GSA coexistence with Cisco Umbrella
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2b9c53f · +23 −26 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.author: kenwith
66
manager: dougeby
77
ms.topic: conceptual
8
−ms.date: 08/26/2025
8
+ms.date: 10/03/2025
99
ms.service: global-secure-access
1010
ms.subservice: entra-private-access
1111
ms.reviewer: shkhalid
⋯ 18 unchanged lines
3030
3131
## Prerequisites
3232
33
−- Cisco SWG features must be disabled for these configurations.
34
−- Integration with Microsoft Entra ID is recommended for best user experience.
33
+1. Cisco SWG features must be disabled for these configurations.
34
+1. Integration with Microsoft Entra ID is recommended for best user experience.
3535
36
−## Global Secure Access setup
36
+### Global Secure Access setup
3737
3838
To configure Global Secure Access:
3939
⋯ 9 unchanged lines
4949
> [!NOTE]
5050
> Private Network Connectors are required for Private Access applications.
5151
52
−## Cisco Umbrella setup
52
+### Cisco Umbrella setup
5353
5454
To configure Cisco Umbrella:
5555
⋯ 80 unchanged lines
136136
#### Steps
137137
138138
**Global Secure Access configuration:**
139
−- Enable Internet Access and Microsoft Access forwarding profiles.
140
−- Install and configure the Global Secure Access client for Windows or macOS.
139
+1. Enable Internet Access and Microsoft Access forwarding profiles.
140
+1. Install and configure the Global Secure Access client for Windows or macOS.
141141
142142
**Cisco configuration:**
143
−- Configure the required destinations bypasses. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access](#bypass-global-secure-access-ips-and-fqdns-in-umbrellacisco-secure-access) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
144
−- Disable the SWG for [Umbrella devices](https://docs.umbrella.com/umbrella-user-guide/docs/selective-enablement#disable-the-swg-module) or [Cisco Secure Access devices](https://docs.sse.cisco.com/sse-user-guide/docs/edit-roaming-devices-internet-security-settings#disable-the-internet-security-settings).
145
−
146
−- Install and configure Cisco Secure Client software with the Umbrella module.
143
+1. Configure the required destinations bypasses. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access](#bypass-global-secure-access-ips-and-fqdns-in-umbrellacisco-secure-access) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
144
+1. Disable the SWG for [Umbrella devices](https://docs.umbrella.com/umbrella-user-guide/docs/selective-enablement#disable-the-swg-module) or [Cisco Secure Access devices](https://docs.sse.cisco.com/sse-user-guide/docs/edit-roaming-devices-internet-security-settings#disable-the-internet-security-settings).
145
+1. Install and configure Cisco Secure Client software with the Umbrella module.
147146
148147
**Validation:**
149
−- Ensure both clients are enabled and the Umbrella profile is `Active`.
150
−- To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
151
−- Test traffic flow by accessing various sites and validating traffic logs in both platforms.
148
+1. Ensure both clients are enabled and the Umbrella profile is `Active`.
149
+1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
150
+1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
152151
1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
153152
2. Access `bing.com`, `salesforce.com`, `yelp.com` in browsers.
154153
3. Verify Global Secure Access client **is** capturing traffic for these sites. We **do not** expect to see destination FQDN information for these sites in the traffic tab.
⋯ 11 unchanged lines
166165
#### Steps
167166
168167
**Global Secure Access configuration:**
169
−- Enable Internet Access, Microsoft Access, and Private Access forwarding profiles.
170
−- Install a private network connector.
171
−- Configure Quick Access and Private DNS.
172
−- Install and configure the Global Secure Access client for Windows or macOS.
168
+1. Enable Internet Access, Microsoft Access, and Private Access forwarding profiles.
169
+1. Install a private network connector.
170
+1. Configure Quick Access and Private DNS.
171
+1. Install and configure the Global Secure Access client for Windows or macOS.
173172
174173
**Cisco configuration:**
175
−- Configure the required destinations bypasses. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access](#bypass-global-secure-access-ips-and-fqdns-in-umbrellacisco-secure-access) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
176
−- Disable the SWG for [Umbrella devices](https://docs.umbrella.com/umbrella-user-guide/docs/selective-enablement#disable-the-swg-module) or [Cisco Secure Access devices](https://docs.sse.cisco.com/sse-user-guide/docs/edit-roaming-devices-internet-security-settings#disable-the-internet-security-settings).
177
−- Install and configure Cisco Secure Client software with the Umbrella module.
174
+1. Configure the required destinations bypasses. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access](#bypass-global-secure-access-ips-and-fqdns-in-umbrellacisco-secure-access) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
175
+1. Disable the SWG for [Umbrella devices](https://docs.umbrella.com/umbrella-user-guide/docs/selective-enablement#disable-the-swg-module) or [Cisco Secure Access devices](https://docs.sse.cisco.com/sse-user-guide/docs/edit-roaming-devices-internet-security-settings#disable-the-internet-security-settings).
176
+1. Install and configure Cisco Secure Client software with the Umbrella module.
178177
179178
**Validation:**
180
−- Ensure both clients are enabled and the Umbrella profile is `Active`.
181
−- To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
182
−- Test traffic flow by accessing various sites and validating traffic logs in both platforms.
179
+1. Ensure both clients are enabled and the Umbrella profile is `Active`.
180
+1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
181
+1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
183182
1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
184183
2. Access `bing.com`, `salesforce.com`, `yelp.com` in browsers.
185184
3. Verify Global Secure Access client **is** capturing traffic for these sites. We **don't** expect to see destination FQDN information for these sites in the traffic tab.
⋯ 3 unchanged lines
189188
7. Access a site blocked by Cisco and validate that the Cisco block page is displayed.
190189
8. Access a Microsoft Entra private application (for example, SMB file share) and validate that Global Secure Access **is** capturing traffic and Cisco isn't.
191190
9. In Global Secure Access, stop collecting traffic and confirm correct traffic handling.
192
−
193
−
194191
195192
---
196193
⋯ 8 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.