In short: Cisco ZTNA is the private access part of Cisco Secure Access, sold as Secure Private Access. It grants per-application, deny-by-default access after checking identity (for example with Duo) and device posture, works through Cisco Secure Client or a browser, adds VPN as a service for legacy apps, and can be enforced on-premises on Secure Firewall Threat Defense.
What is Cisco ZTNA?
A traditional remote access VPN puts a user's device on the network, and from there it can usually reach far more than it needs. Zero trust network access (ZTNA) reverses that: nothing is reachable by default, every request is checked against identity, device and context, and the user is connected to one application at a time.
In Cisco's portfolio, ZTNA is delivered by Cisco Secure Access under the Secure Private Access use case, alongside VPN as a service. Secure Access draws on Duo for identity, ISE for segmentation context and ThousandEyes-based Experience Insights for performance, and hybrid private access lets remote and on-site users share the same policy. For a vendor-neutral introduction, see our ZTNA explainer.
Client-based and clientless access
| Access method | How it works | Best for |
|---|---|---|
| Client-based ZTNA | The Zero Trust Access module in Cisco Secure Client creates per-app connections, using QUIC and MASQUE, and covers non-web protocols | Managed laptops and mobile devices; Cisco lists Windows, macOS, Linux, iOS and Android support |
| Clientless (browser) ZTNA | Users reach published web apps through the browser; Cisco also lists browser-based SSH and RDP | Contractors, partners' staff and unmanaged devices |
| Enterprise browser integration | Cisco lists integration with enterprise browsers (Chrome Enterprise, Microsoft Edge for Business and Island) for more secure clientless access to private apps | Unmanaged devices that need private web apps in a controlled browser |
| VPN as a service | Full-tunnel or network-level access from the same client and policy | Legacy apps, server-initiated traffic and protocols ZTNA cannot handle |
Because the same Secure Client also carries the internet security modules, one agent covers web, DNS and private application access. If you are still on AnyConnect 4.x, read our AnyConnect end of life guide first.
How access decisions are made
- Identity: users authenticate through your SAML identity provider (for example Microsoft Entra ID or Okta) with MFA from Cisco Duo; Secure Access customers receive limited-use Duo licences
- Device posture: posture profiles evaluate the endpoint, or the browser for clientless access, against your requirements before access is granted
- Identity risk: trust levels from Cisco Identity Intelligence appear in Secure Access and, in some packages, can feed private access policy
- Least privilege: rules are written per application or application group, so a finance user never sees engineering servers
- Continuous checks: Cisco describes per-session access with continuous posture checks and a user trust profile that adjusts with behaviour, rather than a single decision at login
Private applications are published through resource connectors that run beside the application in AWS, Microsoft Azure, VMware or Docker. Cisco says they hide the application's IP address, so the applications are not exposed directly to the internet.
On-premises enforcement: universal ZTNA
Users in the office should not have to hairpin through the cloud to reach a server down the corridor. Cisco's package guide lists hybrid private access, with policy enforced in the cloud, on-premises or both, and Cisco's DNS Defense data sheet refers to the wider approach as Universal Zero Trust Network Access (UZTNA). Cisco says local enforcement can be enabled on existing Cisco firewalls, such as Secure Firewall Threat Defense, so the same zero trust policy applies whether the user is at home or on site. We check your firewall software version for support as part of the design.
Policy for both is managed centrally through Security Cloud Control, which also manages Hybrid Mesh Firewall. For industrial sites, Cisco offers a separate OT-focused ZTNA product, Secure Equipment Access.
Replacing remote access VPN, step by step
- Inventory applications and users: list every app reached over VPN, who uses it, and which protocols it needs.
- Classify the apps: web apps (clientless or client-based), thick-client and SSH/RDP apps (client-based or clientless SSH/RDP), and legacy or server-initiated flows that need VPN as a service.
- Set up identity and posture: connect your identity provider, enforce Duo MFA and define posture profiles for managed and unmanaged devices.
- Deploy resource connectors near each application group and publish the first apps.
- Upgrade endpoints to Secure Client with the Zero Trust Access module, using the same agent for internet security if you also take Secure Internet Access.
- Pilot with a friendly group, then migrate users in waves, moving app by app rather than in one big switch.
- Shrink the VPN: once apps have moved, restrict or retire the old VPN headend on Cisco ASA or Threat Defense.
Licensing and how we help
ZTNA and VPN as a service are licensed per user through Secure Private Access Essentials or Advantage, either alone or alongside Secure Internet Access; Cisco lets you buy separate user counts for each. They are also part of the User Protection Suite. See Secure Access licensing for the detail, and ask us for a quote.
We run ZTNA projects end to end: application discovery, policy design, connector deployment, Secure Client packaging and staged cut-over from VPN, with support afterwards. Contact us to plan your move away from VPN.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between ZTNA and VPN?
A VPN connects a device to a network, after which it can often reach many systems. ZTNA connects a verified user and device to one specific application at a time, with nothing visible by default, which limits what an attacker can reach with stolen credentials.
Does Cisco ZTNA need a client?
Not always. Client-based ZTNA uses the Zero Trust Access module in Cisco Secure Client and covers the widest range of apps. Clientless ZTNA works through the browser for web apps and, according to Cisco, browser-based SSH and RDP, with enterprise browser integrations as a further option.
Can Cisco ZTNA protect apps that are not web-based?
Yes. Client-based ZTNA handles non-web protocols, and VPN as a service covers legacy or server-initiated traffic that per-app access cannot.
Can Cisco ZTNA be used in the office as well as remotely?
Yes. Cisco supports hybrid private access, with policy enforced in the cloud, on-premises or both. Cisco says local enforcement can be enabled on existing Cisco firewalls, so on-site users get the same policy without routing through the cloud.
Is Cisco ZTNA part of Cisco Secure Access?
Yes. ZTNA is delivered by Secure Access as the Secure Private Access use case, licensed per user in Essentials or Advantage tiers.