Secure Access Service Edge:Cross-region acceleration best practices

Step 1: Create an identity source

1. Go to the Identity Access page and switch to the Identity synchronization tab.

2. Click Create IdP. This document uses a Custom IdP as an example.

   Note

   In production, integrate SASE with your enterprise identity provider (IdP), such as Active Directory (AD), LDAP, DingTalk, or WeCom.

   1. In the Basic Configurations section, enter an IdP Name and Description. Set IdP Status to Enabled. Click Next.

   2. In the Logon Settings section, set the PC Logon Method and Mobile Device Logon Method. This example uses the default settings. You can enable Two-factor Authentication based on your requirements.

   3. After you confirm the settings, click Ok.

Step 2: Create users and user groups

1. Go to the Identity Access page and switch to the Employee Center tab. From the drop-down list on the left, select the identity source you created, and then click Add User.

2. In the Add User panel, enter the username, password, and other required information. In the Department field, assign the user to a department within the selected identity source.

   Other form fields include:

   • Position

   • Email (required)

   • Phone

   • Employment Status: You can select statuses such as "Active"

   • Account Expiration Time: The account will be automatically frozen after expiration

   • Remarks

3. Switch to the User Group Management tab. Click Create User Group, set a name such as dev-group, and select a Group Scope as needed.

   In the Group Scope area, you can filter users by Organization, Account Name, Email, or Phone Number, and set the configuration relationship to Equal to or Not equal to.

4. Click OK.

Step 1: Add an SASE connector

1. Log on to the SASE console. In the left-side navigation pane, choose Private Access > Network Settings.

2. On the Non-Alibaba Cloud services tab, add a connector.

   1. On the Connectors tab, click Add Connector.

   2. In the Add Connector dialog box, configure the parameters as required. Then, click OK.

      Parameter	Description
      Region	Select the region closest to your server for optimal access quality.
      Instance Name	Enter a connector name.
      Instance Switch	Only when the instance switch is in the Enable state, SASE end users can access the applications associated with the connector. You can also turn on the instance switch from the connector list or on the connector Details panel. Important If you turn off the connector instance switch, end users cannot use the SASE client to access internal applications. Proceed with caution.

      The connector then appears in the connector list.

3. Enable Global Accelerator.

   1. For the connector instance you created, click Details in the Actions column.

   2. On the instance details page, find the Global Acceleration section and turn it on.

   3. In the Enable GA dialog box, enter the following information:

      Important

      When you enable Global Accelerator for the first time, you are prompted to authorize the automatic creation of the AliyunServiceRoleForGaCdt and AliyunServiceRoleForGaVpcEndpoint service-linked roles. Global Accelerator uses these roles to access your resources in SASE.

      Parameter	Description
      GA Instance Name	Required. Enter a name for the Global Accelerator instance. Important Global Accelerator fees include instance fees, capacity unit (CU) fees, and data transfer fees.
      Resource Group	Select a resource group.
      Terms of service	By clicking submit, you agree to the relevant terms of service.

      Click Next.

   4. Configure the Acceleration Region and Allocate Bandwidth.

      Parameter	Description
      Acceleration Region	Select the region closest to your users. Note The Dubai region is not supported as an acceleration region.
      Allocate Bandwidth	Range: 2 to 10,000 Mbit/s. Allocation methods: Allocate Bandwidth by Region: Specify a peak bandwidth for each acceleration region. Batch Set: Specify a uniform peak bandwidth for all acceleration regions.

      After you complete the configuration, click OK. The acceleration instance is created within a few minutes.

   5. After the instance is created, its details appear on the details page.

      The details page displays the following configuration items:

      • Instance Switch: Enabled

      • Global Acceleration: Enabled

      • Acceleration Instance status: Available

      • Acceleration Instance ID: Starts with ga-

Step 2: Deploy the connector

1. In the Operation column for the connector you added, click Deploy. On the Deploy panel, copy the deployment command.

2. Log on to the server or virtual machine where you want to deploy the connector as the root user and run the deployment command. On the Deploy panel, you can also find commands to upgrade the connector, uninstall the connector, and export logs.

   • Connectors support deployment on multiple servers for high availability (HA), connecting to the Private Access zero-trust gateway through reverse TLS encrypted connections.

   • Recommended server specifications: operating system CentOS 7.0+/Ubuntu 18.04+/Debian 12+, CPU 4 cores, bandwidth 200 Mbps, memory 8 GB.

   • Deployment/upgrade command: curl -sSL https://sase-app.oss-cn-hangzhou.aliyuncs.com/connector/install_connector.default_v2.sh | ALIUID=xxx bash

3. After deployment, the instance status changes to Connected. You can also view other information, such as the instance ID.

Step 3: Configure an enterprise acceleration policy

1. On the Access control page, switch to the Enterprise Acceleration tab, and then click Create Policy.

2. In the Create Policy panel, configure the parameters as required. Then, click OK.

   Parameter	Description
   Policy Name	The name of the enterprise acceleration policy.
   Description	The description of the policy.
   Priority	Valid values: 1 to 100. A smaller value indicates a higher priority.
   Acceleration Instance	Supported instance types: CEN: You must enter the Instance IP Address and Instance Port. Connector: Select a connector instance. Note Select the connector instance you created in the Add an SASE connector step.
   Acceleration Mode	The following modes are supported: Global Acceleration: Routes all Internet traffic through the accelerated connection. Acceleration stops when a user clicks the "Stop acceleration" button in the client. Custom Acceleration: Requires configuring custom acceleration addresses after policy creation. Only traffic to specified addresses uses the accelerated connection.
   Accelerated User Group	Select one or more user groups for acceleration.
   Display on Client	If you select this option, users can choose from different acceleration policies in the SASE client.

3. If you selected Acceleration Mode for the Custom Acceleration, you must configure acceleration addresses:

   1. For the policy you created, click Accelerated URL in the Actions column.

   2. In the Accelerated URL panel, click Add Accelerated URL. Configure acceleration addresses:

      Parameter	Description
      Acceleration address	Manually enter the acceleration addresses. You can add up to 500 addresses.
      Local bulk upload	Use a template file to upload acceleration addresses in bulk. The file must be in .xlsx format and cannot exceed 100 MB.

   3. Click OK.

Step 4 (optional): Configure managed objects

Change the Transmission network quality type to improve network transmission quality.

1. Go to the Instances page on the Global Accelerator console to view the managed objects and their statuses.

   The instance status column displays Available and Managed tags, with a tooltip showing the managed cloud service is CSAS.

2. If the current account supports Cross-border Express Connect, the automatically created managed GA instance defaults to the Cross-border Express Connect mode. Otherwise, the instance defaults to the BGP (Multi-ISP) Pro mode.

   In the Transmission Network Quality Type area at the bottom of the GA instance's Instance Information page, the Cross-border Express Connect card shows Enabled status, and the instance managed status shows Managed (CSAS).