topic Re: Reserved IP Address in Cisco Secure Access in Cloud Security

Re: Reserved IP Address in Cisco Secure Access

Edsnow — Tue, 04 Nov 2025 14:09:16 GMT

Hi,

If we purchased a Reserved Egress IP Address in Cisco Secure Internet Access, Is it possible that we route some traffic through reserved IP address some traffic through shared IP address ?

Re: Reserved IP Address in Cisco Secure Access

Aref Alsouqi — Tue, 04 Nov 2025 14:35:56 GMT

I don't think that is possible, I think once the dedicated IP is deployed to your organization any web traffic will be sourced from that IP.

Re: Reserved IP Address in Cisco Secure Access

Royalty — Tue, 04 Nov 2025 19:54:21 GMT

Hi @Edsnow,

I agree with Aref. The Reserved IP is associated with a specific Secure Access Region (geographic data center location) of Cisco's cloud SSE services

Any traffic that reaches or traverses through that Secure Access Region will use the Reserved IP assigned to the region. If your web traffic passes through a region where you haven’t provisioned a Reserved IP, it will instead use the shared IP range for that region. The choice of which Secure Access Region to use as ingress is dependent on your deployment method, e.g. Cisco Secure Access client vs branch IPSec Network Tunnel.

Attempting to perform traffic engineering to selectively route traffic through either the Reserved IP or the Shared IP based on the destination IP address/domain is not supported

The documentation below may be of use if you've not seen it already! See 'Reserved IP' and 'Secure NAT as a Service'

https://docs.sse.cisco.com/

Re: Reserved IP Address in Cisco Secure Access

adamwin — Wed, 05 Nov 2025 02:55:01 GMT

This is not supported today but we are looking to develop this functionality. What's your use-case for doing so?

Re: Reserved IP Address in Cisco Secure Access

Edsnow — Wed, 05 Nov 2025 04:00:57 GMT

HI @adamwin ,

There is no use case as of now. but I am bit confused when I filter the logs in my console as shared IP address, I am seeing some of the windows update traffic is egressing with Shared IP Addresses. Any thoughts on this?

As more details The traffic egressing from Mumbai DC in India.

Re: Reserved IP Address in Cisco Secure Access

adamwin — Wed, 05 Nov 2025 04:27:01 GMT

Reserved IP is not enabled on Microsoft update and some Cisco destinations. This is by-design.

Re: Reserved IP Address in Cisco Secure Access

Edsnow — Wed, 05 Nov 2025 06:30:36 GMT

Hi @adamwin ,

Any cisco Doc for which all are the excluded domains for Reserved IP address?

Re: Reserved IP Address in Cisco Secure Access

Royalty — Wed, 05 Nov 2025 15:58:23 GMT

Hi @Edsnow,

There is no public document with all of the excluded domains. In general, see below for information on the traffic that is excluded from using the Reserved IP address.

Secure Access excludes Microsoft Update traffic on the organization's reserved IP.
Secure Access does not provide the reserved IP for web sites that load over QUIC
Secure Access only supports reserved IP for traffic using SWG.
Reserved IP is available only for IPv4
Remote Browser Isolation (RBI) is not supported by Reserved IP. Applications or services that require a reserved IP address should not use remote browser isolation as they will egress on the Shared IP range.

Re: Reserved IP Address in Cisco Secure Access

msyk.oym — Sun, 16 Nov 2025 15:16:25 GMT

There are some restrictions on Reserved IP address, which you can refer to here.

https://securitydocs.cisco.com/docs/csa/olh/121292.dita
https://securitydocs.cisco.com/docs/csa/olh/121296.dita
https://securitydocs.cisco.com/docs/csa/olh/121306.dita