Secure Access Service Edge:Secure cloud-native application access with SASE

Step 1: Configure an identity source

An identity provider (IdP) primarily provides identity authentication for enterprise employees, and SASE supports third-party and self-built identity authentication systems. The currently supported IdPs include LDAP, DingTalk, WeChat Work, Feishu, IDaaS, and custom identity providers. If your business uses multiple IdPs, you can configure each of them and enable their authentication status. This allows you to use the SASE service with different IdPs.

For a quick demonstration, this topic uses a custom identity source as an example.

1. Log on to the Cloud Security Access Service console.

2. In the left navigation bar, select Identity Authentication > Identity Access.

3. On the Identity synchronization tab, find Custom IdP and click Edit in the Actions column. Follow the wizard to configure the custom identity source. For more information, see Connect to a custom identity source.

Step 2: Configure a user group

When you configure a policy, you must specify the user group to which it applies.

1. In the left navigation bar, select Identity Authentication > Identity Access.

2. On the User Group Management tab, click Create User Group.

3. In the Create User Group panel, configure parameters for the user group, such as Organizational Structure, Account Name, Email Address, and Mobile Phone Number. Then, click OK. For more information, see Manage user groups.

Step 3: Enable network connection

1. In the left navigation bar, select Private Access > Network Settings.

2. On the Services on Alibaba Cloud > CEN Instance tab of the Network Settings page, view the network resources synchronized by SASE.

3. On the right side of the specified CEN instance or a VPC instance associated with the CEN instance, turn on the Network Connection switch.

4. In the Network Connection dialog box, select either Enable Network Connection for All Cloud Applications or Custom Connection to Cloud Applications.

   • Enable Network Connection for All Cloud Applications: If you select this option, all cloud-native applications connect automatically. You can connect to non-cloud applications by configuring ACL rules. Any new cloud-native applications created in this VPC also connect by default.

     Note

     Currently, only specific types of cloud-native applications are supported. To see the supported types, go to the Services on Alibaba Cloud > Cloud-native Application tab and check the Application Type column.

   • Custom Connection to Cloud Applications:

     • Select Custom Connection to Cloud Applications and click OK.

     • In the Custom Connection to Cloud Applications panel, select the applications you want to connect and click OK.

Step 4: Create a private application

Before you can use SASE private access, you must configure the IP addresses or domain names of your enterprise office applications in SASE. Only configured office applications can be accessed by employees through the SASE App.

1. Log on to the Office Security Platform console.

2. In the left navigation bar, select Private Access > Application Management.

3. Click Add Application. On the Manual Configuration tab of the Add Application panel, configure the parameters as described in the following table.

   Parameter	Description	Example
   Application Name	The name of the application. The name must be 2 to 100 characters in length and can contain Chinese characters, letters, digits, hyphens (-), underscores (_), and periods (.).	Cloud-native Application
   Status	The status of the application. You can enable or disable it.	Enable
   Access Mode	Select an access mode. Client-based Access: You must install the SASE App to access office applications. The feature supports access to Layer 4 and Layer 7 applications for employee office work and O&M, and provides rich endpoint security detection and control policies. Browser-based Access: You can use a browser to access your enterprise's web-based office applications without installing the SASE App. This mode does not support endpoint security checks or control policies.	Client-based Access

4. Click Next. Configure the Application Address, Port, and Protocol for the application, and then click OK.

   To trace access to the application, enable the Web Application Access Reinforcement feature. Select Access Tracing, choose the fields to add to the HTTP header, and then extract the information from your application.

   Available header fields include Username, Device ID, and Device IP.

Step 5: Create a zero trust policy

1. In the left navigation bar, select Private Access > Access Control.

2. On the Zero Trust Policies tab, click Create Policy.

3. In the Create Policy panel, configure the policy to allow authorized users to access the cloud-native application, and then click OK.

   Set Policy name to Cloud-native application zero trust policy, Priority to 1, and Action to Allow Access. In the Selected applications section, add the Cloud-native application.

Step 6: Verify the configuration

1. Open your installed SASE App.

2. Enter the enterprise verification ID and click OK.

   You can log on to the Secure Access Service Edge console. In the navigation pane on the left, on the Settings page, obtain the Enterprise Authentication Identifier.

3. Log on by using the initial username and password that you received by email or phone.

4. Click Connect to Private Network.

5. Access the private application. A successful connection to the private application verifies your configuration.