Cisco
Login
Search
Software Secure Access
Activity Manage

Cisco Secure Access Help Manage Advanced Configuration Settings Manage IP Surrogates for User Authentication Add Internal Networks for Bypass

Last updated: Aug 20, 2025

Add Internal Networks for Bypass

After you enable IP Surrogate, add internal networks. The user connections on internal networks bypass the SAML IP surrogate authentication challenge for traffic to the Secure Access Secure Web Gateway.

Before you begin

  • Full Admin user role. For more information, see Manage Accounts.
  • At least one configured user authentication IdP integration. For more information, see Add User Authentication Profiles.
  • Internal private IP addresses are visible. IP surrogate needs to be able to see the internal private IPs.
  • Proxy networks with XFF or network tunnels without NAT.
  • In Secure Access, enable HTTPS inspection.
  • Do not delete cookies at the end of a browser session, or browse in incognito mode.

Procedure

1

Navigate to Connect > Users and User Groups, and then click Configuration management.
2

On the Advanced Settings tab, navigate to IP Surrogate.
3

Confirm that you enabled IP Surrogate.
4

Click Internal Network bypass.

Select the internal networks that are associated with Registered Networks and Network Tunnels in Network Tunnel Groups.
5

Expand Network.

  1. Expand a specific Network, and then select the internal networks for the Registered Networks.

  2. Click Apply.
6

Expand Network Tunnel Groups.

  1. Expand a specific Network Tunnel Group, and then select the internal networks for the Network Tunnels in the Network Tunnel Groups.

  2. Click Apply.
Previous topic Enable IP Surrogates for User Authentication Next topic Delete Internal Networks for Bypass