Access App for Android on Samsung Devices
    - Requirements and Prerequisites
    - Configure Cisco Secure Access
    - Install the App
    - (Optional) Set up the Android device for Zero Trust Access using MDM
      - Add the app to MDM
      - Set up the App on the Samsung Device
    - Enroll the Device in Zero Trust Access
    - Notes for administrators
  - Monitor and Troubleshoot the Zero Trust Access App from Mobile Devices
    - Monitor Activity
    - General Troubleshooting
    - Troubleshoot iOS Devices
    - Troubleshoot Samsung Devices Running Android OS
    - Troubleshoot access issues
- Get Started with Cisco Secure Client on Windows and macOS Devices
  - Windows and macOS Prerequisites
  - Download and Install Cisco Secure Client
    - ThousandEyes Endpoint Agent Module
  - Download the OrgInfo.json File
  - Manual Installation of Cisco Secure Client (Windows and macOS)
  - Mass Deployment Overview
    - Customization Options
  - Mass Deployment (Windows)
  - Customize Windows Installation of Cisco Secure Client
    - Optional OrgInfo.json Configurations
  - Mass Deployment (macOS)
    - Automated Installation (macOS)
  - Customize macOS Installation of Cisco Secure Client
    - Step 1 – Make the DMG Package Writeable
    - Step 2 – Generate the Module Installation Configuration File
    - Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
    - Step 4 – (Optional) Hide the VPN Module
    - Step 5 – Customize the Cisco Secure Client Installation Modules
      - Example – Customize Cisco Secure Client Modules
    - Step 6 – Set Up the Correct Extension Permission Settings
    - Step 7 – Install Cisco Secure Client with Selected Modules
  - VPN Headend Deployment
  - Meraki Systems Manager (SM) Deployment
  - Migration from Umbrella Roaming Client
  - Install the Root Certificate for All Browsers
  - Cloud Management
    - Deploying Cisco Secure Client
    - Uploading the Orginfo.json profile
    - Create a Deployment
    - Post Deployment
  - Additional References
  - Remote Monitoring and Management Deployment Tutorials
  - Manage Device Deployment
    - Prerequisites for Device Deployment Management
    - Add and Activate Deployment Key
    - Manage Deployment Key Compromise
    - Delete a Deployment Key
    - Reverting to Using Legacy Deployment Implementation
    - Backward Compatibility
- Manage Internet Security on Cisco Secure Client
  - Umbrella Roaming Security Module Requirements
    - System Requirements
    - Network Requirements
      - Secure Access DNS Block Pages
      - Secure Access and SAML Identity Provider Domains
    - Transport Layer Security Protocol
    - Network Access
      - Host Names
      - Secure Access DNS Resolvers
      - Encrypted DNS
      - External DNS Resolution
      - HTTP and HTTPS
      - Secure Access DNS – Client Configuration Services
      - Secure Access DNS – Client Sync Services
      - Secure Access DNS and Web – Client Certificate Revocation Services
    - Roaming Security DNS Requirements
    - Internal Domains
  - Domain Management
    - Internal Domains List
    - DNS Suffixes
    - Operational Flow
      - Configure Internal Domains
      - Cisco Secure Client and External Queries
      - Cisco Secure Client and Internal Queries
    - Advanced Topics
      - Unencrypted
      - DNS Suffixes (Continued)
  - Interpret Internet Security Diagnostics
    - Prerequisites
    - Procedure
      - Generate the Diagnostic Report from the Cisco Secure Client
      - Generate the Diagnostic Report on the Command Line
  - IPv4 and IPv6 DNS Protection Status
    - Prerequisites
    - Procedure
    - DNS and IP Layer State Descriptions
- Manage Zero Trust Access on Cisco Secure Client
  - Invite Users to Enroll in Zero Trust Access for Secure Client
    - Prerequisites
    - Recommended: Use MFA Authentication and Biometric Identity
    - Procedure
  - Requirements for Secure Client with Zero Trust Access
  - Troubleshoot Client-Based Zero Trust Access
    - Pre-Enrollment Errors
    - Enrollment Errors
    - Post-Enrollment Errors
    - Requests to Reauthenticate
  - Unenroll a Device from Zero Trust Access
- Manage Virtual Private Networks on Cisco Secure Client
  - Prerequisites
  - Download the Virtual Private Network XML Profile
    - Prerequisites
    - Procedure
      - Step 1 – Download the Cisco Secure Client VPN Profile
      - Step 2 – Copy the VPN Profile to the Target Directory
Cisco Security for Chromebook Client
- About Cisco Security for Chromebooks
  - Key benefits
- Prerequisites for Cisco Security for Chromebooks Client
- Limitations for Cisco Security for Chromebooks
- Integrate the Google Workspace Identity Service
  - Limitations
  - Prerequisites
  - Procedure
- Deploy the Cisco Security for Chromebooks Client
  - About DNS-Layer Protection
  - High-Level Steps for Deploying Cisco Security for Chromebook Client
    - Step 1. In Secure Access:
    - Step 2. In the Google Admin console
  - Procedure
    - Step 1
    - Step 2
  - Bypass Internal Domains from DNS-over-HTTPS (DoH)
    - Procedure
      - Verification
  - Enable Reporting for Private IP Address of Chromebook Device
    - Prerequisites
    - Procedure
  - Verify Cisco Security for Chromebooks Client Deployment
    - Procedure
  - Export Device Data to CSV
    - Procedure
  - Troubleshoot Cisco Security for Chromebooks Client Deployment
    - Procedure
- View Protection Status of Chromebook Devices
  - Procedure
- Add Policies to a Chromebook Device
  - Prerequisites
  - Procedure
- Cisco Security for Chromebooks Client FAQ
- Google Workspace Identity Service FAQ

Cisco Secure Access - DNS Defense Help Manage Registered Networks Point Your DNS to Cisco Secure Access Procedure for Pointing Your DNS to Cisco Secure Access

Last updated: Apr 17, 2026

Previous topic Point Your DNS to Cisco Secure Access Next topic Step 1 – Identify Where Your Public DNS Server Addresses are Configured