Cisco Secure Access — Architecture & Configuration Reference

VPN gives network access. That's the problem, not the solution.

When a user VPNs in, they get access to your entire network — or a large subnet of it. If that device is compromised, the attacker gets the same access. Lateral movement is trivial.

ZTNA flips this: users get access to one specific app per authenticated session. No broader network. No lateral movement. Posture is verified before every session and continuously during it.

VPN and ZTNA aren't mutually exclusive. Cisco Secure Access gives you both — VPN for legacy apps that need full subnet, ZTNA for everything else. You migrate at your own pace. Zero disruption.

Complexity lives in the planning, not the platform.

The typical ZTNA pilot — 10 private resources, 50 users — takes 2-3 days end to end. Resource Connectors deploy in under an hour (Docker pull, provisioning key, done). Private resource definitions take under a minute each. The SAML setup with Entra ID or Okta is guided and well-documented.

The real complexity is IP access control lists and firewall rules in your current VPN setup. CSA eliminates that entirely — apps, not subnets.

Compare the full stack, not the license line item.

Price CSA against what you're currently running: VPN hardware + maintenance + support + web proxy + DNS filtering + DLP tools + a separate RBI solution. Add staff time to manage five separate consoles. Add the cost of a single security incident caused by lateral movement that ZTNA would have prevented.

CSA is a consolidation play. Most customers eliminate 3-5 separate products. The license cost is usually offset entirely by what they retire — and the security posture improves significantly.

You don't have to move everything. Start where the value is highest.

CSA doesn't require replacing your existing firewall or on-prem security stack. Add it alongside. Start with remote user protection — the highest-risk surface — and grow from there. Resource Connectors bridge your existing on-prem apps to the cloud security layer without touching your datacenter architecture.

The question isn't "are we ready?" It's "which users are highest risk today?" Start there. One deployment, 50 users, 30 days. Then decide.

Cloud security done right is faster than on-prem done badly.

Cisco operates global PoPs with anycast routing — user traffic goes to the nearest PoP, not across the globe. For most enterprise users, latency through CSA is lower than backhauling traffic to a central on-prem proxy through an MPLS network.

For internet-bound traffic specifically: local breakout through CSA is consistently faster than hairpinning through corporate DC. DEM (Experience Insights) gives you the proof — per-user latency data, ISP vs CSA vs destination breakdown.

If a customer has specific latency concerns, point them to the DEM capabilities and offer to run a measurement during the POC.

TLS inspection bypass lists are exactly what they're for.

CSA's TLS decryption policy includes a bypass list. Certificate-pinned applications — banking apps, MDM agents, Microsoft services (some), antivirus update channels — are added to the bypass list and their traffic flows through uninspected.

Cisco maintains a pre-built list of known cert-pinned apps to bypass. You can also add custom entries. TLS inspection is selective — not all-or-nothing. You get visibility where it matters and compatibility where it doesn't.

Then you're already sold on cloud-delivered SSE. The question is which platform delivers better value.

Zscaler: strong SWG, but no integrated VPN headend. ZTNA (ZPA) is a separate product, separate agent, separate console. DEM is limited. No built-in DEM for private app paths.

Palo Alto Prisma Access: good security, but complexity is high. Licensing is byzantine. Onboarding is long. Support can be slow.

CSA differentiators: single agent (Secure Client), single console, VPN + ZTNA in one platform, Talos threat intel (largest threat research team in the world), DEM built-in, AI Assistant, and a Cisco TAC that actually answers the phone. Ask them what their current support experience is like.

The same thing that happens when your on-prem VPN hardware fails — except Cisco's SLA is likely better than your hardware uptime.

Cisco Secure Access is built on a distributed, multi-region architecture. No single PoP or data center failure takes the service down. Cisco publishes a 99.999% uptime SLA for the SSE platform. That's under 6 minutes of downtime per year.

Compare that to your current VPN hardware: one device failure, one misconfigured upgrade, one power event — and you're down. With CSA, Cisco's operations team handles redundancy, patching, and failover automatically.

Which compliance requirement specifically? Most don't mandate on-prem infrastructure — they mandate controls.

CSA is compliant with SOC 2 Type II, ISO 27001, GDPR (EU data residency options available), PCI DSS (as a security control), and HIPAA. Data residency is configurable — traffic can be processed in EU-region PoPs only if required.

On-prem is an implementation choice, not a compliance requirement in most frameworks. The frameworks mandate encryption, access control, logging, and audit trails — all of which CSA provides, often more robustly than on-prem equivalents. Ask them to name the specific regulation or clause.

That's exactly the use case cloud SSE was designed for.

Cisco operates PoPs across North America, Europe, Asia-Pacific, and the Middle East. A user in Tokyo routes to the Tokyo PoP. A user in São Paulo routes to the nearest Brazilian PoP. Policy and security are identical regardless of location — no VPN backhauling to headquarters required.

VPN access in restrictive countries (China, UAE, Russia) requires specific configuration — UDP ports may be blocked. CSA supports SSL/TLS (port 443) fallback for VPN, which works in most restrictive environments. For ZTNA, port 443 is always used.

It integrates with all major SIEMs — out of the box.

CSA exports logs in CEF (Common Event Format) and LEEF (Log Event Extended Format) via real-time syslog stream. This is the native format for Splunk, IBM QRadar, Microsoft Sentinel, ArcSight, and most other enterprise SIEMs.

Additionally: S3 bucket export for data lake or batch ingestion, REST API for custom integrations, and Cisco also publishes pre-built Splunk dashboards and Sentinel workbooks. Whichever SIEM they're using, integration is a known, documented process — not a custom project.

Two VMs per datacenter. No maintenance overhead. Cisco manages the software.

Resource Connectors are containerized and self-updating. You deploy them (Docker or OVA, 30 minutes), they auto-register to CSA, and then Cisco manages the software lifecycle. You don't patch them. You don't update them. You just monitor their status in the dashboard — green means running.

Compare this to managing a traditional VPN concentrator: hardware refreshes, IOS upgrades, certificate renewals, HA failover testing. Connectors are a significant reduction in operational overhead, not an addition.

CSA is a per-user SaaS subscription — simpler than most.

Cisco Secure Access is licensed per user per year. There are typically two tiers — Essentials (SWG, CASB, ZTNA, RA-VPN) and Advantage (adds DLP, RBI, advanced DEM). No per-device licensing. No throughput tiers. No PoP fees. No connector licensing.

If they're thinking of Cisco's legacy product licensing complexity — EAs, SMARTnet, per-device registration — that's not CSA. This is a SaaS model. One SKU per tier, per user, per year. Clear, predictable, budgetable.

Good. CSA works alongside it. This isn't a replacement conversation — yet.

CSA doesn't replace your perimeter firewall. It secures your remote users and provides cloud-delivered access control — use cases where Fortinet and Palo Alto on-prem hardware isn't the right tool regardless of investment size.

The conversation to have now: protect your remote users and provide ZTNA for private apps. Your FortiGate/NGFW stays in place for datacenter perimeter and site-to-site traffic. When renewal comes up, you'll have real-world CSA data and a clearer picture of what you actually need from on-prem vs cloud.

CSA is designed to reduce management overhead, not add to it.

Unified dashboard: internet policy, private access, posture, DEM, logs — all in one place. No tool-switching. AI Assistant creates policies from natural language. Policy changes propagate globally in under 60 seconds — no deployment pipeline. Connectors self-update. SCIM keeps users in sync automatically.

The average CSA administrator spends 30-60 minutes per week on platform management after initial setup. If they're understaffed, the answer isn't "don't deploy better tools" — it's "deploy tools that do more with less manual effort." That's exactly what CSA is built for.