GSA coexistence with Cisco Umbrella
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 25c2ccd · +25 −48 lines · also on GitHub
⋯ 55 unchanged lines
5656
1. **Provision users and groups.**
5757
Integration with Microsoft Entra ID is recommended. See Microsoft Entra ID SAML configuration guide for [Umbrella](/entra/identity/saas-apps/cisco-umbrella-tutorial) or [Cisco Secure Access](https://docs.sse.cisco.com/sse-user-guide/docs/manage-users-and-groups).
5858
2. **Create a policy to block a destination or content for testing.**
59
− For detailed information, see [Umbrella policies](https://docs.umbrella.com/deployment-umbrella/docs/create-and-apply-policies) or [Cisco Secure Access Internet Access Rules documentation](https://docs.sse.cisco.com/sse-user-guide/docs/manage-internet-access-rules).
59
+ For detailed information, see [Umbrella policies](https://docs.umbrella.com/deployment-umbrella/docs/create-and-apply-policies) or [Cisco Secure Access Internet Access Rules documentation](https://docs.sse.cisco.com/sse-user-guide/docs/manage-internet-access-rules).
6060
3. **Deploy and install the Cisco Secure Client.**
6161
6262
> [!IMPORTANT]
⋯ 10 unchanged lines
7373
1. In the Microsoft Entra admin center, go to **Global Secure Access > Connect > Traffic forwarding > Internet access profile**.
7474
2. Under **Internet access policies**, select **View**.
7575
3. Expand **Custom Bypass** and select **Add rule**.
76
−4. Enter the following IPs:
77
− ```
78
− 208.67.222.222, 208.67.220.220, 67.215.64.0/19, 146.112.0.0/16, 155.190.0.0/16, 185.60.84.0/22, 204.194.232.0/21, 208.67.216.0/21, 208.69.32.0/21
79
− ```
76
+4. Enter the following IPs: `208.67.222.222, 208.67.220.220, 67.215.64.0/19, 146.112.0.0/16, 155.190.0.0/16, 185.60.84.0/22, 204.194.232.0/21, 208.67.216.0/21, 208.69.32.0/21`
8077
5. Select **Save**.
8178
8279
### Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access
8380
8481
#### [Cisco Umbrella Portal](#tab/cisco-umbrella-portal)
8582
86
−1. Add domain suffixes and Microsoft Entra service FQDNs to the **Deployments > Configuration > Domain Management > Internal domains** list:
87
− ```
88
− *.globalsecureaccess.microsoft.com
89
− ```
90
− > [!NOTE]
91
− > Cisco Umbrella supports implied wildcards, so you can use `globalsecureaccess.microsoft.com`.
92
−
83
+1. Add domain suffixes and Microsoft Entra service FQDNs to the **Deployments > Configuration > Domain Management > Internal domains** list: `*.globalsecureaccess.microsoft.com`
84
+ > [!NOTE]
85
+ > Cisco Umbrella supports implied wildcards, so you can use `globalsecureaccess.microsoft.com`.
9386
2. Add these Microsoft FQDNs (only required if Microsoft traffic forwarding profile is enabled):
94
−```
95
− auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net
96
−```
97
− 3. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
98
−
87
+ `auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
88
+3. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
9989
> [!NOTE]
10090
> Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
101
−
102
− 4. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
103
−
91
+4. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
10492
5. Restart Cisco Umbrella client services or restart the machine where the clients are installed.
10593
10694
#### [Cisco Secure Access Portal](#tab/cisco-secure-access-portal)
10795
10896
1. Go to **Connect > End User Connectivity > Internet Security**.
109
−2. In **Traffic Steering**, select **Add Destination > Bypass Secure Access**, add this FQDN, and save:
110
− ```
111
− *.globalsecureaccess.microsoft.com
112
− ```
113
− > [!NOTE]
114
− > Cisco Secure Access has an implied wildcard, so you can use `globalsecureaccess.microsoft.com`.
115
−
97
+2. In **Traffic Steering**, select **Add Destination > Bypass Secure Access**, add this FQDN, and save: `*.globalsecureaccess.microsoft.com`
98
+ > [!NOTE]
99
+ > Cisco Secure Access has an implied wildcard, so you can use `globalsecureaccess.microsoft.com`.
116100
3. Add these Microsoft FQDNs (only required if Microsoft traffic forwarding profile is enabled):
117
−```
118
−auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net
119
−```
101
+ `auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
120102
4. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
121
−
122
− > [!NOTE]
123
− > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
124
−
125
− 5. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
126
−
127
−5. Restart Cisco Umbrella client services or restart the machine where the clients are installed.
103
+ > [!NOTE]
104
+ > Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
105
+5. Add DNS suffixes defined in your Private DNS or Enterprise App segments (only required if Private Access traffic forwarding profile is enabled). For example, if your Private DNS suffix is `contoso.local` and you have a private app at `contoso.com`, add both suffixes.
106
+6. Restart Cisco Umbrella client services or restart the machine where the clients are installed.
128107
129108
---
130109
⋯ 42 unchanged lines
173152
1. Ensure both clients are enabled and the Umbrella profile is `Active`.
174153
1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
175154
1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
176
− 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
177
− 2. Access `bing.com`, `salesforce.com`, `yelp.com` in browsers.
178
− 3. Verify Global Secure Access client **is** capturing traffic for these sites. We **don't** expect to see destination FQDN information for these sites in the traffic tab.
179
− 4. In the Umbrella or Cisco Secure Access portal, validate DNS traffic to these sites **is** captured.
180
− 5. Access `outlook.office365.com`, `<yourmicrosoftdomain>.sharepoint.com` in browsers.
181
− 6. Verify Global Secure Access client **is** capturing traffic for these sites. We **do** expect to see destination FQDN information for these sites.
182
− 7. Access a site blocked by Cisco and validate that the Cisco block page is displayed.
183
− 8. Access a Microsoft Entra private application (for example, SMB file share) and validate that Global Secure Access **is** capturing traffic and Cisco isn't.
184
− 9. In Global Secure Access, stop collecting traffic and confirm correct traffic handling.
155
+ 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
156
+ 2. Access `bing.com`, `salesforce.com`, `yelp.com` in browsers.
157
+ 3. Verify Global Secure Access client **is** capturing traffic for these sites. We **don't** expect to see destination FQDN information for these sites in the traffic tab.
158
+ 4. In the Umbrella or Cisco Secure Access portal, validate DNS traffic to these sites **is** captured.
159
+ 5. Access `outlook.office365.com`, `<yourmicrosoftdomain>.sharepoint.com` in browsers.
160
+ 6. Verify Global Secure Access client **is** capturing traffic for these sites. We **do** expect to see destination FQDN information for these sites.
161
+ 7. Access a site blocked by Cisco and validate that the Cisco block page is displayed.
162
+ 8. Access a Microsoft Entra private application (for example, SMB file share) and validate that Global Secure Access **is** capturing traffic and Cisco isn't.
163
+ 9. In Global Secure Access, stop collecting traffic and confirm correct traffic handling.
185164
186165
---
187166
188167
> [!NOTE]
189168
> For troubleshooting health check failures, see [Troubleshoot the Global Secure Access client: Health check](troubleshoot-global-secure-access-client-diagnostics-health-check.md).
190
−
191
−
192169
193170
## Next steps
194171
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.