Implementing SD-WAN security policies for distributed workforces?

All answers to this question.

The trick to a successful SASE rollout is integrating Cisco Umbrella with your SD-WAN fabric. This allows you to offload security functions to the cloud, reducing the load on your branch routers while providing consistent DNS-layer security and web filtering for all users. In early 2024, we transitioned to this model and found that it significantly reduced latency for SaaS applications like Office 365. Make sure you use the automated tunnels between the vEdge devices and the Umbrella head-ends to simplify the management of your security policies across hundreds of sites.

   Answered 2024-03-07 by Lisa Peterson

How are you managing the user identity piece of the SASE puzzle? Are you using Cisco ISE for centralized policy enforcement, or are you relying on local authentication? Integrating your identity provider with the SASE cloud is usually the biggest point of failure during initial deployment.

   Answered 2024-03-09 by Brian Collins

• Brian, we are using Cisco ISE integrated with Azure AD. This allows us to push identity-based policies directly to the SD-WAN edge. Your question actually highlighted a gap in our guest network policy—we weren't properly tagging those users. Correcting that has helped us segment the traffic more effectively without adding complexity to the end-user login process.

     Commented 2024-03-10 by Jennifer Adams

Don't forget to enable "Direct Internet Access" (DIA) for trusted applications to bypass the data center. It’s the fastest way to improve user experience for video conferencing.

   Answered 2024-03-11 by Sandra Miller

• Absolutely, Sandra. DIA for Webex and Zoom was the single biggest "win" for our helpdesk tickets after the hybrid transition. Users noticed the speed difference immediately.

     Commented 2024-03-12 by Lisa Peterson