What's New
15 min
Features part of SKU based licensing:
- Custom WAF blocking rules
- Features access management
- Patch lifecycle management
- AI Chat interface
- Threat Neutralizer
- Scanning with Indicator of Comromise
- Platform-specific Client OS packages
Note: These features are in Beta and will be enabled for few customers. Customers who want to test these features must reachout via their Ivanti Sales Reps.
NSA provides centralized control of features on the ICS Gateways/Gateway Groups directly from NSA User Interface. Multiple features can be selected across multiple gateways and enabled/disabled in one action. For details, see Features Access Managementaccess.
The Indicator of Compromise (IoC) feature is a licensed NSA capability that scans ICS gateways for runtime anomalies and threats. It reports gateway health status to the ICT service and triggers admin alerts. For details, see Scanning with Indicator of Compromiseabc.
- RSA Authentication Manager (formerly known as ACE/Server) is supported that allows user authentication based on credentials from the RSA SecurID® product from RSA Security Inc. For details, see Using a RSA Server (REST API)RSA Authentication Server.
- Microsoft's Windows Hello for Business (WHfB) is supported which is passwordless authentication solution for Windows devices. For details, seeWindows Hello for Business SSO Serveraaa.
- Post-Quantum Cryptography (PQC) is supported to protect against future quantum computer attacks. For details, see Inbound SSL Optionsabs and Outbound SSL Optionsabc.
Patch packages provides a controlled patch lifecycle for gateways, enabling seamless patch upgrades, rollback, and removal without disrupting gateways operations. This feature is controlled by the feature entitlement. For details, see Patch Lifecycle ManagementPatch lifecycle management.
Tenant admins can create WAF rules to block specific traffic such as bad IPs, malicious payloads, etc. This feature is controlled by the feature entitlement. For details, see Creating Custom WAF RulesCustom WAF Rules.
The ISAC Client Components now offers different client versions list per OS. The platform-specific option lets tenant admins to independently activate packages and enforce Minimum Support Version per OS. This feature is controlled by the feature entitlement. For details, see Manage Ivanti Secure Access Client Versionsclient, and Upgrading Gateways and Clusters with Ivanti Secure Access Clientupgrade.
- Combined ISAC package supporting all Desktop Client OSes continues to be supported as is.
- On uploading a new Client package, only the affected clients receive the upgrade prompt.
- Applying client hotfix for specific OS saves time for tenant admins managing multiple ICS deployments.
Automated monitoring of license expiry ensures efficient license management, timely awareness, and improved operational efficiency. This feature introduces daily tenant lifecycle checks, milestone-based notifications through email and alerts, and a configurable 30-day grace period. For details, see NSA Licensing/SubscriptionNSA Licensing/Subscription.
Archiving config sync rule allows to deactivate the rule temporarily instead of deleting the rule. The archived rule can be unarchived without losing its configuration for later use. For details, see Archiving Config Sync RuleArchiving Config Sync Rule.
Deleting a gateway or self-deregistration automatically performs end-to-end cleanup and stops communication with NSA. Disabling a tenant automatically cleans up associated gateways and blocks NSA access. VTM synchronizes blacklist data and blocks traffic from deleted gateways and disabled tenants.
Important Updates and Improvements
- ICS Upgrade Enhancements and Duration Improvements: The upgrade workflow has been enhanced to improve efficiency and provide better visibility into gateway upgrade operations. These enhancements help streamline upgrade activities and reduce the overall duration required to complete gateway upgrades across managed deployments. For details, see Upgrading Gateways and Clusters with a New Gateway Version.
- ICS Config Backup, Restore and Scheduled Backup (supported for ICS 22.7, ICS 22.8 and ICS 25.1.3.0 Gateways): NSA now provides enhanced configuration backup and restore capabilities for managed ICS gateways. Administrators can back up gateway configurations and restore them when required, simplifying operational recovery and configuration management. For more details, see Config Backup, Restore and Schedule Backup.
- NSA Alerts Enhancements: This release introduces enhancements to the NSA alerting framework, providing improved visibility into events and operational conditions. These improvements help administrators more effectively monitor and respond to important system activities. For details, see Managing Alerts and Notifications.
- Licensing for Cloud Storage Phase 1: Phase 1 of Cloud Storage Licensing introduces foundational licensing capabilities required for cloud-based storage services and future cloud storage enhancements.
- Advanced HTML5 Feature Licensing support: NSA now supports licensing and feature entitlement management for Advanced HTML5 functionality on 22.8R2 and 25.x gateway platforms, simplifying feature activation and deployment management. ICS Gateway side enhancements for feature licensing have been progressively integrated into the platform to support upcoming NSA capabilities. For details, see Feature Licenses.
Zero Day Support for External ICT and for 25.1.3.0 Gateways: This release adds Zero-Day support capabilities for External ICT deployments and extends support to ICS 25.1.3.0 gateways, enabling administrators to manage and monitor newer gateway deployments through NSA. Support for 25.1.3.0 includes the latest ICS platform features and enhancements. For details, see Scanning with External Integrity Checker Tool.22.8R1.12
Important Updates and Improvements
- ICS Upgrade Enhancements and Duration Improvements: The upgrade workflow has been enhanced to improve efficiency and provide better visibility into gateway upgrade operations. These enhancements help streamline upgrade activities and reduce the overall duration required to complete gateway upgrades across managed deployments. For details, see Upgrading Gateways and Clusters with a New Gateway Version.
- ICS Config Backup, Restore and Scheduled Backup (supported for ICS 22.7, ICS 22.8 and ICS 25.1.3.0 Gateways): NSA now provides enhanced configuration backup and restore capabilities for managed ICS gateways. Administrators can back up gateway configurations and restore them when required, simplifying operational recovery and configuration management. For more details, see Config Backup, Restore and Schedule Backup.
- NSA Alerts Enhancements: This release introduces enhancements to the NSA alerting framework, providing improved visibility into events and operational conditions. These improvements help administrators more effectively monitor and respond to important system activities. For details, see Managing Alerts and Notifications.
- Licensing for Cloud Storage Phase 1: Phase 1 of Cloud Storage Licensing introduces foundational licensing capabilities required for cloud-based storage services and future cloud storage enhancements.
- Advanced HTML5 Feature Licensing support: NSA now supports licensing and feature entitlement management for Advanced HTML5 functionality on 22.8R2 and 25.x gateway platforms, simplifying feature activation and deployment management. ICS Gateway side enhancements for feature licensing have been progressively integrated into the platform to support upcoming NSA capabilities. For details, see Feature Licenses.
- Zero Day Support for External ICT and for 25.1.3.0 Gateways: This release adds Zero-Day support capabilities for External ICT deployments and extends support to ICS 25.1.3.0 gateways, enabling administrators to manage and monitor newer gateway deployments through NSA. Support for 25.1.3.0 includes the latest ICS platform features and enhancements. For details, see Scanning with External Integrity Checker Tool.
Important Updates and Improvements
- Support for ICS Gateway versions 22.7R2.13, 22.8R2.4, 25.1.1.1 and 25.1.2.1in nSA Controller
- Critical Service Updates
- Brief service disruption expected during maintenance window for nSA administrators.
- No disruption for VPN end users running 22.7R2.5 or above.
- Brief disruption to first time VPN users logging in onto ICS Gateway version 25.1.0.0 during the maintenance window.
Important Updates and Improvements
- ICS Config Backup and Restore: This feature enhancement allows tenant admin to download config backup package of any of the supported gateways. This downloaded config package can be used to restore the user configuration via ICS Gateway UI. For more details, see Config Backup and Restore.
- Alert Enhancements: The goal of alert enhancements is to ensure that only genuine, actionable alerts are displayed to users, while minimizing false positives. This improves operational efficiency, reduces unnecessary distractions, and ensures that attention is focused on real issues. This feature enhancement allows tenant admin to configure frequency for email notifications. Event logs is added in Tenant Admin Logs for Config Authoring and Config Sync activities instead of raising alerts.
Key Enhancements are:
- Suppression of Transient Alerts
- Gateway Down/Up Events: If a gateway goes down, it triggers the gateway disconnect alert. This gateway disconnect alert will be suppressed / removed once the gateway connects back.
- Short-lived Failures: Alerts triggered by temporary or self-resolving issues will not be shown to users. Currently this functionality applies only to gateway disconnect and reconnect cases.
- Historical Data in Event Logging
- Event Logging Repository: Config Authoring and Config Sync related alerts are recorded in event logs.
- Separation of Alerts and Logs: Alerts are reserved for real-time actionable issues, while logs provide a complete historical record.
- Audit and Analysis: Event logs can be used for trend analysis, troubleshooting, and compliance purposes.
For more details, see Managing Alerts and Notifications and Checking Tenant Admin Logs.
- Support for ICS Gateway version 25.1.2.0 in NSA Controller: This release supports registering the ICS Gateway (ISA6500 Hardware) with nSA controller.
- Troubleshooting Enhancements: This feature enhancement simplifies Gateway troubleshooting, which includes enhanced Debug Log, Node Monitoring, TCP Dump, System Snapshot, and Network Command functionalities. For more details, see Using the Troubleshooting Tools.
- ISAC package management : ISAC Client packages are separately provided for ICS and ZTA so that these can be managed independently. This provides flexibility to plan for ZTA ISAC releases. For more details, see Upgrading Multiple Gateways and Clusters.
- Support for ICS Gateway version 25.1.1.0 in NSA Controller
- Critical Service Updates
- Feature parity with ICS Gateway
The following features are supported with ICS 22.7R2.12, 22.8R2.3, 25.1.1.0:
- Proxy Servers for PSAM Connections: ICS Gateway supports Proxy Server for connections to PSAM destination (TCP only) via Proxy Servers. Administrators can modify existing policies to route traffic through proxy servers, enhancing both security and scalability. For details, see Proxy Servers for PSAM Connection.
- Samsung Knox Manage: This feature enhances security by ensuring that only authorized android devices are permitted access based on validated device identifiers. For details, see Configuring MDM Authentication Server.
- Source IP and Geo-Location access restriction: Allows administrators to configure and enable both Geo-Location and manual IP lists simultaneously. This enhancement improves ICS security by allowing customers to better restrict access from bad actors while permitting legitimate traffic. For details, see Configuring Administrator Access.
- DSIDID Enforcement for Secure VPN Authentication: DSIDID enforcement ensures secure VPN authentication by verifying both DSID and DSIDID cookies. This provides an additional layer of device and session validation, enhancing overall security. For details, see Miscellaneous Setup.
Important Updates and Improvements
- Critical Service Updates
- Enhancement: Syslog Server Configuration : To optimize syslog server connectivity and performance, the Syslog Server configuration interface now includes a new dropdown enabling users to explicitly select the Server CA (Certificate Authority) when setting up secure connections. This enhancement complements the existing client certificate option and addresses latency issues during SSL handshakes.
- Key Improvements:
- Targeted Server CA Selection: Administrators can now specify which Server CA to use when configuring syslog servers. Previously, if no Server CA was selected, the system sequentially tested all trusted CAs in the tenant during connection establishment, which increased connection times. This results in a better performance and a better user experience.
- Reduced Latency and Streamlined Handshakes:Enhanced the syslog forwarding mechanism to enable real-time log delivery by directly consuming gateway log events.
- Improved Security and Accuracy:By ensuring the correct Server CA is always used, this enhancement minimizes the risk of mismatched certificates and strengthens secure logging communications.
- Enhanced User Experience: The refined UI makes syslog server setup more intuitive and efficient, speeding up configuration and accelerating message delivery.
Administrators are encouraged to specify the relevant Server CA when adding or editing syslog server configurations to gain the benefits of this enhancement.
For details, see Syslog Forwarding.
- ICS Config Backup: This feature allows tenant admin to take config backup of any of the supported gateways. For more details, see Config Backup.
- Gateway Upgrade Improvements:
- Current version column is added in the Gateways list table.
- Confirmation dialog is added for manual upgrades. For more details, see Upgrading Gateways and Clusters with a New Gateway Version.
- Feature parity with ICS Gateway releases -
The following features are Deprecated/ Changed (Applicable from 22.7R2.11, 22.8R2.2, 25.1.1.0 onwards):
- Enterprise Onboarding is disabled in Users main menu.
- Fallback to NTLMv1 authentication option is not supported.
- Hosted Java applets, OWA (2010/13/16+), Lotus iNotes 7/8/8.5, and MSRDWeb in Rewriter applications are not supported.
- IP plus Location based restrictions at realm level.
- Java Support options in Citrix/VDI/Terminal Services resource profiles are not supported.
- NTLMv1 protocol in Active Directory authentication is not supported.
- SAML 1.1 is not supported.
- SAML Artifact options in IDP and SP configurations are not supported.
- TOTP as a fallback server is supported.
- Virtual Desktop menu is hidden.
- (Preview) AI-based migration of ICS Configuration to ZTA Gateways: This preview feature allows tenant admin to fetch the config details of one or more ICS gateways to migrate to one or more ZTA gateways. For more details, see AI-based Migration of ICS Configrations to ZTA Gateways.
- External Integrity Checker Tool enhancements: This release includes scheduling, history and snapshot downloading options along with RBAC support. For more details, see Scanning with External Integrity Checker Tool.
- UAL enhancements: First Login time and Last Login time details are provided in the Subscriptions > Users page. For more details, see Device to User Normalization.
- Feature parity with ICS Gateway release 22.7R2.10:
- Troubleshooting with Portprobe command: Use Portprobe command to display the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) port status. For more details, see Troubleshooting TCP and UDP Port Status.
- Proof Key of Code Exchange (PKCE) Support: Enabling Proof Key for Code Exchange (PKCE) helps to protect against interception of the authorization code returned from the authorization endpoint. For more details, see Configuring OAuth Server
- SFTP method of archiving servers. For more details, see Archiving Servers.
- Selection of IE as embedded browser in Client Connections is removed. For more details, see Ivanti Secure Access Client Connections.
- Admin experience enhancement: Enhanced page controls to select the number of log records per page and to select a specific page. For more details, see Viewing Log Records.
- Log Forwarding to NSA from ICS: A configurable option on the ICS gateway is added to stop forwarding logs to the NSA. By default, log forwarding is enabled during registration, but it can be toggled off. When disabled, the NSA controller will not display any log or analytics data. For more details, see Completing Registration of an ICS Appliance.
Deprecated/Unsupported Features in ICS 25.x Gateways
Upgrading to ICS GW version 25.1.0.0 is supported only from version 22.8R2 for standalone ISA hardware appliances and ISA-V ESX virtual appliances.
Note that cluster upgrades are not supported. Additionally, upgrades from earlier versions (22.7R2.x and below) to 25.1.0.0 are not supported.
For 25.x gateway, a popup/tooltip message will be shown in the NSA for the following pages:
- SAML ECP Use Cases – need “ECP definition”
- Named Users model on the gateways. Applies only for Classic Named user model.
- Enterprise Onboarding, see Enterprise Onboarding.
- DMI & NetConf
- OWA 2010, OWA 2013 and All OWA versions, see Microsoft OWA Versions.
- Lotus iNotes 7 and 8, see Lotus iNotes Versions.
- Hosted Java Applet, see Hosted Java Applet.
- Java support options under Citrix and VDI profiles, see Terminal Services, Virtual Desktop.
- Resource profiles > HTML5 > Performance flags
- Resource profiles > WEB > MS Rdweb, see Microsoft RDWeb.
- Protocol Binding to use for SAML Response
- SAML > Artifact, see SAML Identity Provider.
- AD > NTLM V1
- VMWare View and Citrix Client Delivery
- VDI: System > Configuration > Virtual Desktops, see Virtual Desktops Configuration.
- Citrix: System > Configuration > Virtual Desktops > Disable Citrix tab
- Cloud Secure
- Multicast
- Telnet client in HTML5 Resource Profile
- UAL enhancements
- Sort option for Updated time is provided in the Subscriptions > Users page.
- Auto-delete function is now extended to machine logins.
For more details, see Device to User Normalization.
- Manage Advanced HTML5: Tenant admin can now apply feature licenses (Advanced HTML5) for gateways. For more details, see Feature Licenses.
- Alerts and Notifications enhancement: Tenant admin can configure alerts with users Email IDs to whom the Email notification should be sent. For more details, see Managing Alerts and Notifications.
- External Integrity Checker Tool: External Integrity Check scanning tool is provided to scan the system to check for any integrity anomalies. For more details, see Scanning with External Integrity Checker Tool.
- Feature parity with ICS Gateway release:
- Web Application Firewall (WAF) configuration for ICS Gateways protects web applications by filtering and monitoring HTTP traffic, preventing attacks such as SQL injection, cross-site scripting (XSS), and other web exploits. This feature is supported from ICS Gateway 22.8R2 release. For more details, see Configuring Web Application Firewall.
- Debug logs now provides Web server logs with debug severity codes for web-related events. This feature is supported from ICS Gateway 22.8R2 release. For more details, see Using the Debug Log.
- Ivanti recommends MFA for all realms. This feature is supported from ICS Gateway 22.7R2.7 release. If not configured with MFA, realms will be listed in red color. For more details, see Configuring User Realm.
- Suspend tunnel on smart card removal. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see Ivanti Secure Access Client Connection is Established Options.
- Specifying passwords for configuration files is mandatory. This feature is supported from ICS Gateway 22.8R2 release. For details, see Configuration File Administration, and Exporting/Importing TOTP Users.
- Limiting simultaneous connections from a single IP address to the server. This feature is supported from ICS Gateway 22.8R2 release. For details, see Miscellaneous Setup.
- Admin experience enhancement:
- When the Auto Delete process deletes a user, a corresponding "Auto Delete" message (with message ID, such as ADM65432) is created in the admin logs, thus providing visibility into how many and which licenses were deleted over a specified period. For more details, see NSA Licensing/Subscription.
- Disable/Enable functionality is provided for Admin policies. For details, see Viewing Admin Authentication Policies.
- Upgrade to ICS Gateway 22.8R2 from NSA will be supported starting with NSA 22.8R1.4. However, gateways upgraded to 22.8R2 using the Gateway Admin UI will remain interoperable with the current NSA version 22.8R1.3.2.
- This release includes bug fixes. There are no new features.
- Gateway-side Enhancements for Upcoming NSA Features: Gateway-side enhancements supporting upcoming NSA features, Feature Licensing and External ICT Management are now included in ICS Gateway 22.7R2.9.
These features will be fully functional following the upcoming release of NSA 22.8R1.4.
- This release includes bug fixes. There are no new features.
- This release includes bug fixes. There are no new features.
- Gateway Upgrade Improvements: NSA now provides option to stage the package on individual Gateway/Cluster or multiple Gateways/Clusters, and upgrade the Gateways manually or on a specified date and time. The Gateway stage and upgrade from NSA is supported for ICS Gateway with base version 22.7R2.8. For more details, see Upgrading Gateways and Clusters with a New Gateway Version.
- NSA Syslog Server Integration: NSA enables you to configure external syslog server to forward ICS Gateway logs and NSA Tenant Admin logs. This enables centralized and secure log management and enhanced visibility into the health and efficiency of the services running in your ICS Gateways, or to facilitate debugging in the event of unexpected service behavior. For details, see Using Enterprise Integration to Export Your Logs for External Analysis.
- Config Sync Enhancements: Config Sync enhancement supports configuring the entire configuration synchronization across multiple targets (up to 15 targets for entire configuration and 50 targets for selective configuration). This enhancement enhances flexibility and scalability for managing multiple gateways or clusters. This is particularly useful for enterprises with extensive networks, as it simplifies configuration management across various systems. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see Config Synchronization.
- Segregation of app visibility logs: In order to avoid performance issue, app visibility logs is segregated from user access logs. App visibility logs is available in debug log/snapshot for troubleshooting. This feature is supported from ICS Gateway 22.7R2.8 release. For details, see Using the Debug Log. The maximum debug log file size for Gateways with disk space > 80 GB is increased to 1024 MB.
- Reporting Enhancements:
- The number of schedule/on-demand exports is increased to 10.
- Summary charts of gateways, user roles, application access, anomalies, non-compliance, and user risk now displays top 100 with up to 1 lakh users aggregation.
- User analytics now shows maximum top 30 users.
- Admin experience enhancements:
- Search and Sort options are added for selective tables:
- Gateway > Users > Resource Policies
- Gateway > System > Configuration, Network, IF-MAP Federation, Log/Monitoring
- Gateway > Authentication > Signing In, Authentication Servers
Move Up and Down arrow option is disabled when Search function is applied to a table.
- Feature Parity with ICS Gateway:
- For Gateways with disk space > 80 GB, maximum debug log file size is increased to 1024 MB. For details, see Using the Debug Log. This change is applicable from ICS 22.7R2.6.
- VPN Tunneling Resource Policy configuration allows you to enable / disable IPv4 and IPv6 address assignments and specify IPv4 and IPv6 address ranges. For details, see VPN Tunneling Resource Policy Configuration Use Case. This change is applicable from ICS 22.7R2.6.
This release includes bug fixes. There are no new features.
- Enhancements to Tenant Admin Audit Logs for end-to-end admin activities: Tenant Admin logs now captures all the admin activities from login to logout. For more details, see Checking Tenant Admin Logs.
- Config Sync enhancements: Admin can now schedule config sync rule jobs to run only on a specified time or to run daily, weekly or monthly frequencies. For more details, see Scheduling Config Sync Rule Job.
- Admin experience enhancements: Search and Sort options are added for tables in Gateway > Users > Roles, Realms, and Resource Profiles, and Authentication > Endpoint Security.
- NSA Config Authoring can handle multiple certificates with the same serial number.
- (Preview) Enhancements Tenant Admin Audit Logs for Gateway operations:Tenant Admin Logs page now additionally shows the audit logs generated for config change operations (create/update/delete) performed by all admins. For more details, see Checking Tenant Admin Logs.
- Config Sync enhancements: "Duplicate Config" option is newly added in the Config Synchronization Status page to clone the config sync rule. For more details, see Cloning a Config Sync Rule.
- Admin experience enhancements: "Group by" option is added in the Gateway List page to filter the list based on Gateway Type, Connection status, Version or Region.
- (Preview) Tenant Admin Audit Logs for Gateway operations: Tenant Admin Logs page is newly added to show NSA admin audit logs generated for Gateway operations such as create, delete, upgrade, reboot and rollback. For more details, see Checking Tenant Admin Logs.
- Password policy for XML configuration export and import, and TOTP users export and import:
- Strengthening the XML configuration file import/export process with password authentication checks. For more details, see: Exporting an XML Configuration File.
- Strengthening the TOTP server by adding password authentication checks for importing and exporting the users data file. For more details, see: Exporting/Importing TOTP Users.
- Config Sync enhancements: "Refresh Gateway Status" option is newly added in Config Synchronization Status page for target gateways with status "Pending", "Importing" or "Timed out". For more details, see Config Synchronization.
- Admin experience enhancements:
- Alphabetical sorting (ascending / descending) is now possible in the Gateways List and the Config Synchronization pages. Use the arrow icon provided in the column header to show alphabetically sorted list.
- "Expand all / Collapse all" functionality is added in the Gateways List page. Use the Expand all / Collapse all icon provided in the Gateways List page to expand / collapse the Clusters and Gateways lists.
- Admin UI user experience enhancements: Column reordering is newly added in the Users L3 and L4 pages. To move a column, a user can click the header and drag to its new position. For more details, see Ivanti Connect Secure Gateway Analytics.
- Consolidated landing page: Drill down support for the Sankey chart is newly added on the consolidated landing page. With each chart, the View all link provides a page with detailed log records for that category. For more details, see Consolidated Landing Page, see Consolidated Landing Page.
- Multinode configuration status enhancement: configuration status now includes start and end timestamps and additional status information. For more details, see Config Synchronization.
- All Gateways Counter: All Gateways counter is newly added on ZTA and NSA specific analytics landing page. For more details, see Reviewing Your Network Activity. For more details, see Registering Ivanti Connect Secure Gateway and Creating an ICS Cluster.
- Gateway name / Cluster name length: The maximum length of ICS Gateway name / Cluster name is increased to 19 characters. Admin can now register the existing ICS Gateway Cluster with cluster name length up to 19 characters to NSA.
- Feature parity with ICS Gateway 22.7R2.1 version:
- Max log Size for Event logs: The range is 1- 200 MB and the maximum size is 200 MB for Virtual Appliances. The range is 1- 1024 MB and the maximum is 1GB/1024MB for ISA Hardware. For details, see Events to Log.
- Play integrity check for rooting detection on Android devices: checks if interactions and server requests are coming from the genuine app binary running on a genuine Android device. For details, see Mobile Configuration.
- (Preview) Consolidated landing page: A new unified landing page allows tenant admin to examine the shared analytical tables and charts for nZTA and ICS Gateways. For more details, see Consolidated Landing Page.
- Admin UI user experience enhancements: Improvements to the admin experience (Modernize the table view for session management and log view). Advanced filter on the page for managed users. For more details, see:
- Sync Now: A new Sync Now page allows the tenant admin to implement changes made to Admin Management and correct any configuration problems based on the alerts. For more details, see Synchronizing the Configuration.
- Admin Experience Enhancements: To enhance the administrative experience, there have been improvements in the form of table modernization for both Admin Management and Session Management. For details, see NSA Administration.
- Password Strengthening for Local Authentication Server: The local authentication server has stronger password restrictions. For details, see Workflow: Creating a Local Authentication Policy.
- IPv6 L3 VPN Application Visibility (Supported only for 22.x ICS Gateway): Support for IPV6 L3 VPN visibility in NSA. You can view both IPv4 and IPv6 applications for L3 user sessions from the Applications overview page. For details, see Using the Applications Filter Bar.
- NSA Named User License Normalization (Supported only for 22.6R2 ICS Gateway with 22.6R1 ISAC Client and later versions): Normalization of license seat reservation across devices and users. Single license is consumed instead of two through associating devices with users for Machine Cert Authentication and subsequent User Authentication. For details, see NSA Licensing/Subscription.
- Licensing Enhancements for named user licenses (UAL): Support added to perform out of band license checks. The subscription page in NSA tenant admin portal will be updated with few minutes of delay from the new user login.
- NSA Feature parity with 22.6R2 ICS gateway
- Resource policies > VPN Tunnelling > Connection Profile > DHCP Subnet - 22.x
- HTML5 Bookmark - Enable Auto Resolution Option - 22.x and 9.x
- User Roles Options - Enable Auto Resolution Option - 22.x and 9.x
- System > Configuration > SAML > New SAML > Hide PDP Option - 22.x
- Hide Authentication > Auth Servers > LDAP server > Health check - 9.x
- Authentication > Auth Servers > LDAP server > Health check - 22.x
- System > Configuration > Security > Miscellaneous > Relay state option - 22.x
- Support SAML Authentication server as a secondary authentication server when configuring Certificate Authentication server (Supported only for 22.x ICS Gateway): NSA now supports configuration of Certification Authentication server with SAML Authentication server as a secondary authentication server. For details, see Configuring Certificate Authentication Server.
- Admin experience enhancements to L4, Gateway Logs, and Logs Tables in terms of selection and resizing, pagination, and text copy/paste
The following list shows the enhancements to L4, Gateway Logs, and Logs Tables.
- Column resizing across ICS pages
- Cell content copy text from Table
- Pagination across ICS pages
- Minimum number of columns in all the tables in L4 dashboards
- Enhancement to Advanced Filter
For details, see Using the Top Active Breakdown Charts and Filtering the Logs.
- Auto Selecting Dependent Configurations as part of Config Sync: While creating config sync rule, if there is any dependency mismatch, admin can review dependent configurations and select them before creating/editing rule. For details, see Config Synchronization.
For example, If realm configuration is mapped to Authentication server and if config sync rule is created with only realm. The dependent configuration is highlighted (Auth server). Realm configuration is highlighted with i icon and when dependencies are reviewed, Authentication server is mentioned in the dependency tree.
- Preview of changes done in source gateway before config sync. This feature is available only with Manual sync.
Preview before sync will work only when one manual config sync rule is triggered.
- 22.5R2 ICS configuration parity in NSA.
- Admin Access Control based on location, Host Checker, and Network: Checks the Admin's device geographic location/network/host checker compliance for admin sign-in policy before providing access to admin login. For details, see Creating Admin Policies.
- NSA Licensing Enhancements: When NSA licensing is enabled on Gateway, and if there is connectivity issue between gateway and controller, grace period of 24 hours is applied for new user logins up to platform limit.
- Role Based Access Control for Admin Users: With Role-based access control (RBAC), organizations can easily add admins and assign them specific roles, with differing levels of access to the NSA Admin Portal. In addition to an existing set of default roles, Administrators can now create custom granular roles for specific functions within the NSA admin portal. For details, see Role-based Access Control for Admin Users
- Analytics: Historical View: Analytics supports data visualization in Active View. Admin can see the historic data on different time windows. Admin's can find all connections details for different time frames past 30 days. For details, see Using the Filter Bar
- Config Sync Rule Status: This feature allows a user to view the config sync rule status of all target gateways. For details, see Config Synchronization.
- NSA named user licensing normalization: This feature allows a user to use different login formats - Domain\username, Common Name (CN), and User Principal Name (UPN) - from different devices, but consumes only one seat for the user. For details, see NSA Licensing/Subscription.
- Configuring ZTA Policy to an ICS Application: Administrators can now configure ICS application with ZTA secure access policy from the NSA-ICS Applications page.
- NSA Named User Licensing - Freeing named user licenses automatically: Users who have not logged in to the ICS Gateway for the last 30 days can be deleted automatically from the Users list.
- Addition of a new alert "Config Sync Target Cluster Deleted": This alert is generated when the Target Cluster, which is in any of the Config Sync rule gets deleted.
Configuration template functionality is consolidated into Configuration sync feature.
Actionable Insights: Step up Authentication, Subsequent login and Chart Visibility.
- Enhanced Admin experience
- Config Sync enhancements
- Alerts and Notification enhancements
- NSA UI parity with 9.1R16 and R17
- L3 VPN App Visibility
- Config Replace/reorder