Course contents

Unit 6: Advanced securityLesson 6.2 (2 of 11 in this unit)4 of 25 in the Advanced Cisco SD-WAN course

What is SASE?

Secure access service edge: the idea, its parts (SD-WAN, secure web gateway, CASB, zero-trust access, firewall as a service), how it differs from SSE, and how Cisco SD-WAN connects to cloud security.

Advanced · 11 min read

You'll learn to explain SASE and SSE, name the services inside them, describe how a Cisco SD-WAN edge reaches cloud security, and choose between on-box security, cloud security or both.

Technical definition

SASE (secure access service edge) is an architecture, named by the analyst firm Gartner in 2019, that combines wide-area networking (such as SD-WAN) with security services delivered from the cloud. Users and sites connect to a security service close to them instead of sending all internet traffic back to a data centre to be checked there.

The problem SASE was meant to solve

In a traditional design, branches send internet traffic through a tunnel to a data centre, where a firewall and web gateway check it. This is called backhauling. It was reasonable when applications lived in the data centre. Today most traffic is for SaaS and cloud applications, so backhauling adds delay and loads the data centre links to reach services that are not in the data centre at all. Remote users make it worse, because they are not at any site.

SASE answers by moving the security services to points of presence across the internet. A branch or a user connects to a nearby one, the traffic is checked there, and it carries on to its destination. SD-WAN provides the connection and the path choice. The cloud provides the checks.

What is inside SASE

What is inside SASE
What is inside SASEPart; What it does; Typical question it answers. SD-WAN: Connects sites and chooses the best path for each application Which link should this traffic use? Secure web gateway (SWG): Filters and inspects web traffic, including HTTPS, for users and sites Should this user reach this website, and is the content safe? Cloud access security broker (CASB): Controls the use of SaaS applications, such as which accounts and actions are allowed Is staff data going to an unapproved cloud service? Zero-trust network access (ZTNA): Gives a user access to one named application after checking identity and device, not to a whole network Does this person need this application, from this device? Firewall as a service (FWaaS): A firewall delivered from the cloud for traffic that is not just web Which ports and protocols may leave the site?PartWhat it doesTypical question it answersSD-WANConnects sites and chooses the bestpath for each applicationWhich link should this traffic use?Secure web gateway(SWG)Filters and inspects web traffic,including HTTPS, for users and sitesShould this user reach this website,and is the content safe?Cloud access securitybroker (CASB)Controls the use of SaaSapplications, such as which accountsand actions are allowedIs staff data going to an unapprovedcloud service?Zero-trust networkaccess (ZTNA)Gives a user access to one namedapplication after checking identityand device, not to a whole networkDoes this person need thisapplication, from this device?Firewall as a service(FWaaS)A firewall delivered from the cloudfor traffic that is not just webWhich ports and protocols may leavethe site?

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

SSE names the security services on that list: SWG, CASB, ZTNA and usually a cloud firewall. SASE is SSE plus the SD-WAN that carries traffic to it. The split matters in practice because many organisations already own an SD-WAN and only need the security half.

How a Cisco SD-WAN edge connects to cloud security

A WAN Edge (cEdge or vEdge) can send traffic to a cloud security service in three ways. They are not exclusive. A branch may use more than one, for different traffic.

  1. Tunnels to a Secure Internet Gateway (SIG). The edge builds IPsec or GRE tunnels to a cloud security service and a policy sends chosen internet traffic into them. The service applies its web and firewall controls and forwards the traffic on. See the Manager's SIG settings in your release for the supported providers and tunnel types.
  2. DNS-layer security. The edge redirects DNS queries to a cloud resolver that refuses lookups of bad domains. Only DNS goes to the cloud; the web traffic itself leaves the branch directly. See DNS web layer security.
  3. Direct internet access with on-box security. The edge breaks traffic out locally and protects it with the firewall, URL filtering, IPS and the other features described in the security overview. Nothing is sent to a cloud security service.

Cisco's product and service names for the cloud security side have changed several times, and packaging (what is bundled, which subscription includes what) changes with them. This lesson names the functions, not the products. Check the current Cisco documentation for the service names and for the integration steps for your release.

Where cloud security joins an SD-WAN edge
Where cloud security joins an SD-WAN edgeBR-01 can protect internet traffic in two places. On the box, its own firewall, IPS and URL filtering inspect traffic locally. In the cloud, a tunnel carries internet-bound traffic to a security service, which applies web, DNS and policy checks before the traffic reaches the internet and SaaS applications. SASE combines SD-WAN with such cloud security services.BR-0110.255.2.1On-box securityfirewall, IPS, URL filterCloud security serviceInternet and SaaStunnel to the cloudSASE = SD-WAN connectivity + cloud security services (web, DNS, access policy), delivered together

On small screens, swipe sideways or focus the diagram and use the arrow keys.

On-box, cloud, or both: the choice depends on how many sites you have, the hardware at each site and where the users are.

On-box, cloud, or both

On-box, cloud, or both
On-box, cloud, or bothFactor; On-box security at the branch; Cloud security service. Users covered: Users at that site only Sites and remote users with the same policy Scale: Limited by the router's spare resources Scales with the service; the limit is tunnel capacity and the contract Latency: Local, but inspection adds delay Extra hop to a nearby point of presence; usually less than backhauling Operations: Policy per device or template; updates and sizing are yours One policy console; the provider runs the engines Cost: Router capacity and subscriptions per site Subscription by users or bandwidth Compliance: Traffic and logs stay in your hands Traffic and logs pass through a provider; check where and how long they are kept Failure: Fails with the router Fails if the tunnel or the service failsFactorOn-box security at the branchCloud security serviceUsers coveredUsers at that site onlySites and remote users with the samepolicyScaleLimited by the router's spareresourcesScales with the service; the limit istunnel capacity and the contractLatencyLocal, but inspection adds delayExtra hop to a nearby point ofpresence; usually less thanbackhaulingOperationsPolicy per device or template;updates and sizing are yoursOne policy console; the provider runsthe enginesCostRouter capacity and subscriptions persiteSubscription by users or bandwidthComplianceTraffic and logs stay in your handsTraffic and logs pass through aprovider; check where and how longthey are keptFailureFails with the routerFails if the tunnel or the servicefails

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

A common result is both: simple local rules for segmentation and for traffic that must stay private, and the cloud for general internet and SaaS traffic. Which mix is right depends on the table above, not on fashion. With the lab's sites, BR-02 (internet only, a handful of staff) is a candidate for cloud security with a thin local firewall. BR-01 (MPLS and internet, voice and payment VPNs) keeps local rules for VPN 20 and VPN 40 whatever it does for web traffic.

Tunnels to the cloud service

Because the cloud service sits on the only path to the internet, the tunnels become critical.

  • Primary and backup tunnels. Plan at least two tunnels, to different points of presence where the provider offers them, so one failure does not cut internet access. Check how many tunnels and which tunnel types your release and provider support.
  • Health checks. The edge needs a way to decide that a tunnel is unusable and switch to the other. If it cannot tell, it keeps sending traffic into a tunnel that goes nowhere. Check which probing your release uses and how fast it reacts.
  • Which traffic goes in. Send what needs the service, not everything. Voice, private applications and traffic to the data centre usually stay out of the tunnels.
  • When both tunnels are down. Decide in advance. Failing closed blocks internet access until the service returns: safe, but staff stop working. Failing open sends traffic directly to the internet without cloud checks: staff keep working, but the protection is gone for the duration. This is a design decision for the organisation, not a default to accept.
Why not simply fail open and avoid the complaints?

Because an attacker or a faulty change can cause the failure that opens the gate. If the policy says the checks are required, fail open turns a service outage into a security gap. If the policy says availability matters more, fail open can be right. Write down which it is, and have someone with authority sign it off.

What SASE does not remove

  • Segmentation. Keeping guest, voice and payment traffic apart inside a site is still done at the site, with service VPNs and a local firewall.
  • Identity. ZTNA and CASB depend on knowing who the user is. A weak identity system makes a strong cloud service weak.
  • Local policy. Traffic between sites, to printers and to local servers does not go near the cloud service and needs its own rules.
  • Operations. Someone still owns the policy, reviews the logs, and handles changes. The provider runs the engines, not your decisions.

Test yourself on SASE

Predict · scenario 1

A manager asks what SSE adds to an SD-WAN they already run. Which answer is correct?

Predict · scenario 2

BR-02 has internet only and few staff, and the organisation wants central web policy. Which option fits best?

Predict · scenario 3

Both tunnels from BR-01 to the cloud service are down. Staff cannot reach the internet. What explains this?

Predict · scenario 4

A team says moving to a cloud security service means they can remove VPN separation of guest and corporate networks at the branch. What is wrong with this?

FAQ

Is SASE a product I can buy?
No. SASE is a design approach. Vendors sell products and services that deliver parts of it, and they combine them in different ways. When someone says they have SASE, ask which services they mean and where each one runs.
What is the difference between SASE and SSE?
SSE (security service edge) is the security half of SASE: secure web gateway, cloud access security broker and zero-trust network access, often with a cloud firewall. SASE is SSE plus the networking half, such as SD-WAN. A site that already has an SD-WAN can buy SSE and connect to it.
If the cloud checks my traffic, can I remove the branch firewall?
Sometimes, but not by default. The branch still needs segmentation between its own VPNs, protection for traffic that does not go to the cloud service, and a plan for when the tunnel to the cloud fails. Many designs keep a simple local firewall and send internet traffic to the cloud for deeper checks.