Coexistence with Cisco Secure Access
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 10d372a · +30 −55 lines · also on GitHub
⋯ 61 unchanged lines
6262
1. **Install and configure the Cisco Secure Client**. See Cisco documentation for [downloading and installing the client for Windows and macOS](https://docs.sse.cisco.com/sse-user-guide/docs/manual-installation-of-cisco-secure-client-windows-and-macos).
6363
6464
> [!IMPORTANT]
65
− > Cisco released a Cisco Secure Client (CSC) feature to improve coexistence with Global Secure Access. These steps need to be performed after the initial installation, or re-installation (not required to run again when upgrading), of CSC version 5.1.10.x (or later).
66
− > 1. Install Cisco Secure Client version 5.1.10.x.
67
− > 1. Open CMD prompt as an administrator and run these commands:
68
− > 1. `"%ProgramFiles(x86)%\Cisco\Cisco Secure Client\acsocktool.exe" -slwm 10`
69
− > 1. `net stop csc_vpnagent && net stop acsock && net start csc_vpnagent`
65
+> Cisco released a Cisco Secure Client (CSC) feature to improve coexistence with Global Secure Access. These steps need to be performed after the initial installation, or re-installation (not required to run again when upgrading), of CSC version 5.1.10.x (or later).
66
+> 1. Install Cisco Secure Client version 5.1.10.x.
67
+> 1. Open CMD prompt as an administrator and run these commands:
68
+> 1. `"%ProgramFiles(x86)%\Cisco\Cisco Secure Client\acsocktool.exe" -slwm 10`
69
+> 1. `net stop csc_vpnagent && net stop acsock && net start csc_vpnagent`
7070
7171
## Bypass configuration for coexistence
7272
⋯ 12 unchanged lines
8585
#### [Cisco Secure Access Portal](#tab/cisco-secure-access-portal)
8686
8787
1. In the Cisco Secure Access portal, go to **Connect > End User Connectivity > Internet Security**.
88
−2. In the **Traffic Steering** section, select **Add Destination > Bypass Secure Access**, add the following FQDN, and save:
89
−
90
− `*.globalsecureaccess.microsoft.com`
91
−
92
− > [!NOTE]
93
− > Cisco Secure Access has an implied wildcard, so you can use `globalsecureaccess.microsoft.com`.
94
−
88
+2. In the **Traffic Steering** section, select **Add Destination > Bypass Secure Access**, add the following FQDN, and save: `*.globalsecureaccess.microsoft.com`
89
+ > [!NOTE]
90
+ > Cisco Secure Access has an implied wildcard, so you can use `globalsecureaccess.microsoft.com`.
9591
3. Add these Microsoft 365 FQDNs (only required if Microsoft traffic forwarding profile is enabled):
96
−
9792
`auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
98
−
9993
4. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
100
−
101
− > [!NOTE]
102
− > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
103
−
104
− 5. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
105
−
106
−6. In the Traffic Steering section, select **Add Destination > Bypass web proxy only**, add these IPs, and save:
107
−
108
− `150.171.19.0/24, 150.171.20.0/24, 13.107.232.0/24, 13.107.233.0/24, 150.171.15.0/24, 150.171.18.0/24, 151.206.0.0/16, 6.6.0.0/16`
109
−
110
− 7. Add these Microsoft 365 IP addresses (only required if Microsoft traffic forwarding profile is enabled):
111
−
112
− `132.245.0.0/16, 204.79.197.215/32, 150.171.32.0/22, 131.253.33.215/32, 23.103.160.0/20, 40.96.0.0/13, 52.96.0.0/14, 40.104.0.0/15, 13.107.128.0/22, 13.107.18.10/31, 13.107.6.152/31, 52.238.78.88/32, 104.47.0.0/17, 52.100.0.0/14, 40.107.0.0/16, 40.92.0.0/15, 150.171.40.0/22, 52.104.0.0/14, 104.146.128.0/17, 40.108.128.0/17, 13.107.136.0/22, 40.126.0.0/18, 20.231.128.0/19, 20.190.128.0/18, 20.20.32.0/19`
113
−
94
+ > [!NOTE]
95
+ > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
96
+5. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
97
+6. In the Traffic Steering section, select **Add Destination > Bypass web proxy only**, add these IPs, and save: `150.171.19.0/24, 150.171.20.0/24, 13.107.232.0/24, 13.107.233.0/24, 150.171.15.0/24, 150.171.18.0/24, 151.206.0.0/16, 6.6.0.0/16`
98
+7. Add these Microsoft 365 IP addresses (only required if Microsoft traffic forwarding profile is enabled):
99
+ `132.245.0.0/16, 204.79.197.215/32, 150.171.32.0/22, 131.253.33.215/32, 23.103.160.0/20, 40.96.0.0/13, 52.96.0.0/14, 40.104.0.0/15, 13.107.128.0/22, 13.107.18.10/31, 13.107.6.152/31, 52.238.78.88/32, 104.47.0.0/17, 52.100.0.0/14, 40.107.0.0/16, 40.92.0.0/15, 150.171.40.0/22, 52.104.0.0/14, 104.146.128.0/17, 40.108.128.0/17, 13.107.136.0/22, 40.126.0.0/18, 20.231.128.0/19, 20.190.128.0/18, 20.20.32.0/19`
114100
8. Restart Cisco Umbrella client services or restart the machine where the clients are installed.
115101
116102
#### [Cisco Umbrella Portal](#tab/cisco-umbrella-portal)
117103
118
−1. Add domain suffixes and Microsoft Entra service FQDNs to the **Internal domains** list:
119
− `*.globalsecureaccess.microsoft.com`
120
−
121
− > [!NOTE]
122
− > Cisco Umbrella supports implied wildcards, so you can use `globalsecureaccess.microsoft.com`.
123
−
104
+1. Add domain suffixes and Microsoft Entra service FQDNs to the **Internal domains** list: `*.globalsecureaccess.microsoft.com`
105
+ > [!NOTE]
106
+ > Cisco Umbrella supports implied wildcards, so you can use `globalsecureaccess.microsoft.com`.
124107
2. Add these Microsoft 365 FQDNs (only required if Microsoft traffic forwarding profile is enabled):
125108
`auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
126
−
127109
3. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
128
−
129
− > [!NOTE]
130
− > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
131
−
110
+ > [!NOTE]
111
+ > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
132112
4. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
133
−
134
−5. In the **External Domains & IPs** section, add these Global Secure Access IPs and FQDN:
135
− `*.globalsecureaccess.microsoft.com, 150.171.19.0/24, 150.171.20.0/24, 13.107.232.0/24, 13.107.233.0/24, 150.171.15.0/24, 150.171.18.0/24, 151.206.0.0/16, 6.6.0.0/16`
136
−
113
+5. In the **External Domains & IPs** section, add these Global Secure Access IPs and FQDN: `*.globalsecureaccess.microsoft.com, 150.171.19.0/24, 150.171.20.0/24, 13.107.232.0/24, 13.107.233.0/24, 150.171.15.0/24, 150.171.18.0/24, 151.206.0.0/16, 6.6.0.0/16`
137114
6. Add these Microsoft 365 IP addresses (only required if Microsoft traffic forwarding profile is enabled):
138115
`132.245.0.0/16, 204.79.197.215/32, 150.171.32.0/22, 131.253.33.215/32, 23.103.160.0/20, 40.96.0.0/13, 52.96.0.0/14, 40.104.0.0/15, 13.107.128.0/22, 13.107.18.10/31, 13.107.6.152/31, 52.238.78.88/32, 104.47.0.0/17, 52.100.0.0/14, 40.107.0.0/16, 40.92.0.0/15, 150.171.40.0/22, 52.104.0.0/14, 104.146.128.0/17, 40.108.128.0/17, 13.107.136.0/22, 40.126.0.0/18, 20.231.128.0/19, 20.190.128.0/18, 20.20.32.0/19`
139
−
140116
7. Restart Cisco Umbrella client services or restart the machine where the clients are installed.
141117
142118
---
⋯ 15 unchanged lines
158134
1. Deploy and configure Cisco Secure Client with Umbrella module.
159135
160136
**Validation**
161
− 1. Ensure both clients are enabled and the Umbrella profile is `Active`.
162
− 1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
163
− 1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
164
− 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
165
− 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com` in browsers.
166
− 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
167
− 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
168
− 5. Access private applications via Global Secure Access (for example, SMB file share).
169
− 6. Validate the SMB file share traffic is captured in Global Secure Access logs and isn't shown in Cisco logs.
170
− 7. Stop collecting traffic and confirm correct traffic handling.
137
+1. Ensure both clients are enabled and the Umbrella profile is `Active`.
138
+1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
139
+1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
140
+ 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
141
+ 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com` in browsers.
142
+ 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
143
+ 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
144
+ 5. Access private applications via Global Secure Access (for example, SMB file share).
145
+ 6. Validate the SMB file share traffic is captured in Global Secure Access logs and isn't shown in Cisco logs.
146
+ 7. Stop collecting traffic and confirm correct traffic handling.
171147
172148
### 2. Microsoft Entra Private Access with Cisco Secure Internet Access and Cisco Secure Private Access
173149
⋯ 24 unchanged lines
198174
8. Validate the RDP traffic is captured in Cisco logs and isn't shown in Global Secure Access logs.
199175
9. Stop collecting traffic and confirm correct traffic handling.
200176
201
−
202177
### 3. Microsoft Entra Microsoft Access with Cisco Secure Internet Access and Cisco Secure Private Access
203178
204179
**Global Secure Access configuration**
⋯ 59 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.