Create an application

This task creates a Grouped or Ungrouped Application to establish secure access controls for private applications within your Zero Trust Access policy framework.

Before you begin

  1. Create a zero trust application policy.

  2. Create an application group (required only for Grouped Applications).

Procedure

Step 1

Choose Policies > Security policies > Zero Trust Application

Step 2

Choose the policy.

Step 3

Click Add Application.

Step 4

In the Application Settings section, complete the following fields.

  • Application Name—Enter the application name.

  • External URL—Enter the URL that is used by the user to access the application.

  • Application URL—By default, the external URL is used as the Application URL. Uncheck the Use External URL as Application URL check box to specify a different URL.

    If Threat Defense uses an internal DNS, the Application URL must match an entry within that DNS to ensure it resolves to the application. In addition, if you enter a fully qualified domain name (FQDN) that could have either an IPv4 or IPv6 address, the FQDN must resolve to both IPv4 and IPv6. Threat Defense does not translate between these types of addresses.

  • Application Certificate—Choose the certificate for the private application. Click the Add (add icon) icon to configure an internal certificate object. For more information, see Add internal certificate objects.

  • Source Network Address Translation—Source Network Address Translation (source NAT) translates the source IP address in a packet to an address from a specified range.

    Enable Source Network Address Translation to specify an IP address range. The source IP address of an incoming request is translated to an IP address from the specified range. Source NAT works for both IPv4 and IPv6 addresses.

    • IPv4—Choose the source network for NAT from the list. Click Add (add icon) to create a network object. For more information, see Networks.

    • IPv6—Choose the source network for NAT from the list. Click Add (add icon) to create a network object. For more information, see Networks.

    Source NAT translates the source IP address of an incoming request to a routable IP address specified in the network object or the object group.

    Note

    Only object or object groups of type Host or Range are supported.

  • Application Group—Choose the Application Group from the drop-down list. See Create an application group.

    Note

    This field is not applicable for an ungrouped application.

Step 5

Click Next.

Step 6

Depending on the type of application:

  • For a Grouped Application, the SAML Service Provider (SP) Metadata, SAML Identity Provider (IdP) Metadata, and Re-authentication Interval are inherited from the Application Group and do not need to be configured by the user.

  • For an Ungrouped Application, perform these steps:

    1. In the SAML Service Provider (SP) Metadata section, the data is dynamically generated. Copy the Entity ID, Assertion Consumer Service (ACS) URL of the IdP, or click Download SP Metadata to download this data in XML format for adding it to the IdP. Click Next.

    2. In the SAML Identity Provider (IdP) Metadata section, add the metadata using any one of the methods:

      • XML File Upload—Choose a file or drag and drop the XML file.

        The details of the Entity ID, Single Sign-On URL, and IdP Certificate are displayed.

      • Manual Configuration—Perform these steps:

        • Entity ID—Enter the URL that is defined in the SAML IdP to identify a service provider uniquely.

        • Single Sign-On URL—Enter the URL for signing into the SAML identity provider server.

        • IdP Certificate—Choose the certificate of the IdP enrolled in threat defense to verify the messages signed by the IdP.

          Click the Add (add icon) icon to configure a new certificate enrollment object. For more information, see Add certificate enrollment.

      • Configure Later—If you do not have the IdP metadata, you can configure it later.

      Click Next.

    3. In the Re-authentication Interval section, enter the value in the Timeout Interval field and click Next. The reauthentication interval allows you to provide a value that determines when a user must authenticate again.

Step 7

In the Security Zones and Security Controls section, the security zones and threat settings are inherited from the parent policy or application group. You can override these settings. Click Next.

Step 8

Review the configuration summary. Click Edit to modify the details in any of the sections. Click Finish.

Step 9

Click Save.

The application is listed on the Zero Trust Application page and enabled by default.

What to do next

  1. Set targeted devices for zero trust access policy.

  2. Deploy configuration changes. See Deploy Configuration Changes in the Cisco Secure Firewall Management Center Administration Guide.