Secure Access Service Edge:Configure private access

Step 1: Configure an identity provider (IdP)

An identity provider (IdP) authenticates your employees. SASE supports both third-party and self-managed identity providers (IdPs), including LDAP, DingTalk, WeCom, Lark, IDaaS, and custom IdPs. If your business uses multiple IdPs, configure all of them so different teams use the SASE service with their preferred provider.

The following example uses a custom IdP.

1. Log on to the SASE platform.

2. In the left-side navigation pane, choose Identity Authentication > Identity Access.

3. On the Identity synchronization tab, find Custom IdP, and click Actions in the Edit column. Configure the custom IdP by following the wizard. For more information, see Connect to a custom identity provider.

4. On the User Group Management tab, click Create User Group.

5. In the Create User Group panel, configure the Organizational Structure, Account Name, Email Address, Mobile Phone Number, and other information for the user group. Then, click OK. User Group Management.

Step 2: Configure a user group

A policy must target a user group. Create one if needed.

1. In the left-side navigation pane, choose Identity Authentication > Identity Access.

2. On the User Group Management tab, click Create User Group.

3. In the Create User Group panel, configure the Organizational Structure, Account Name, Email Address, Mobile Phone Number, and other information for the user group. Then, click OK. User Group Management.

Step 3: Configure private application resources

Private applications are internal IT resources—such as applications, servers, or databases—that employees access from their work devices through the SASE client after passing identity and security policy checks. No public IP addresses are required for these LAN applications or resources.

1. In the navigation pane on the left, choose Private Access > Application Management.

2. On the Office Application page, in the Custom Tags section, click Add, enter a tag name, and then click OK.

   You can add up to 100 custom tags.

3. Click Add Application and configure the application as follows.

   If your services use a DNS server to resolve your internal network segments, you can click Internal DNS Configuration. In the DNS Address dialog box, manually specify the Default DNS Service and Other DNS Services. The default DNS group (a DNS group can contain up to two DNS server IP addresses) is sent to the SASE client as the primary enterprise DNS. Employees can switch DNS groups on the client to meet specific access requirements.

   If you do not configure a DNS service, SASE uses Alibaba Cloud DNS by default for internal network resolution. If Alibaba Cloud DNS PrivateZone is configured, it is prioritized for resolving IP addresses or domain names.

   1. On the Manual Configuration tab, set the basic parameters as described in the following table.

      Parameter	Description	Example
      Application Name	The name of the private application. The name must be 1 to 128 characters in length and can contain Chinese characters, letters, digits, hyphens (-), underscores (_), and periods (.).	Attendance Management App
      Description	A description of the private application.	Attendance management portal for employees
      Tag	A custom tag for the application, used to categorize, search for, and manage applications.	OA_System
      Status	The access status of the application. Valid values: Enable: The application is available. Disable: The application is unavailable.	Enabled

   2. Click Next and set the application address information as described in the following table.

      Parameter	Description	Example
      Application Address	The private access address. Supports IP addresses, CIDR blocks, domain names, and wildcard domain names. You can specify multiple addresses.	10.10.XX.XX
      Port	The port number or port range used by the application.	80-200
      Protocol	The protocol type of the application. Valid values: All Protocols, TCP, and UDP.	All

   

Step 4: Establish a network connection

Identify your deployment scenario to select the correct connection method.

The following example uses a non-Alibaba Cloud deployment.

Step 5: Create a zero trust policy

Zero trust policies help you control access to applications and resources for employees and partners. Creating a zero trust policy involves assigning resource permissions by linking user groups to business applications. A deny-all policy is in place by default—create allow policies to grant different user groups access to specific resources.

1. In the left-side navigation pane, choose Private Access > Access Control.

2. On the Zero Trust Policies tab, click Create Policy.

3. In the Create Policy panel, configure the basic information as described in the following table, and then click OK.

   There is no limit on the number of zero trust policies you can create. You can create multiple policies to cover different access scenarios.

   Parameter	Description	Example
   Policy Name	The name of the zero trust policy. The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).	Allow_Policy_for_Attendance_App
   Description	A description of the zero trust policy.	Allows all users to access the attendance management application.
   Priority	The priority of the policy. Lower values take precedence (1 = highest). The maximum priority value for a new policy is the current number of zero trust policies plus one. For example, if you have 17 policies, the priority for a new policy can range from 1 to 18. Conflicting policies resolve by priority.	1
   Action	The access permission for the policy. Valid values: Allow Access: Allows users or devices to access the specified application. Access Denied: Denies users or devices access to the specified application.	Allow
   Applicable User	The user group this policy applies to. The zero trust policy takes effect on devices belonging to the specified user group. SASE allows or denies access requests that match the policy. Click Add. On the User Group tab, select a user group. If the existing user groups do not meet your needs, you can create a new one on the Custom User Group tab. User Group Management.	All company employees
   Selected Applications	The applications affected by the policy's Action. Click Add. On the Tag tab, select applications based on their tags. You can also select applications directly from the Application tab.	Attendance Management App
   Security Baselines	Select a security baseline template for your enterprise.	-
   Policy Status	Enables or disables the policy.	Enabled

   

Step 6: Verify the configuration

1. Open your installed SASE client.

2. Enter the enterprise verification ID and click OK.

   You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

3. Log on by using the initial username and password that you received by email or text message.

4. Click Connect to Private Network.

5. Access the enterprise attendance management application.

   If you can access the application, the configuration is successful.