Secure Access Service Edge:Administrator guide for initial private access setup

Step 1: Configure an identity provider (IdP)

An identity provider (IdP) handles identity authentication for enterprise employees. SASE supports third-party and self-built authentication systems, including LDAP, DingTalk, WeChat Work, Feishu, IDaaS, and custom identity providers. If your business uses multiple IdPs, you can configure each one and enable its authentication status to use the SASE service with different IdPs.

To quickly test the feature, this topic uses a custom IdP as an example.

1. Log on to the SASE console.

2. In the left-side navigation pane, choose Identity Authentication > Identity Access.

3. On the Identity synchronization tab, find the Custom IdP, click Actions in the Edit column, and follow the on-screen instructions to configure the custom IdP. For more information, see Connect to a custom identity provider.

4. On the User Group Management tab, click Create User Group.

5. In the Create User Group panel, configure information for the user group, such as Organizational Structure, Account Name, Email Address, and Mobile Phone Number. Then, click OK. For more information, see User group management.

Step 2: Configure a user group

When you configure a policy, you must specify the user group to which the policy applies.

1. In the navigation pane on the left, choose Identity Authentication > Identity Access.

2. On the User Group Management tab, click Create User Group.

3. In the Create User Group pane, configure the Organizational Structure, Account Name, Email Address, and Mobile Phone Number for the user group. Then, click OK. For more information, see User Group Management.

Step 2: Configure a private application

In SASE, a private application represents an internal IT resource, such as an application, server, or database, that does not require a public IP address. To access a private application, employees must use a device with the SASE client installed and pass identity and security policy checks.

1. In the navigation pane on the left, choose Private Access > Application Management.

2. On the Office Application page, in the Custom Tags section, click Add, set a tag name, and then click OK.

   You can add up to 100 custom tags.

3. Click Add Application and configure the application by following these steps.

   If you have a DNS server for resolving your enterprise's internal CIDR blocks, you can click Internal DNS Configuration. In the DNS Address dialog box, manually enter the Default DNS Service and Other DNS Services. The default DNS group (each DNS group can contain up to two DNS server IP addresses) is pushed to the SASE client as the primary enterprise DNS. Employees can switch DNS groups on the client to meet specific access requirements.

   If you do not configure a DNS service, SASE automatically configures an Alibaba Cloud DNS server to resolve your enterprise's internal CIDR blocks. If Alibaba Cloud DNS PrivateZone is configured, it is prioritized for IP or domain name resolution.

   1. On the Manual Configuration tab, configure the following parameters.

      Parameter	Description	Example
      Application Name	The name of the private application. The name must be 1 to 128 characters in length and can contain Chinese characters, letters, digits, hyphens (-), underscores (_), and periods (.).	Attendance Management Application
      Description	The description of the private application.	Attendance management address for employees
      Tag	A custom tag for the application, which helps you classify, search for, and manage applications.	OA System
      Status	The access status of the application. Valid values: Enable: The application is available. Disable: The application is unavailable.	Enable

   2. Click Next and configure the following address and port information.

      Parameter	Description	Example
      Application Address	The private access address of the application. You can define applications or resources by using IP addresses, CIDR blocks, domain names, and wildcard domain names. Multiple private access addresses can be set for a single application.	10.10.1.100
      Port	The port number or port range used by the application.	80-200
      Protocol	The protocol of the application. Valid values: All Protocols, TCP, and UDP.	All Protocols

Step 3: Establish a network connection

Before you establish a network connection, confirm your current service deployment and select the appropriate connection solution.

This topic uses business resources deployed in a non-Alibaba Cloud environment as an example.

Step 4: Create a zero trust policy

A zero trust policy controls access by mapping user groups to specific applications. By default, all access is denied. You must create Allow policies to grant users access to applications.

1. In the left-side navigation pane, choose Private Access > Access Control.

2. On the Zero Trust Policies tab, click Create Policy.

3. In the Create Policy panel, configure the following parameters, and then click OK.

   You can create an unlimited number of zero trust policies based on your business requirements.

   Parameter	Description	Example
   Policy Name	The name of the zero trust policy. The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), and underscores (_).	Allow policy for attendance app
   Description	The description of the zero trust policy.	All users can access the attendance management application.
   Priority	A number that determines the evaluation order. A lower number indicates a higher priority (1 is the highest). Policies are evaluated from highest to lowest priority. If policies conflict, the policy with the higher priority takes effect.	1
   Action	The action of the policy. Valid values: Allow Access: The policy allows users or devices to access the specified application. Access Denied: The policy denies users or devices from accessing the specified application.	Allow
   Applicable User	The policy is applied to the endpoint devices of users in the specified user groups. SASE then allows or blocks matching access behaviors accordingly. Click Add. On the User Group tab, select the user group to which the policy applies. If the current user groups do not meet your needs, you can configure a new one on the Custom User Group tab. For more information about how to configure user groups, see User group management.	All employees of the company
   Selected Applications	The applications that are allowed or denied based on the Action setting. Click Add. On the Tag tab, select the specified applications based on the configured tags. You can also select applications directly on the Application tab.	Attendance Management Application
   Security Baselines	Select a security baseline template that meets your enterprise's requirements.	-
   Policy Status	Set the status of the policy.	Enabled

Step 5: Verify the configuration

1. Open the SASE client that you have installed.

2. Enter the enterprise verification ID and click OK.

   You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

3. Log on by using the initial username and password that you received by email or phone.

4. Click Connect to Private Network.

5. Access the enterprise attendance management application.

   If you can access the application, the configuration is successful.