Cisco Secure Access Help

PDF

Cisco Secure Access Help

Limitations and range limits

Updated: September 15, 2026

Want to summarize with AI?

Log in

Limitations and range limits related to the maximum number of certain components and the amount of time that your data is retained by Secure Access.

Cisco Secure Access sets limitations by component and defines the amount of time that your data is available on our system. These general limitations affect how you configure, deploy, and interact with Secure Access.

Access Policy

For information about the Access policy, see Manage the Access Policy.

  • You can add a maximum of 10,000 access rules in the Access policy.

  • You can add a maximum of 250 sources on each access rule in the Access policy.

    The total number of sources accepted in an access rule includes both pre-configured sources (resources) and sources that you enter directly on an access rule (composite sources).

    You can add at most 10 composite sources in an access rule.

  • You can add a maximum of 5000 destinations on each access rule in the Access policy.

    The total number of destinations accepted on an access rule includes both pre-configured destinations (resources) and destinations that you enter directly on an access rule (composite destinations).

    You can add at most 10 composite destinations in an access rule.

Zero Trust Access

The components of Zero Trust Access (ZTA) support the following limits:

  • You can create a maximum of 100 ZTA profiles per organization.

  • You can add a maximum of 100,000 steering destinations per ZTA profile, and 1 million steering destinations per organization.

For an in-depth list of limitations specific to Zero trust access, see Zero Trust Access Requirements and Limitations.

Cisco Secure Client

  • Secure Access checks the Cisco Secure Client Zero Trust Access (ZTA) posture profile every 5 minutes.

  • Secure Access applies private application configuration changes to the Cisco Secure Client every 10 minutes. However, on iOS this is every 4 hours.

  • Secure Client version 5.1.13 and later supports both IPv4 and IPv6.

Data Retention

  • DNS logs—Summary data (such as queries per identity or domain) is available for one calendar year.

  • DNS, Web proxy, firewall logs—Data retained for 90 days.

Destinations for Client-Based Zero Trust Traffic

Secure Access limits the number of Zero Trust traffic steering rules added in an organization for end-user connectivity. In Secure Access, the Zero Trust traffic steering rules appear on Connect > End User Connectivity > Zero Trust. For more information, see Traffic Steering for Zero Trust Access Client-Based Connections.

These limits include:

  • Destinations that are automatically added to the Zero Trust traffic steering page. When an organization enables client-based zero trust connections, Secure Access adds a traffic steering rule for each "Internally reachable address" configured for Private Resources.

  • Wildcard exceptions to the private resource addresses, which you configure on the Zero Trust traffic steering page.

  • Any other destinations configured directly on the Zero Trust traffic steering page, which is not recommended.

To reduce the number of rules, consider using wildcards. For more information, see Using Wildcards to Configure Traffic Steering for Private Destinations.

Domain Names

You can configure various components in Secure Access with domain names, for example:

Note
A domain name can have a maximum of 253 characters. A subsection or label in the domain name must have at least two and no more than 63 characters. Domain names may contain alphanumeric characters and the hyphen.

File Inspection and File Analysis

See Manage File Inspection and File Analysis for details about supported files and limitations for file inspection and analysis performed by Cisco Advanced Malware Protection (AMP), Secure Access antivirus scanner, and Cisco Secure Malware Analytics.

Internet Protocol Versions

Secure Access supports various IP versions to accommodate different network environments. The dashboard and wizards guide you in selecting the appropriate protocol based on your requirements.

Protocol Configuration Type

  • Pure IPv6 stack: A configuration where the entire communication path, including tunnels and end to end traffic, is strictly IPv6.

  • Dual stack: A configuration where tunnel endpoints communicate over IPv6, while the encapsulated internal traffic flows as IPv4.

Upstream connectivity and protocol handling : For upstream connectivity to web servers and internet-hosted resources, Secure Access connects using either IPv4 or IPv6 depending on the client configuration and destination resource. In any single transaction, only one IP version is used.

Secure Access does not support automatic IPv6 fallback to IPv4. If an upstream session or resource connection fails over IPv6, the system does not fall back or translate the request to IPv4. Clients attempting to reach IPv4-only resources over a pure IPv6 connection or unresolvable IPv6 path will fail to connect. Ensure your network routing and client configurations support the intended protocol end-to- end.

The following table outlines internet protocol and configuration support across Secure Access functions:

Table 1. Internet Protocol support by Function
Function in Secure Access Client-to-Cloud Connection (Ingress) Cloud-to-Destination Forwarding (Egress)

Remote Access VPN

 IPv4, pure IPv6, or Dual stack IPv4 and IPv6 traffic forwarding (No IPv6 to IPv4 fallback)

IPsec tunnel (Network Tunnel Group)

 IPv4, pure IPv6, or Dual stack IPv4 and IPv6 traffic forwarding (No IPv6 to IPv4 fallback)

Remote Security Module

 IPv4 or pure IPv6 IPv4 or pure IPv6

Secure Client Zero Trust Access (ZTA) - Private Access

 Dual stack Dual stack (Resource only)
Note
You can only configure IPv6 as a private resource, not a private destination.

Secure Client Zero Trust Access (ZTA) - Internet Access

 IPv4 or pure IPv6 Not supported

DNS

 IPv4, pure IPv6, or Dual stack IPv4 or pure IPv6

IP Address Restrictions

The following networks/addresses are not valid for use as:

  • Client IP pools

  • System IP pools

  • DNS and DDNS servers

  • RADIUS servers

  • Private resources

Using these addresses in the specified contexts can cause conflicts, routing issues, or operational failures.

Table 2. Restricted Networks/Addresses:
Network/Address Description
0.0.0.0/8 Addresses in this block identify source hosts on 'this' network
127.0.0.0/8 Loopback
127.0.53.53 Name collision occurrence
169.254.0.0/16 Link local
192.0.0.0/24 IETF protocol assignments
192.0.2.0/24 TEST-NET-1 (Documentation and examples)
198.18.0.0/15 Network interconnect device benchmark testing
198.51.100.0/24 TEST-NET-2 (Documentation and examples)
203.0.113.0/24 TEST-NET-3 (Documentation and examples)
224.0.0.0/4 Multicast
240.0.0.0/4 Reserved for future use
255.255.255.255/32 Limited broadcast
Note
You can use 198.18.0.0/15 network with the Secure Access internal networking fabric, in client IP pools, and for private resources. Keep it blocked for all other use cases.

For more information, refer to the following documentation topics:

Other Components

Feature Limit Description
Block Page Bypass You cannot use the Block Page Bypass feature with a redirected block page. If configured, Secure Access uses the default appearance of the block page.
Bypass Domains No more than 2000 bypass domains may be added to Secure Access. The number of bypass domains can be increased upon request.
Customer CA Signed Root Certificate Six certificates per organization.
Destination Lists

  • A destination list is not active until you set an access rule that includes the destination list.

  • A destination list's comment string can contain at most 256 characters.

  • A destination list does not support regular expressions in URL paths.

  • No more than 250K destinations may be added to the Secure Access across all the destination lists.

 Destination lists may contain fully qualified domain names (FQDN), URLs, or IP addresses.
File Download The maximum file size that can be downloaded is 5 GB, which applies only for access rules with the Isolate action. If the access rule does not specify the Isolate action, Secure Access will permit downloads of files greater than 5 GB. Secure Access scans the downloaded files.
File Scanning (Antivirus, Threat Grid, and AMP)

  • A file must be less than 50 MB.

  • Compressed file scanning supports no more than 16 levels of recursion.

  • AMP: The system computes only the archive hash, not hashes for files inside archives.
File Transfer The maximum file size that the Secure Web Gateway (SWG) can upload is 20 GB.
Internal Networks No more than 5000 internal networks may be added to Secure Access.
Network Tunnel Groups

  • Static Traffic Selector Prefixes must not exceed 100

  • BGP prefixes must not exceed 10,000

  • The combination of local and remote traffic selector prefixes (those configured dashboard in the dashboard plus transmitted via IKE) must not exceed 100. Customers should utilize BGP for more complex or dynamic networks.

  • Network Tunnel Groups with BGP can support up to 10,000 prefixes.
Reserved IP 20 reserved IP addresses per organization per DC or Secure Access region. Reserved IP supports 20 IPs per organization per region (sufficient for 160 Gbps of throughput).
WebSockets and HTTP PATCH For WebSockets or HTTP PATCH requests, the Secure Access Secure Web Gateway does not perform file inspection.

Reports

For details on data retention periods for each report type, see Report retention.

Feature Limit

  • Scheduled Report (email attachment)

 Accepts up to 10,000 rows of data.

  • Exported Report (CSV export)

 Exports no more than 100,000 rows of data.

Resource Connectors and Resource Connector Groups

Feature Limit
Maximum number of connector groups per organization 50
Maximum number of connectors per connector group 50

Service Connections

The number of total, concurrent browser-based Secure Shell (SSH) and Remote Desktop Protocol (RDP) sessions supported is limited to the total number of Secure Access Advantage, Secure Private Access (SPA) licenses purchased, regardless of the number of configured applications.

Users and Groups

For general information about adding users, groups, and endpoint devices, see Manage Users, Groups, and Endpoints Devices.

Cloud Identity Providers

Secure Access supports provisioning up to 1000 groups from a supported cloud identity provider (IdP). For information about provisioning users and groups, see Manage Cloud Identity Providers.

Note
If you have more than 1000 groups in the organization, contact Support to get assistance with importing the groups in Secure Access. For more information, see Cisco Support.

Users and Private Applications

For access to private applications, configure the user and private applications to use the same data center.