In short
Cisco universal ZTNA is client-based zero trust network access applying the same per-user, per-application policy whether people are remote or on-premises. Cisco Secure Access defines policy and enforces it in the cloud, Secure Firewall Threat Defense enforces it for on-site resources with IPS and malware inspection, Cisco Secure Client is the endpoint enforcement point, and Security Cloud Control manages both.
Get a quote for Cisco universal ZTNA
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Cisco universal ZTNA is
Cisco's documentation describes universal zero trust network access (universal ZTNA) as a way to allow access to internal resources specifically according to user identity, trust and posture. Unlike remote access VPN, it does not give access to the whole network, and it does not assume that access to one application authorises access to any other.
The word universal refers to location. Many ZTNA services only govern remote users: traffic goes to a cloud broker, policy is checked and a connection is brokered to the application. Users in the office, meanwhile, often reach the same applications directly over the LAN with far fewer checks. Universal ZTNA closes that gap by enforcing the same policy on Cisco Secure Firewall for on-premises resources, so a user's access is the same at home, in a branch or at head office.
Cisco introduced universal ZTNA in August 2025, with Management Center 7.7.10 and managed devices on Threat Defense 10.0 or later. For the cloud side on its own, see Cisco ZTNA on our Cisco site, and for the general model, how zero trust network access works.
The components and what each does
| Component | Role in universal ZTNA (per Cisco's documentation) |
|---|---|
| Cisco Secure Access | Defines access policies, posture requirements and security profiles for users, and enforces policy for user traffic through Cisco's cloud |
| Secure Firewall Threat Defense | Enforces universal ZTNA policy for on-premises resources and inspects that traffic with intrusion prevention (IPS), file and malware policies |
| Cisco Secure Client | Installed on the user's device, where it acts as the enforcement point that intercepts connection requests to protected internal resources |
| Security Cloud Control | A unified management plane for both Secure Access and the firewall; its Firewall Management service (formerly Cisco Defense Orchestrator) configures and deploys universal ZTNA policy to Threat Defense |
| Firewall Management Center | Manages the Threat Defense devices; Cisco supports both the on-premises and cloud-delivered Management Center |
| Identity provider and Cisco Duo | Users sign in through your SAML identity provider, such as Microsoft Entra ID or Okta, and Duo can supply MFA and device trust |
Universal ZTNA is a client-based design: the decision point sits in Secure Client on the device. Cisco's client-based ZTNA uses QUIC and MASQUE for per-application connections. Clientless browser access for contractors is a separate Secure Access feature, covered on agentless ZTNA.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What happens when a user opens an internal app
- The user signs in to Secure Client with your identity provider, with MFA (for example Duo device trust checks on the device).
- Secure Access evaluates the user, their groups and the device posture against the access policy for that application.
- Secure Client intercepts the request for the protected resource. If the user is remote, the connection is brokered through Cisco's cloud to the application, typically through a resource connector beside it.
- If the user is on-premises, the connection is enforced by Secure Firewall Threat Defense instead, which also applies IPS, file and malware inspection.
- Either way the user reaches only that application, and every decision is logged for review.
The outcome is one set of rules, written once, applied consistently. A finance user can reach the finance system from anywhere, and cannot reach engineering servers from anywhere, including from a desk in the office.
Universal ZTNA vs remote access VPN
| Remote access VPN on Secure Firewall | Cisco universal ZTNA | |
|---|---|---|
| What is granted | A network address and routes to subnets | Access to one application per policy |
| Remote and on-site users | Different controls: VPN remotely, LAN access on site | The same per-application policy in both places |
| Device posture | Optional, checked at connection | Part of every access decision |
| Inspection | Depends on firewall rules after the tunnel | IPS, file and malware policy on Threat Defense for on-site resources; Secure Access security profiles in the cloud |
| Client | Cisco Secure Client VPN module | Cisco Secure Client as the enforcement point |
| Legacy and server-initiated traffic | Handled well | May still need VPN, or VPN as a service in Secure Access |
The broader comparison is on ZTNA vs VPN, and the relationship with on-site network access control is on ZTNA vs NAC.
Is Cisco universal ZTNA the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Who it suits and what to check first
Universal ZTNA makes most sense for organisations that already run, or are moving to, Cisco Secure Firewall with Threat Defense software and use Cisco Secure Client (or its predecessor, AnyConnect) for remote access. That is also why it is a common topic in Cisco firewall migration to ZTNA projects: an ASA or Threat Defense refresh is a natural moment to stop handing remote users network access.
Things we check before design:
- Firewall software versions: universal ZTNA needs Threat Defense version 10 or later on managed devices, and Cisco notes that upgrading a universal ZTNA device from an older release to 10.1 or later disables the feature until policy is redeployed, so upgrades are planned
- Management: whether you use an on-premises or cloud-delivered Management Center, and onboarding both it and Secure Access into Security Cloud Control
- Secure Access package: which Secure Private Access tier your users need
- Identity and devices: identity provider, MFA and posture requirements for managed devices
- Applications that will not suit ZTNA: legacy or server-initiated flows that should stay on VPN or move to VPN as a service
If you are not a Cisco firewall customer, Cisco Secure Access on its own still provides cloud-delivered ZTNA, and other options are compared on ZTNA providers.
Universal ZTNA, NAC and segmentation
Universal ZTNA governs which applications a signed-in user can reach. It does not replace the controls that decide which devices may join the network in the first place, or how servers talk to each other:
- Network access control with Cisco ISE still admits devices to the LAN, including printers, phones and IoT devices that have no user and no Secure Client. The two complement each other, as explained on ZTNA vs NAC.
- Segmentation inside the network limits what a compromised server can reach. Universal ZTNA limits user-to-application access; for server-to-server traffic see network segmentation vs microsegmentation.
- Internet and SaaS protection for the same users comes from Secure Internet Access, part of the wider Secure Access service.
Together these support the NCSC's requirement to limit the impact of compromise: if one account or laptop is taken over, the attacker reaches only what that user's policy allows, wherever they are connected from.
Licensing
Universal ZTNA depends on Cisco Secure Access, which is licensed per user in Essentials or Advantage packages for Secure Private Access (on its own or with Secure Internet Access), on 12, 36 or 60-month terms, plus the Threat Defense firewalls and their management. Exactly which packages and firewall licences a design needs depends on your estate, so we confirm it at quote. The detail is on Cisco Secure Access licensing, and the cost drivers for any ZTNA product on ZTNA cost. We do not publish prices: ask us for a quote.
How Forever Systems helps
We can review your firewall estate and remote access, check version and licensing readiness, design the universal ZTNA policy with you, onboard Secure Access and your firewalls into Security Cloud Control, and migrate users from VPN in stages. Where Cisco's SD-WAN is also in scope, Cisco SASE brings the network side together. Scope and timescales are confirmed at quote. Contact us to talk it through.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is Cisco universal ZTNA?
Cisco's client-based zero trust network access that applies the same per-user, per-application policy to remote and on-premises users. Cisco Secure Access defines and enforces policy in the cloud, Secure Firewall Threat Defense enforces it for on-site resources, Cisco Secure Client is the endpoint enforcement point and Security Cloud Control manages them together.
How is universal ZTNA different from Cisco ZTNA in Secure Access?
Cisco ZTNA in Secure Access brokers remote users to private applications through Cisco's cloud. Universal ZTNA extends that same policy to users on site by enforcing it on Secure Firewall Threat Defense, so access is consistent wherever people work.
Do I need Cisco Secure Firewall for universal ZTNA?
For on-premises enforcement, yes: Threat Defense enforces policy for on-site resources and needs version 10 or later on managed devices. Without it you can still use Cisco Secure Access for cloud-delivered ZTNA.
Does universal ZTNA replace the Cisco remote access VPN?
For most applications it can. Cisco positions it as not granting whole-network access the way remote access VPN does. Legacy and server-initiated traffic may still need VPN or VPN as a service, which Secure Access also provides.
Does Cisco universal ZTNA need a client?
Yes. Universal ZTNA is client-based, with Cisco Secure Client on the device as the enforcement point. Clientless browser access is a separate Secure Access option for contractors and unmanaged devices.
Still have a question about Cisco universal ZTNA?
Ask us and a member of our team will reply by email.
More zero trust access guides
Check Point ZTNAPrivate Access in the Check Point SASE Platform: agent-based and agentless ZTNA over a private backbone.ZTNA vs NACNetwork access control on the LAN compared with per-app zero trust access from anywhere.ZTNA vs VPNPer-app zero trust access compared with network-level VPN access, and when a VPN still makes sense.SASE vs firewallOn-premises NGFW vs SASE and firewall as a service: where inspection happens and whether you still need a firewall.