topic Re: Secure Access identity question in Cloud Security

Secure Access identity question

Maciej Waliszko — Mon, 05 Aug 2024 13:13:32 GMT

Hello,

Let's say that I want to build a security policy where source is equal to MS AD group (users/groups will be provisioned through AD connector). My question is the following. How does firewall feature of SA know about IP-user mapping? According to what I am reading SAML is only for SWG/ZTA... Any hints?

Re: Secure Access identity question

ccieexpert — Mon, 05 Aug 2024 16:16:37 GMT

The AD connector provides user to IP mapping for all features..

are you seeing any issues with that ?

Re: Secure Access identity question

Maciej Waliszko — Tue, 06 Aug 2024 09:26:23 GMT

The problem is that there are no single word in the SA documentation about its integration with Umbrella VA (nothing is also seen in the SA dashboard to do this integration). This is in contrary to Umbrella SIG docs where we can find nice info like the one below

https://docs.umbrella.com/umbrella-user-guide/docs/identity-and-sig-deployment

Re: Secure Access identity question

ccieexpert — Tue, 06 Aug 2024 16:53:49 GMT

AD connector is different from VA... VA is not required with SSE.. but AD connector is required..

Please see this:

https://docs.sse.cisco.com/sse-user-guide/docs/provision-users-and-groups-from-azure-active-directory#prerequisites

For IP-to-user mapping deployments, you must use an on-premises Secure Access AD connector. Azure does not store the private IP to Active AD user mappings.

**Please rate as helpful if this was useful **

Re: Secure Access identity question

howe — Tue, 24 Sep 2024 08:38:18 GMT

VA is not **required** with SSE, but it is available to provide DNS level protection with user attribution for policy application and reporting. Details here: https://docs.sse.cisco.com/sse-user-guide/docs/deploy-virtual-appliances Useful for agent-less deployments in IOT, servers etc. as it was with Umbrella.