Skip to main content
Cisco Meraki

Cisco Secure Connect - Private Applications and Networks Access Control

Cisco+ Secure Connect secures access to private network destinations and applications via site-to-site VPN tunels, client-based tunnels (Cisco Anyconnect VPN) with identity-based control and clientless per-app access using any browser.

With these you will be able to:
  • Secure Applications with granular access control so only authorized users can access them 
  • Define and manage internal applications for the use in Access policies
  • Provide least privileged access to users that are connecting from anywhere using a client or via a browser
  • Only allow user devices that meet the device posture requirements of your organization 
What’s the difference between client based and clientless?

Client based access

With client based, as the DTLS terminates, the user is prompted for authentication, and once authorized the user’s traffic is directly routed through the Cloud Deliver Firewall (CDFW)  for finer-grained access control to private resources based upon contextual controls such as identity and posture.

nap.png

CDFW policies apply when:

Source
Traffic
Destination Traffic
Application hosted in Private Cloud or
 On Prem Data Center
Application hosted in Branch
Anyconnect VPN Client clipboard_ef9d65e5fc12710e67cb0a61828b7b5e3.png clipboard_e86829aa2a488bdf6ee2e0dfa4b6bce9b.png
Branch clipboard_ec8fba24849c4cf81c32a86d475fb8813.png

clipboard_ec8fba24849c4cf81c32a86d475fb8813.png

Note:  Security for branches that are connected to the same Cloud Hub is enforced by the local (Meraki) firewall not the cloud-delivered firewall

Clientless Access

Clientless allows you to leverage a web browser for user authentication and application access without requiring users to install the Cisco Anyconnect Client on their devices. This feature addresses situations where it might not be feasible or desirable to install the Cisco Anyconnect client. For example, you might want to:

  • Control user access to applications on devices with operating systems that are not currently supported by Cisco Anyconnect.
  • Provide third-party access to applications on devices that might not be owned or managed by your company (e.g., contractor or partner-owned devices)

Each user and device is verified and validated by a Browser Access Policy (BAP), before access is permitted to an app or resource. The verification is granular, per session. Users have the freedom to connect from anywhere with any policy-compliant device.

Next Steps:

For configuration details, see Private Applications and Networks Configuration

 

  • Was this article helpful?