Introduction

Remote access is key for operations teams to manage and troubleshoot operational technology (OT) assets without time-consuming and costly site visits. In many organizations, machine builders, maintenance contractors, or the operations teams themselves have installed their own solutions: cellular gateways that nobody knows about or remote access software that IT is not controlling.

With Secure Equipment Access (SEA), Cisco is solving the challenges of deploying secure remote access to operational assets at scale. It embeds the Zero Trust Network Access (ZTNA) gateway function into Cisco industrial switches and routers, making secure remote access capabilities very simple to deploy at scale. There is no point hardware solution to source, install, and manage. No complex iDMZ firewall rules to configure. Enabling remote access is just a software feature to activate in your Cisco industrial network equipment.

Managing a large number of ZTNA gateways across your operational environment is simple. Cisco Secure Equipment Access comes with a cloud portal that centralizes gateway management and configuration of remote access policies. It acts as a ZTNA trust broker, verifying users and granting access only to specific resources based on identities and contexts.

Remote personnel (employees, vendors, and contractors) connect to the Secure Equipment Access cloud portal where they are authenticated and offered access only to the devices, protocols, and time you choose.

Remote Sessions start with a default deny posture and SEA adaptively offers the appropriate trust required at the specified time. Assets are hidden from discovery making lateral movements impossible. IP addresses are never exposed in the iDMZ, which further reduces your attack surface.

Operations Administrators can easily create credentials to meet their business needs and grant access to OT assets in two different ways:

• Clientless ZTNA: Users need a web browser to access remote OT assets using RDP, VNC, HTTP/S, SSH, or Telnet.
• Agent-based ZTNA (also called SEA Plus): SEA establishes a secure IP communication channel between the user’s computer and the OT asset, so that any desktop application can be used for advanced tasks, such as file transfer or PLC programming using native applications.

IMPORTANT: The SEA Service no longer recognizes the Device Operator role. To utilize SEA functionality, you must have one of the following designated SEA roles with the associated privileges:

• SEA System Admin
• SEA Access Admin
• SEA User

Clientless ZTNA (SEA) solution architecture

Note:

• To use Clientless SEA access features, ensure the feature is activated in your Organization on IoT OD. If you don't know the status of the feature, please contact Cisco to clarify the status or activate the required feature.
• Clientless SEA requires at least SEA-E licenses. See the SEA Ordering guide on the Cisco Sales Connect portal.

Agent-based ZTNA (SEA Plus) solution architecture

Note:

• To use Agent-based SEA (SEA Plus) features, ensure the feature is activated in your Organization on IoT OD. If you don't know the status of the feature, please contact Cisco to clarify the status or activate the required feature.
• Agent-based SEA requires at least SEA-E licenses. See the SEA Ordering guide on the Cisco Sales Connect portal.

Use the Secure Equipment Access Plus (SEA Plus) feature to establish a secure clear channel between your computer and a remote system through SEA cloud.

• When using the SEA Plus User App to access remote systems, you can employ TCP, UDP, and ICMP protocols for data transfer and to configure any particular port for enhanced security.
• For remote access that requires SEA Plus connectivity you must download and then launch the SEA Plus App to your local computer. See supported access methods and SEA Plus access method.

SEA Agent

SEA is a hybrid-cloud solution that integrates cloud-based control and management (SaaS) with on-premises industrial devices. To provide remote access, an SEA Agent should be installed to a compatible industrial device. The SEA Agent is an IOx application that enables the ZTNA gateway functionality while industrial devices run as a hosting platform for the IOx applications.

Both external and internal customers can use SEA to remotely manage access and interact with both network devices and connected clients. Remote access, using the SEA agent, is used to directly access, troubleshoot, or monitor the connected clients in your deployment.

Note: SEA requires SEA-E or SEA-A licenses. See SEA Ordering guide on the Cisco Sales Connect portal.

SEA Agent Connection States

When you open the SEA System Management page, the state of the SEA Agent Connection column is displayed. 

The table below describes the various deployment states that the SEA Agent can show.

Prerequisites

Role name and permission descriptions

There are three principal roles used in SEA. Each role has permissions specific to that role. The roles with accompanying permissions and available menu options are listed here.

Note: Roles and permissions are the same for SEA and SEA Plus.