Reserved IP Address in Cisco Secure Access

[Edsnow]

Hi, 

If we purchased a Reserved Egress IP Address in Cisco Secure Internet Access, Is it possible that we route some traffic through reserved IP address some traffic through shared IP address ?

[Aref Alsouqi]

I don't think that is possible, I think once the dedicated IP is deployed to your organization any web traffic will be sourced from that IP.

[Royalty]

Hi @Edsnow,

I agree with Aref. The Reserved IP is associated with a specific Secure Access Region (geographic data center location) of Cisco's cloud SSE services

Any traffic that reaches or traverses through that Secure Access Region will use the Reserved IP assigned to the region. If your web traffic passes through a region where you haven’t provisioned a Reserved IP, it will instead use the shared IP range for that region. The choice of which Secure Access Region to use as ingress is dependent on your deployment method, e.g. Cisco Secure Access client vs branch IPSec Network Tunnel.

Attempting to perform traffic engineering to selectively route traffic through either the Reserved IP or the Shared IP based on the destination IP address/domain is not supported

The documentation below may be of use if you've not seen it already! See 'Reserved IP' and 'Secure NAT as a Service'

https://docs.sse.cisco.com/

[adamwin]

This is not supported today but we are looking to develop this functionality. What's your use-case for doing so?

[Edsnow]

HI @adamwin ,

There is no use case as of now. but I am bit confused when I filter the logs in my console as shared IP address, I am seeing some of the windows update traffic is egressing with Shared IP Addresses. Any thoughts on this?

As more details The traffic egressing from Mumbai DC in India. 

[adamwin]

Reserved IP is not enabled on Microsoft update and some Cisco destinations. This is by-design. 

[Edsnow]

Hi @adamwin ,

Any cisco Doc for which all are the excluded domains for Reserved IP address? 

[Royalty]

Hi @Edsnow,

There is no public document with all of the excluded domains. In general, see below for information on the traffic that is excluded from using the Reserved IP address.

• Secure Access excludes Microsoft Update traffic on the organization's reserved IP.
• Secure Access does not provide the reserved IP for web sites that load over QUIC
• Secure Access only supports reserved IP for traffic using SWG.
• Reserved IP is available only for IPv4
• Remote Browser Isolation (RBI) is not supported by Reserved IP. Applications or services that require a reserved IP address should not use remote browser isolation as they will egress on the Shared IP range.

[msyk.oym]

There are some restrictions on Reserved IP address, which you can refer to here.

https://securitydocs.cisco.com/docs/csa/olh/121292.dita
https://securitydocs.cisco.com/docs/csa/olh/121296.dita
https://securitydocs.cisco.com/docs/csa/olh/121306.dita