Cisco Web Security Appliance S170 Antivirus Security Software User Guide
Add to My manuals734 Pages
advertisement
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA http://www.cisco.com
800 553-NETS (6387)
Cisco IronPort AsyncOS
7.5.7 for Web User Guide
February 4, 2013
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO
CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL
ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN
THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS
REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT
YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California,
Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981,
Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE
SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM
ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A
COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR
INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA
ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
© 2013 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
Getting Started with the Web Security Appliance
1-1
1-1
1-2
1-2
Where to Find More Information
1-2
1-2
Security Training Services & Certification
1-3
1-3
1-4
Cisco IronPort Customer Support
1-4
1-4
1-5
Web Security Appliance Overview
1-5
Using the Web Security Appliance
2-1
Understanding How the Web Security Appliance Works
2-1
2-1
2-2
2-2
Administering the Web Security Appliance
2-2
2-2
Accessing the Web Security Appliance
2-2
Using the Command Line Interface (CLI)
2-3
2-3
2-4
2-4
Navigating the Web Security Appliance Web Interface
2-4
2-6
2-6
2-6
2-7
2-7
2-8
2-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
1
Contents
2-8
Committing and Clearing Changes
2-9
Committing and Clearing Changes in the Web Interface
2-9
2-10
2-10
Committing and Clearing Changes in the CLI
2-10
Checking for Web Proxy Restart on Commit
2-10
2-11
2-12
Deployment
3-1
3-1
3-2
3-2
3-3
3-3
3-4
3-4
Deploying the Web Proxy in Explicit Forward Mode
3-4
Configuring Client Applications
3-5
Connecting Appliance Interfaces
3-5
Testing an Explicit Forward Configuration
3-5
Deploying the Web Proxy in Transparent Mode
3-5
Connecting Appliance Interfaces
3-6
Connecting the Appliance to a WCCP Router
3-6
Configuring the Web Security Appliance
3-6
3-6
3-8
3-8
3-9
3-9
Working with Multiple Appliances and Routers
3-10
Using the Web Security Appliance in an Existing Proxy Environment
3-10
3-11
Explicit Forward Upstream Proxy
3-11
Deploying the L4 Traffic Monitor
3-11
Connecting the L4 Traffic Monitor
3-12
Configuring an L4 Traffic Monitor Wiring Type
3-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2
3-13
Installation and Configuration
4-1
4-1
Connecting a Laptop to the Appliance
4-2
Connecting the Appliance to the Network
4-2
4-3
4-4
4-5
Accessing the System Setup Wizard
4-5
4-6
4-6
4-14
4-16
FIPS Management
5-1
5-1
Understanding How FIPS Management Works
5-1
5-2
Logging into the FIPS Management Console
5-3
Working with the FIPS Officer Password
5-5
5-6
5-6
Managing Certificates and Keys
5-6
Uploading a Certificate and Key for Secure Authentication
5-8
Uploading and Generating a Certificate and Key for the HTTPS Proxy
5-9
Uploading and Generating a Certificate and Key for SaaS Access Control
5-11
Backing up and Restoring Certificates and Keys
5-13
Backing up Certificates and Keys
5-14
Restoring Certificates and Keys
5-14
Using the fipsconfig CLI Command
5-14
Working with Multiple HSM Cards
5-15
Web Proxy Services
6-1
6-1
6-2
6-2
6-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
3
Contents
Using Authentication with Native FTP
6-7
Working with Native FTP in Transparent Mode
6-8
Configuring FTP Proxy Settings
6-8
6-11
Understanding How the Proxy Bypass List Works
6-12
Using WCCP with the Proxy Bypass List
6-13
Bypassing Application Scanning
6-13
6-13
Configuring Client Applications to Use the Web Proxy
6-13
6-14
6-14
Creating a PAC File for Remote Users
6-15
Specifying the PAC File in Browsers
6-15
Entering the PAC File Location
6-16
Detecting the PAC File Location Automatically
6-16
Adding PAC Files to the Web Security Appliance
6-17
6-18
Uploading PAC Files to the Appliance
6-19
Understanding WPAD Compatibility with Netscape and Firefox
6-20
6-21
6-22
6-27
6-30
6-31
6-32
6-34
6-34
6-35
6-35
Cloud Web Security Connector
7-1
Overview of the Cloud Connector
7-1
Cloud Connector versus Standard Mode
7-2
7-4
7-5
Configuring the Cloud Connector
7-5
Step 1. Access the Web Interface for the Web Security Appliance
7-5
Step 2. Accept the License Agreement and Begin Setup.
7-5
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4
System Settings
: 7-6
Step 4. Set the Appliance Mode
7-6
Step 5. Configure Cloud Connector Settings
7-6
Step 6. Configure Network Interfaces and Wiring
7-7
Step 7. Configure Routes for Management and Data Traffic
7-7
Step 8. Configure Transparent Connection Settings
7-7
Step 9. Configure Administrative Settings
7-8
7-8
Directory Group Policies in the Cloud
7-8
Sending Directory Groups to the Cloud
7-8
Bypassing the Cloud Proxy Server
7-9
7-9
7-9
7-9
7-10
7-10
Preventing Loss of Secure Data
7-10
7-10
Subscribing to the Cloud Connector Logs
7-10
Identities and User Authentication
7-11
Guest Access for Unauthenticated Users
7-11
7-11
Switching to Cloud Connector Mode
7-11
Working with Policies
8-1
Working with Policies Overview
8-1
8-2
8-2
8-3
8-3
8-3
Cisco IronPort Data Security Policies
8-3
8-4
Outbound Malware Scanning Policies
8-4
SaaS Application Authentication Policies
8-4
8-4
8-5
8-5
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
5
Contents
8-7
Authenticating Users versus Authorizing Users
8-7
Working with Failed Authentication and Authorization
8-8
8-8
Policy Group Membership Rules and Guidelines
8-8
Working with Time Based Policies
8-9
8-9
Working with User Agent Based Policies
8-11
Configuring User Agents for Policy Group Membership
8-11
Exempting User Agents from Authentication
8-12
8-13
Identities
9-1
9-1
Evaluating Identity Group Membership
9-2
Understanding How Authentication Affects Identity Groups
9-3
Understanding How Authentication Affects HTTPS and FTP over HTTP Requests
9-4
Understanding How Authentication Scheme Affects Identity Groups
9-5
Matching Client Requests to Identity Groups
9-6
Allowing Guest Access to Users Who Fail Authentication
9-8
Identifying Users Transparently
9-10
Understanding Transparent User Identification
9-11
Transparent User Identification with Active Directory
9-12
Transparent User Identification with Novell eDirectory
9-14
9-15
Configuring Transparent User Identification
9-16
Using the CLI to Configure Transparent User Identification
9-16
Identities and Pass-through HTTPS Traffic
9-17
9-17
Configuring Identities in Other Policy Groups
9-22
Example Identity Policies Tables
9-24
9-24
9-25
Access Policies
10-1
10-1
10-1
Understanding the Monitor Action
10-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6
Evaluating Access Policy Group Membership
10-3
Matching Client Requests to Access Policy Groups
10-4
10-4
Controlling HTTP and Native FTP Traffic
10-7
10-9
10-10
10-10
10-11
Web Reputation and Anti-Malware
10-11
Blocking Specific Applications and Protocols
10-12
10-12
Policy: Protocols and User Agents
10-12
10-14
10-14
Blocking on Ports Other Than 80
10-14
Working with External Proxies
11-1
Working with External Proxies Overview
11-1
Routing Traffic to Upstream Proxies
11-1
Adding External Proxy Information
11-2
Evaluating Routing Policy Group Membership
11-3
Matching Client Requests to Routing Policy Groups
11-4
11-5
Decryption Policies
12-1
12-1
12-2
Personally Identifiable Information Disclosure
12-3
Understanding the Monitor Action
12-3
12-4
12-5
12-6
12-7
Validating Certificate Authorities
12-7
Validating Digital Certificates
12-8
12-9
Mimicking the Server Digital Certificate
12-10
Working with Root Certificates
12-11
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
7
Contents
Using Decryption with the AVC Engine
12-13
Using Decryption with AOL Instant Messenger
12-14
Converting Certificate and Key Formats
12-14
12-15
Evaluating Decryption Policy Group Membership
12-19
Matching Client Requests to Decryption Policy Groups
12-20
12-20
12-23
12-26
Importing a Trusted Root Certificate
12-26
12-27
Outbound Malware Scanning
13-1
Outbound Malware Scanning Overview
13-1
User Experience with Blocked Requests
13-1
Outbound Malware Scanning Policy Groups
13-2
Evaluating Outbound Malware Scanning Policy Group Membership
13-2
Matching Client Requests to Outbound Malware Scanning Policy Groups
13-3
Creating Outbound Malware Scanning Policies
13-4
Controlling Upload Requests Using Outbound Malware Scanning Policies
13-6
13-8
Data Security and External DLP Policies
14-1
Data Security and External DLP Policies Overview
14-1
Bypassing Upload Requests Below a Minimum Size
14-2
User Experience with Blocked Requests
14-2
Working with Data Security and External DLP Policies
14-3
14-3
14-4
Evaluating Data Security and External DLP Policy Group Membership
14-4
Matching Client Requests to Data Security and External DLP Policy Groups
14-5
Creating Data Security and External DLP Policies
14-6
Controlling Upload Requests Using Cisco IronPort Data Security Policies
14-9
14-11
14-12
14-12
14-13
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8
Configuring External DLP Servers
14-14
Controlling Upload Requests Using External DLP Policies
14-16
14-17
Achieving Secure Mobility
15-1
Achieving Secure Mobility Overview
15-1
15-2
15-2
Transparently Identifying Remote Users
15-4
15-4
Configuring Secure Mobility Using the CLI
15-5
Controlling Access to SaaS Applications
16-1
16-1
Understanding How SaaS Access Control Works
16-2
16-2
16-4
16-4
Understanding the Single Sign-On URL
16-4
Using SaaS Access Control with Multiple Appliances
16-5
Configuring the Appliance as an Identity Provider
16-5
Creating SaaS Application Authentication Policies
16-8
Notifying End Users
17-1
Notifying End Users of Organization Policies
17-1
Configuring General Settings for Notification Pages
17-3
Working With On-Box End-User Notification Pages
17-4
Configuring On-Box End-User Notification Pages
17-4
Editing On-Box End-User Notification Pages
17-5
Rules and Guidelines for Editing On-Box End-User Notification Pages
17-8
Using Variables in Customized On-Box End-User Notification Pages
17-8
Defining End-User Notification Pages Off-Box
17-9
17-9
End-User Notification Page Parameters
17-10
Redirecting End-User Notification Pages to a Custom URL
17-11
17-12
Accessing HTTPS and FTP Sites with the End-User Acknowledgement Page
17-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
9
Contents
Configuring the End-User Acknowledgement Page
17-14
Configuring the End-User URL Filtering Warning Page
17-16
Working with FTP Notification Messages
17-17
Custom Text in Notification Pages
17-17
Supported HTML Tags in Notification Pages
17-17
Custom Text and Logos: Authentication, and End-User Acknowledgement Pages
17-18
17-18
URL Filters
18-1
18-1
Dynamic Content Analysis Engine
18-2
18-2
Matching URLs to URL Categories
18-3
Reporting Uncategorized and Misclassified URLs
18-3
18-3
Configuring the URL Filtering Engine
18-4
Managing Updates to the Set of URL Categories
18-5
Understanding the Impacts of URL Category Set Updates
18-5
Effects of URL Category Set Changes on Policy Group Membership
18-5
Effects of URL Category Set Updates on Filtering Actions in Policies
18-6
18-7
Controlling Updates to the URL Category Set
18-8
Manually Updating the URL Category Set
18-8
Choosing Default Settings for New and Changed Categories
18-9
Ensuring that You Receive Alerts About Category and Policy Changes
18-9
Responding to Alerts about URL Category Set Updates
18-9
Filtering Transactions Using URL Categories
18-9
Configuring URL Filters for Access Policy Groups
18-10
Configuring URL Filters for Decryption Policy Groups
18-12
Configuring URL Filters for Data Security Policy Groups
18-14
18-16
18-18
18-20
18-21
18-21
Redirecting Traffic in the Access Policies
18-21
Warning Users and Allowing Them to Continue
18-22
User Experience When Warning Users
18-23
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10
Creating Time Based URL Filters
18-23
Viewing URL Filtering Activity
18-24
Understanding Unfiltered and Uncategorized Data
18-24
18-24
18-24
18-25
Regular Expression Character Table
18-26
18-27
Understanding Application Visibility and Control
19-1
Controlling Applications Overview
19-1
User Experience with Blocked Requests
19-2
19-2
19-2
Understanding Application Control Settings
19-3
19-4
19-5
19-6
Configuring Application Control Settings
19-7
19-8
Configuring Overall Bandwidth Limits
19-8
Configuring User Bandwidth Limits
19-9
Configuring the Default Bandwidth Limit for an Application Type
19-9
Overriding the Default Bandwidth Limit for an Application Type
19-9
Configuring Bandwidth Controls for an Application
19-10
Controlling Instant Messaging Traffic
19-12
19-13
19-13
Configuring Security Services
20-1
Configuring Security Services Overview
20-1
Web Reputation Filters Overview
20-2
20-2
Understanding How Web Reputation Filtering Works
20-2
Web Reputation in Access Policies
20-3
Web Reputation in Decryption Policies
20-4
Web Reputation in Cisco IronPort Data Security Policies
20-4
Anti-Malware Scanning Overview
20-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
11
Contents
Cisco IronPort DVS™ (Dynamic Vectoring and Streaming) Engine
20-4
Understanding How the DVS Engine Works
20-5
Working with Multiple Malware Verdicts
20-5
20-6
20-7
Matching Virus Signature Patterns
20-7
20-7
20-8
20-8
Understanding Adaptive Scanning
20-8
Enabling Web Reputation and Anti-Malware Filters
20-9
Configuring Web Reputation and Anti-Malware in Policies
20-10
Configuring Web Reputation and Anti-Malware in Access Policies
20-11
20-11
20-13
Configuring Web Reputation Scores
20-14
Configuring Web Reputation for Access Policies
20-14
Configuring Web Reputation for Decryption Policies
20-15
Configuring Web Reputation for Cisco IronPort Data Security Policies
20-16
Maintaining the Database Tables
20-17
20-17
20-18
20-18
20-19
Authentication
21-1
21-1
21-2
Working with Upstream Proxy Servers
21-3
21-3
Working with Failed Authentication
21-3
Working with Windows 7 and Windows Vista
21-4
Understanding How Authentication Works
21-4
Basic versus NTLMSSP Authentication Schemes
21-6
How Web Proxy Deployment Affects Authentication
21-7
Explicit Forward Deployment, Basic Authentication
21-7
Transparent Deployment, Basic Authentication
21-8
Explicit Forward Deployment, NTLM Authentication
21-9
Transparent Deployment, NTLM Authentication
21-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12
Contents
Working with Authentication Realms
21-10
Creating Authentication Realms
21-11
21-12
Deleting Authentication Realms
21-12
Working with Authentication Sequences
21-12
Creating Authentication Sequences
21-13
Editing Authentication Sequences
21-14
Deleting Authentication Sequences
21-14
Appliance Behavior with Multiple Authentication Realms
21-14
Testing Authentication Settings
21-15
21-15
21-15
21-16
Testing Authentication Settings in the Web Interface
21-16
Testing Authentication Settings in the CLI
21-17
Configuring Global Authentication Settings
21-17
Sending Authentication Credentials Securely
21-25
Uploading Certificates and Keys to Use with Credential Encryption and SaaS Access Control
21-26
Accessing HTTPS and FTP Sites with Credential Encryption Enabled
21-26
Allowing Users to Re-Authenticate
21-27
Using Re-Authentication with Internet Explorer
21-28
Using Re-Authentication with PAC Files
21-28
21-29
21-29
21-30
Changing Active Directory Passwords
21-30
21-31
21-33
21-35
Working with Multiple Active Directory Domains
21-35
21-36
Joining the Active Directory Domain
21-37
Supported Authentication Characters
21-39
Active Directory Server Supported Characters
21-39
LDAP Server Supported Characters
21-41
L4 Traffic Monitor
22-1
22-1
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13
Contents
Understanding How the L4 Traffic Monitor Works
22-1
The L4 Traffic Monitor Database
22-2
Configuring the L4 Traffic Monitor
22-2
Configuring L4 Traffic Monitor Global Settings
22-3
Updating L4 Traffic Monitor Anti-Malware Rules
22-3
Configuring L4 Traffic Monitor Policies
22-4
22-5
Viewing L4 Traffic Monitor Activity
22-6
Monitoring Activity and Viewing Summary Statistics
22-6
L4 Traffic Monitor Log File Entries
22-6
Reporting
23-1
23-1
Working with Usernames in Reports
23-1
23-2
23-2
23-3
23-4
23-4
Working with Columns on Report Pages
23-4
Configuring Columns on Report Pages
23-6
Printing and Exporting Reports from Report Pages
23-7
23-7
Enabling Centralized Reporting
23-8
23-9
23-9
23-10
23-10
23-10
23-11
23-11
23-12
23-12
23-13
23-13
23-14
14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Web Security Appliance Reports
24-1
Web Security Appliance Reports Overview
24-1
24-2
24-6
24-7
24-11
24-13
URL Category Set Updates and Reports
24-15
Using The URL Categories Page in Conjunction with Other Reporting Pages
24-15
24-16
24-18
24-20
24-21
24-22
Client Detail Page for Web Proxy - Clients by Malware Risk
24-24
24-25
24-27
24-31
24-33
24-33
24-37
24-37
Interpreting the Data You See on System Capacity Page
24-39
24-40
Logging
25-1
25-1
25-2
25-6
Working with Log Subscriptions
25-7
Log File Name and Appliance Directory Structure
25-8
Rolling Over Log Subscriptions
25-8
Manually Rolling Over Log Subscriptions
25-9
Automatically Rolling Over Log Subscriptions
25-9
Working with Compressed Log Files
25-10
Viewing the Most Recent Log Files
25-10
25-10
Contents
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
15
Contents
Adding and Editing Log Subscriptions
25-11
25-14
25-15
25-17
25-18
Understanding Scanning Verdict Information
25-21
Web Reputation Filters Example
25-25
25-25
25-25
25-26
25-26
Working with Log Fields in W3C Access Logs
25-27
Custom Formatting in Access Logs and W3C Logs
25-28
Configuring Custom Formatting in Access Logs
25-35
Configuring Custom Formatting in W3C Logs
25-36
Including HTTP/HTTPS Headers in Log Files
25-36
Malware Scanning Verdict Values
25-37
25-38
25-39
Configuring Network Settings
26-1
26-1
Configuring Network Interfaces
26-2
Configuring the Data Interfaces
26-2
Configuring the Network Interfaces from the Web Interface
26-3
Configuring TCP/IP Traffic Routes
26-5
26-5
26-6
Virtual Local Area Networks (VLANs)
26-7
26-8
26-8
Creating a New VLAN via the etherconfig Command
26-8
Creating an IP Interface on a VLAN via the interfaceconfig Command
26-10
Configuring Transparent Redirection
26-11
26-12
Working with the Assignment Method
26-12
Working with the Forwarding and Return Method
26-13
26-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16
Adding and Editing a WCCP Service
26-14
26-16
26-16
Configuring SMTP from the Web Interface
26-17
26-18
26-18
26-18
26-18
Using the Internet Root Servers
26-19
26-19
26-19
26-19
26-20
System Administration
27-1
Managing the S-Series Appliance
27-1
Saving and Loading the Appliance Configuration
27-2
Committing Changes to the Appliance Configuration
27-2
27-2
27-3
27-4
27-4
27-5
Editing Packet Capture Settings
27-5
27-7
27-7
27-8
27-8
27-9
27-9
27-10
27-11
27-11
27-11
27-12
27-12
27-14
Configuring Administrator Settings
27-15
Configuring Custom Text at Login
27-15
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Contents
17
Contents
Configuring IP-Based Administrator Access
27-16
Configuring the SSL Ciphers for Administrator Access
27-16
Configuring the Return Address for Generated Messages
27-16
27-17
27-17
Alerts: Alert Recipients, Alert Classifications, and Severities
27-17
27-18
27-18
27-19
27-19
27-19
27-20
27-20
27-21
Configuring Existing Alert Recipients
27-22
27-22
27-22
27-22
27-23
27-23
27-23
27-24
27-25
27-26
27-27
27-27
27-27
27-28
Configure NTP (Network Time Protocol)
27-28
27-28
Installing a Server Digital Certificate
27-29
27-29
27-30
Uploading Certificates to the Web Security Appliance
27-30
27-32
Available Upgrade Notifications
27-33
Upgrading AsyncOS for Web from the Web Interface
27-34
Upgrading AsyncOS for Web from the CLI
27-34
Differences from Traditional Upgrading Method
27-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18
Contents
Configuring Upgrade and Service Update Settings
27-34
Updating and Upgrading from the Cisco IronPort Update Servers
27-36
Configuring a Static Address for the Cisco IronPort Update Servers
27-36
27-36
Hardware and Software Requirements for Local Upgrade Servers
27-37
Configuring the Update and Upgrade Settings from the Web Interface
27-38
Configuring the Update and Upgrade Settings from the CLI
27-41
Manually Updating Security Service Components
27-41
Reverting to a Previous Version of AsyncOS for Web
27-41
Reverting AsyncOS for an Appliance Managed by the SMA
27-42
27-42
Important Note About Reversion Impact
27-42
27-43
Command Line Interface
28-1
The Command Line Interface Overview
28-1
Using the Command Line Interface
28-1
Accessing the Command Line Interface
28-1
Working with the Command Prompt
28-2
28-3
28-3
28-3
28-3
28-4
28-4
28-4
28-4
28-5
Committing Configuration Changes
28-5
Clearing Configuration Changes
28-5
Exiting the Command Line Interface Session
28-6
Seeking Help on the Command Line Interface
28-6
Web Security Appliance CLI Commands
28-6
Common Tasks
29-1
How to Prevent Users from Accessing Streaming Media Websites During Business Hours
29-2
How to Bypass Authentication for Specific User Agents
29-4
How to Bypass Authentication for Specific Websites
29-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19
Contents
How to Bypass Decryption for specific HTTPS Websites
29-8
How to Bypass Web Reputation Filtering without Bypassing Anti-Malware Scanning
29-10
How to Create Access Policies that Apply to Active Directory User Groups
29-12
How to Automate Log File Transfers
29-14
How to Redirect Traffic to a Different URL
29-15
20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
1
Getting Started with the Web Security Appliance
The IronPort AsyncOS for Web User Guide provides instructions for setting up, administering, and monitoring the Cisco IronPort Web Security appliance. These instructions are designed for an experienced system administrator with knowledge of networking and web administration.
This chapter discusses the following topics:
•
•
•
What’s New in This Release, page 1-1
How to Use This Guide, page 1-2
Web Security Appliance Overview, page 1-5
What’s New in This Release
This section describes the new features and enhancements in AsyncOS for Web 7.5.7. For more information about the release, see the product release notes, which are available on the Cisco IronPort
Customer Support site at the following URL: http://www.cisco.com/web/ironport/index.html
Note You need a Cisco.com User ID to access the site. If you do not have a Cisco.com User ID, you can register for one here: https://tools.cisco.com/RPF/register/register.do
You might also find it useful to review release notes for earlier releases to see the features and enhancements that were previously added.
describes the new features and enhancements that have been added in the Cisco IronPort
AsyncOS 7.5.7 for Web release.
Table 1-1 New Features for AsyncOS 7.5.7 for Web
Feature
Cloud Web Security Connector
Description
The 7.5.7 release introduces a new configuration mode, which allows you to connect to and direct traffic to Cisco Cloud Web
Security for policy enforcement and threat defense.
Documentation for the Cloud Connector is in Chapter 7, “Cloud
Web Security Connector” . To put the Web Security appliance in
Cloud Connector mode, begin with Configuring the Cloud
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
1-1
Chapter 1 Getting Started with the Web Security Appliance
How to Use This Guide
How to Use This Guide
Use this guide as a resource to learn about the features of your appliance. The topics are organized in a logical order. You might not need to read every chapter in the book.
“Cloud Web Security Connector”
.
You can also use this guide as a reference book. It contains important information, such as network and firewall configuration settings, that you can refer to throughout the life of the appliance.
The guide is distributed as PDF and HTML files. The electronic versions of the guide are available on the Cisco IronPort Customer Support site. You can also access the HTML online help version of the book directly from the appliance GUI by clicking the Help and Support link in the upper-right corner.
Before You Begin
Before you read this guide, review the Quick Start Guide for your appliance and the latest release notes for your product. In this guide, it is assumed that you have unpacked the appliance, physically installed it in a rack, and turned it on.
Note If you have already cabled your appliance to your network, ensure that the default IP address for the
IronPort appliance does not conflict with other IP addresses on your network. The IP address that is pre-configured on the Management port is 192.168.42.42
.
Where to Find More Information
Cisco IronPort offers the following resources to learn more about the Web Security appliance and related products:
•
•
•
Security Training Services & Certification, page 1-3
•
•
Cisco Support Community, page 1-4
Cisco IronPort Customer Support, page 1-4
•
Third Party Contributors, page 1-4
Documentation Set
The documentation set for Cisco IronPort appliances includes the following documents and books (not all types are available for all appliances and releases):
• IronPort AsyncOS for Web User Guide (this book)
• IronPort AsyncOS CLI Reference Guide
This and other documentation is available at the following locations:
1-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 1 Getting Started with the Web Security Appliance
How to Use This Guide
Documentation For
Cisco IronPort Products:
Security Management appliances
Email Security appliances and the CLI reference guide
Web Security appliances
Is Located At: http://www.cisco.com/en/US/products/ps10155/t sd_products_support_series_home.html
http://www.cisco.com/en/US/products/ps10154/t sd_products_support_series_home.html
http://www.cisco.com/en/US/products/ps10164/t sd_products_support_series_home.html
Cisco IronPort Encryption http://www.cisco.com/en/US/partner/products/ps
10602/tsd_products_support_series_home.html
Security Training Services & Certification
Cisco Security Training Services deliver exceptional education and training for Cisco security products and solutions. Through a targeted curriculum of technical training courses, the program provides up-to-date knowledge and skills transfer to different audiences.
Use one of the following methods to contact Cisco Security Training Services:
Training.
For question relating to registration and general training:
• http://training.ironport.com
Certifications.
For questions relating to certificates and certification exams:
• http://training.ironport.com/certification.html
Knowledge Base
You can access the Cisco IronPort Knowledge Base on the Cisco IronPort Customer Support site at the following URL: http://www.cisco.com/web/ironport/knowledgebase.html
Note You need a Cisco.com User ID to access the site. If you do not have a Cisco.com User ID, you can register for one here: https://tools.cisco.com/RPF/register/register.do
The Knowledge Base contains a wealth of information on topics related to Cisco IronPort products.
Articles generally fall into one of the following categories:
•
•
•
How-To. These articles explain how to do something with a Cisco IronPort product. For example, a how-to article might explain the procedures for backing up and restoring a database for an appliance.
Problem-and-Solution. A problem-and-solution article addresses a particular error or issue that you might encounter when using a Cisco IronPort product. For example, a problem-and-solution article might explain what to do if a specific error message is displayed when you upgrade to a new version of the product.
Reference.
Reference articles typically provide lists of information, such as the error codes associated with a particular piece of hardware.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
1-3
Chapter 1 Getting Started with the Web Security Appliance
How to Use This Guide
• Troubleshooting.
Troubleshooting articles explain how to analyze and resolve common issues related to Cisco IronPort products. For example, a troubleshooting article might provide steps to follow if you are having problems with DNS.
Cisco Support Community
Cisco Support Community is an online forum for Cisco customers, partners, and employees. It provides a place to discuss general email and web security issues, as well as technical information about specific
Cisco products. You can post topics to the forum to ask questions and share information with other Cisco and Cisco IronPort users.
You access the Cisco Support Community at the following URL: https://supportforums.cisco.com
Cisco IronPort Customer Support
You can request Cisco IronPort product support by phone, email, or online 24 hours a day, 7 days a week.
During Customer Support hours — 24 hours a day, Monday through Friday — an engineer will contact you within an hour of your request.
To report a critical issue that requires urgent assistance outside of Customer Support hours, contact Cisco
IronPort using one of the following methods:
U.S. Toll-free: 1 (877) 646-4766
International: http://cisco.com/web/ironport/contacts.html
Support Site: http://www.cisco.com/web/ironport/index.html
If you purchased support through a reseller or another supplier, please contact that supplier directly with your product support issues.
Third Party Contributors
Some software included within IronPort AsyncOS is distributed under the terms, notices, and conditions of software license agreements of FreeBSD, Inc., Stichting Mathematisch Centrum, Corporation for
National Research Initiatives, Inc., and other third party contributors, and all such terms and conditions are incorporated in IronPort license agreements.
The full text of these agreements can be found here: https://support.ironport.com/3rdparty/AsyncOS_User_Guide-1-1.html.
Portions of the software within IronPort AsyncOS is based upon the RRDtool with the express written consent of Tobi Oetiker.
Portions of this document are reproduced with permission of Dell Computer Corporation. Portions of this document are reproduced with permission of McAfee, Inc. Portions of this document are reproduced with permission of Sophos Plc.
1-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 1 Getting Started with the Web Security Appliance
Web Security Appliance Overview
Cisco Welcomes Your Comments
The Cisco IronPort Technical Publications team is interested in improving the product documentation.
Your comments and suggestions are always welcome. You can send comments to the following email address: [email protected]
Please include the title of this book and the publication date from the title page in the subject line of your message.
Web Security Appliance Overview
The Web Security appliance is a robust, secure, efficient device that protects corporate networks against web-based malware and spyware programs that can compromise corporate security and expose intellectual property. The Web Security appliance includes protection for standard communication protocols, such as HTTP, HTTPS, and FTP.
Malware (“malicious software”) is software designed to infiltrate or damage a computer system without the owner’s consent. It can be any kind of hostile, intrusive, or annoying software or program code.
Web-based malware includes spyware, system monitors, adware, phishing and pharming techniques, keystroke (key) loggers, browser hijackers, trojan horses, and more.
Web-based malware is a rapidly growing threat, responsible for significant corporate downtime, productivity losses and major strains on IT resources. Additionally, companies run the risk of violating compliance and data privacy regulations if their networks become compromised by malware. Companies run the risk of expensive legal costs and exposure of intellectual property.
The best place to stop these threats from entering the network is right at the gateway. The Web Security appliance provides deep application content inspection, by offering a web proxy service and by monitoring layer 4 traffic. The Web Proxy and Layer 4 Traffic Monitor allow organizations to ensure breadth of coverage within their networks. The Web Security appliance provides a powerful web security platform to protect your organization against malware that is optimized for performance and efficacy.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
1-5
Web Security Appliance Overview
Chapter 1 Getting Started with the Web Security Appliance
1-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
2
Using the Web Security Appliance
This chapter contains the following topics:
•
Understanding How the Web Security Appliance Works, page 2-1
•
•
•
•
Administering the Web Security Appliance, page 2-2
Navigating the Web Security Appliance Web Interface, page 2-4
Committing and Clearing Changes, page 2-9
The Cisco SensorBase Network, page 2-11
Understanding How the Web Security Appliance Works
The Web Proxy and the L4 Traffic Monitor are independent services. They are enabled and configured separately to provide the highest level of protection against a broad range of web-based malware threats.
The Web Proxy and L4 Traffic Monitor use data that is stored in filtering tables to evaluate and match
URL request attributes such as domain names, and IP address path segments with locally maintained database records. If a match occurs, Access Policy settings determine an action to block or monitor the traffic. If no match occurs, processing continues.
Web Proxy
The Web Security appliance Web Proxy supports the following security features:
•
•
Policy groups — Policy groups allow administrators to create groups of users and apply different levels of category-based access control to each group.
URL Filtering Categories — You can configure how the appliance handles each web transaction based on the URL category of a particular HTTP request.
•
•
Applications — The Application Visibility and Control engine (AVC engine) enables administrators to apply deeper controls to particular application types.
Web Reputation Filters — Reputation filters analyze web server behavior and characteristics to identify suspicious activity and protect against URL-based malware threats.
• Anti-Malware Services — The Cisco IronPort DVS™ engine in combination with the Webroot™ and McAfee scanning engines identify and stop a broad range of web-based malware threats.
For detailed information about Web Proxy services, see
Web Proxy Services, page 6-1 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-1
Chapter 2 Using the Web Security Appliance
Administering the Web Security Appliance
The L4 Traffic Monitor
The L4 Traffic Monitor is a configurable service that listens and monitors network ports for rogue activity and blocks malware attempts to infect your corporate network. Additionally, the L4 Traffic
Monitor detects infected clients and stops malicious activity from going outside the corporate network.
For detailed information about the L4 Traffic Monitor, see
L4 Traffic Monitor, page 22-1 .
Cloud Web Security Connector
The Cloud Web Security Connector allows you to connect to Cisco Cloud Web Security, directing traffic to the cloud for policy enforcement and threat defense. When the Appliance is in Cloud Web Security
Connector, it does not serve as a proxy for on-premise policy enforcement and it does not monitor Layer
4 traffic. In Cloud Web Security Connector mode, AsyncOS offers a subset of the features offered in standard mode.
Related information
•
Chapter 7, “Cloud Web Security Connector” .
Administering the Web Security Appliance
You can manage the Web Security appliance using a web-based administration tool. When you first access the appliance, the web interface launches the System Setup Wizard to perform an initial configuration. After running the System Setup Wizard, you can use the web interface or Command Line
Interface (CLI) to customize settings and maintain your configuration.
For a description of how to access the CLI and a list CLI supported commands, see
.
System Setup Wizard
The System Setup Wizard is a utility that configures basic settings and enables a set of system defaults.
The System Setup Wizard is located on the System Administration tab. For more information about running the System Setup Wizard, see
.
Note Running the System Setup Wizard completely reconfigures the Web Security appliance and resets the administrator password. Only use the System Setup Wizard the first time you install the appliance, or if you want to completely overwrite the existing configuration. Running the System Setup Wizard after the appliance is already configured can also interrupt client access to the web. If you choose to run the
System Setup Wizard after performing an initial setup, use the System Administration > Configuration
File pages to print a configuration summary and archive the current configuration file.
Accessing the Web Security Appliance
To access the appliance and launch the web-based administration utility, open a web browser. For the list of supported web browsers, see
Browser Requirements, page 2-6 .
2-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 2 Using the Web Security Appliance
Administering the Web Security Appliance
Connect to the management interface using one of the following methods:
• IP address and port number https://192.168.42.42:8443
•
-orhttp://192.168.42.42:8080 where 192.168.42.42 is the default IP address, and 8080 is the default admin port setting for HTTP, and 8443 is default admin port for HTTPS.
Hostname and port number https://hostname:8443
-orhttp://hostname:8080 where hostname
is the name of the appliance, and
8080
is the default admin port setting for HTTP, and
8443
is default admin port for HTTPS.
Note The hostname parameter is assigned during system setup. Before you can connect to the management interface using a hostname, you must add the appliance hostname and IP address to your DNS server database.
For information about how to use and navigate the web interface, see
Appliance Web Interface, page 2-4 .
Using the Command Line Interface (CLI)
To administer the appliance using the CLI, you can use one of the following methods:
• Ethernet connection.
Establish an SSH session using an Ethernet cable. For more information, see
Using an Ethernet Connection, page 2-3
.
• Serial connection.
Connect to the appliance COM port using a serial cable. For more information, see
Using a Serial Connection, page 2-4 .
The Web Security appliance CLI supports a set of commands to access, install, and administer the system. See
Command Line Interface, page 28-1 for information about the CLI and a list of supported
commands that can be used to access, upgrade, and administer the appliance.
Using an Ethernet Connection
You can connect the appliance to the network using an Ethernet cable from the M1 Management port to the network, and then using an SSH session from a computer on the network to reach the appliance.
By default, the M1 Management port is assigned the IP address
192.168.42.42
. To access the
Management port, the personal computer must be assigned an IP address on the same subnet as the
Management port, such as
192.168.42.43
. The subnet mask is
255.255.255.0
. This is the easiest way to connect if it works with your network configuration.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-3
Chapter 2 Using the Web Security Appliance
Navigating the Web Security Appliance Web Interface
Using a Serial Connection
You can connect directly to the appliance COM port using a null modem cable (9-pin serial) to establish a command line interface (CLI) session. You might want to do this if network connectivity to the appliance using an Ethernet cable is not an option.
To do this, you need the following items:
•
•
9-pin female-to-female serial cable (null modem)
Serial console client (such as HyperTerminal or PuTTY)
The communications settings for the serial port are:
Bits per second: 9600
Data bits: 8
Parity: None
Stop bits: 1
Flow control: Hardware
Reporting and Logging
The Web Security appliance provides several options for capturing data and monitoring system activity.
For detailed information about scheduling reports, see
Reporting Overview, page 23-1 . For more
information about working with log files, see
Navigating the Web Security Appliance Web Interface
The Web Security appliance web interface is a web-based administration tool that allows you to configure and monitor the appliance. The web interface allows you to configure the appliance similar to the Command Line Interface (CLI). However, some features available in the web interface are not available in the CLI and vice versa. For more information about the CLI, see
Command Line Interface, page 28-1 .
The Web Security appliance web interface contains multiple tabs where you can configure or monitor the appliance. You can set up Access Policies, schedule reports, enable features, and modify settings as necessary. The web interface also includes two menus from which you can perform basic administration tasks.
To use the web interface, open a web browser and log in. For more details, see
Security Appliance, page 2-2 . For a list of supported web browsers, see
Browser Requirements, page 2-6 .
For a list of supported languages, see Supported Languages, page 2-6 .
The web interface contains the following menus:
• Options.
From this menu, you can manage your user account. You can logout or change the password you use to log in to the web interface.
• Help.
From this menu, you can access help from documentation or Cisco IronPort Customer
Support. For Help tasks, you can access the online help or the Cisco IronPort Customer Support site.
For Technical Support tasks, you can send a support request email to Cisco IronPort Customer
Support or to allow Cisco IronPort Customer Support remote access to the Web Security appliance.
For more information about the Technical Support tasks, see Support Commands, page 27-2
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-4
Chapter 2 Using the Web Security Appliance
Navigating the Web Security Appliance Web Interface
The web interface contains the following tabs:
•
•
Reporting.
Use the pages on this tab to view reports on the appliance by that display dynamic data on website activity and appliance activity and action. For more information, see
.
Web Security Manager.
Use the pages on this tab to create and configure Access Policies that define which groups can access which types of websites. For more information, see
•
•
Security Services.
Use the pages on this tab to configure how the appliance monitors and secures the network. For more information, see
Security Services Tab, page 2-8 .
Network.
Use the pages on this tab to define the network in which the appliance is located. For more information, see
.
• System Administration.
Use the pages on this tab to configure administrative options, such as users, alerts, system time, and more. You can also enter keys for features you enabled during initial setup. For more information, see
System Administration Tab, page 2-8 .
Each tab has a list of menu selections from which you can choose. Each menu selection represents a different page in the web interface that further group information and activities. Some pages are grouped together into categories. You navigate among sections of the web interface by hovering the cursor over each tab heading and clicking a menu option from the menu that appears.
You open up other pages in the web interface by clicking on hypertext links and buttons. To find the various links, hover the cursor over text in the web interface. Links appear with an underline under the text when the cursor is over them.
links and buttons you can click to open up other pages where you can configure the appliance.
Figure 2-1 Web Interface Tabs, Pages, and Categories
Pages
Category
Tabs
Click these links and button to open other pages.
Figure 2-1 shows that the Web Security Manager tab contains the Web Proxy category, and the Web
Proxy category contains the Identities, Decryption Policies, Routing Policies, Access Policies, and
Bypass List pages. The tab also contains the Custom Policy Elements category (with the Custom URL
Categories page), and the L4 Traffic Monitor page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-5
Chapter 2 Using the Web Security Appliance
Navigating the Web Security Appliance Web Interface
When the documentation refers to specific pages in the web interface, it uses the tab name, following by an arrow and then the page name. For example, Web Security Manager > Access Policies.
Logging In
All users accessing the web interface must log in. Type your username and password, and then click
Login to access the web interface. You must use a supported web browser (see
more information creating appliance users, see
Administering User Accounts, page 27-9 .
After you log in, the Reporting > Overview page displays.
Browser Requirements
To access the web interface, your browser must support and be enabled to accept JavaScript and cookies.
It must be able to render HTML pages containing Cascading Style Sheets (CSS). For example, you can use the following browsers:
• Firefox 3.0 and later
•
•
Internet Explorer 7.0 and later (Windows only)
Safari 4.0 and later (Mac OS X only)
Your session automatically times out after 30 minutes of inactivity.
Some buttons and links in the web interface cause additional windows to open. Therefore, you may need to configure the browser’s pop-up blocking settings in order to use the web interface.
Note Only use one browser window or tab at a time to edit the appliance configuration. Also, do not edit the appliance using the web interface and the CLI at the same time. Editing the appliance from multiple places concurrently results in unexpected behavior and is not supported.
Supported Languages
With the appropriate license key, AsyncOS can display its GUI and CLI in any of the following languages:
• English
•
•
•
•
•
French
Spanish
German
Italian
•
•
•
•
Korean
Japanese
Portuguese (Brazil)
Chinese (zh-cn and zh-tw)
Russian
2-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 2 Using the Web Security Appliance
Navigating the Web Security Appliance Web Interface
Reporting Tab
Use the Reporting tab to monitor the appliance by viewing dynamic data on website activity and appliance activity and action.
The Reporting tab includes the following pages:
•
•
•
•
•
Overview
Users
Web Sites
URL Categories
•
•
•
•
Application Visibility
Anti-Malware
Client Malware Risk
Web Reputation Filters
•
•
•
•
L4 Traffic Monitor
Reports by User Location
Web Tracking
System Capacity
•
•
System Status
Scheduled Reports
Archived Reports
Web Security Manager Tab
Use the Web Security Manager tab to create and configure Access Policies that define which groups can access which types of websites.
The Web Security Manager tab includes the following pages:
• Identities
•
•
•
•
•
•
•
•
•
•
•
•
SaaS Policies
Decryption Policies
Routing Policies
Access Policies
Overall Bandwidth Limits
Cisco IronPort Data Security
Outbound Malware Scanning
External Data Loss Prevention
Custom URL Categories
Defined Time Ranges
Bypass Settings
L4 Traffic Monitor
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-7
Chapter 2 Using the Web Security Appliance
Navigating the Web Security Appliance Web Interface
Security Services Tab
Use this tab to configure how the appliance monitors and secures the network.
The Security Services tab includes the following pages:
•
•
•
•
•
•
•
•
•
•
•
•
•
Web Proxy
FTP Proxy
HTTPS Proxy
PAC File Hosting
Identity Provider for SaaS
Acceptable Use Controls
Anti-Malware
Data Transfer Filters
AnyConnect Secure Mobility
Web Reputation Filters
End-User Notification
L4 Traffic Monitor
SensorBase
Network Tab
Use the Network tab to describe the network in which the appliance is located and to define the appliance’s network settings.
The Network tab includes the following pages:
• Interfaces
•
•
•
•
•
•
•
Transparent Redirection
Routes
Internal SMTP Relay
Authentication
Upstream Proxy
External DLP Servers
DNS
System Administration Tab
Use the System Administration tab to configure administrative options, such as users, alerts, system time, and more. You can also enter keys for features you enabled during initial setup.
The System Administration tab includes the following pages:
• Policy Trace
• Users
2-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 2 Using the Web Security Appliance
Committing and Clearing Changes
•
•
•
•
•
•
•
•
•
•
•
•
•
Alerts
Log Subscriptions
Return Addresses
Time Zone
Time Settings
Configuration Summary
Configuration File
Feature Key Settings
Feature Keys
Upgrade and Update Settings
System Upgrade
System Setup Wizard
Next Steps
Committing and Clearing Changes
When you change the configuration of the Web Security appliance, you must commit the changes before they go into effect. Or, you can choose to clear the changes you have made if you do not want to commit them. How you commit and clear changes depends on the interface you use:
•
•
Web interface
Command Line Interface
When you commit some Web Security appliance configuration changes, the Web Proxy must restart for the changes to take effect. For more information, see
Checking for Web Proxy Restart on Commit, page 2-10
.
Committing and Clearing Changes in the Web Interface
Commit changes using the Commit Changes button in the upper right corner of the web interface. You can make multiple configuration changes before you commit all of them. When you make a change, the
Commit Changes button color is yellow and the button text changes to “Commit Changes” as shown in
Figure 2-2 The Commit Button: Changes Pending
When there are no changes to commit, the button color is gray and the button text is “No Changes
Pending.”
shows the web interface when there are no changes to commit.
Figure 2-3 The Commit Button: No Changes Pending
You also use the Commit Changes button to clear the changes made since the last commit or clear.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-9
Committing and Clearing Changes
Committing Changes
To commit changes made in the web interface:
Step 1 Click the Commit Changes button.
The Uncommitted Changes page appears.
Chapter 2 Using the Web Security Appliance
Step 2
Step 3
Enter comments in the Comment field if you choose.
Click Commit Changes .
Clearing Changes
To clear changes made in the web interface:
Step 1
Step 2
Click the Commit Changes button.
The Uncommitted Changes page appears.
Click Abandon Changes .
Committing and Clearing Changes in the CLI
Commit changes using the commit
command. Most configuration changes you make in the Command
Line Interface (CLI) are not effective until you issue the commit
command. You may include comments up to 255 characters. Changes are not verified as committed until you receive confirmation along with a timestamp. The commit
command applies configuration changes made to appliance since the last commit or clear
command issued.
For more information about using the commit
command, see
Committing Configuration Changes, page 28-5 .
Clear changes using the clear
command. For more information about using the clear
command, see
Clearing Configuration Changes, page 28-5
.
Checking for Web Proxy Restart on Commit
Some configuration changes you make to the Web Security appliance trigger a Web Proxy restart when you commit the changes. When the Web Proxy restarts, the Web Security appliance allows web traffic to continue but there is a brief interruption of Web Proxy services, such as anti-malware scanning.
Typically, the Web Proxy uses less than 30 seconds to restart due to a configuration change. (If the Web
Proxy restarts due to an internal error, the entire restart process may take a few minutes to start all services on the appliance.)
2-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 2 Using the Web Security Appliance
The Cisco SensorBase Network
To minimize the security risk from web traffic that goes unscanned, you can determine if your configuration changes will trigger a Web Proxy restart before you commit them. You can then schedule to commit your configuration changes for a time when the Web Proxy processes fewer user transactions, such as overnight. How you check for this depends on the interface:
•
•
Web interface.
When you click the Commit Changes button, the web interface displays a warning on the Uncommitted Changes page that the Web Proxy will restart as a result of the commit.
CLI.
Use the checkproxyrestart
command before the commit
command. If the configuration changes require a Web Proxy restart, the CLI displays “The changes will trigger a proxy restart.”
In addition to a brief interruption of Web Proxy services, you may notice the following effects when the
Web Proxy restarts:
• The authentication cache is cleared and users need to be authenticated again.
•
•
•
Tracking statistics are reset. This also affects SNMP because the values depend on tracking statistics.
The Web Proxy DNS cache is cleared.
•
•
•
The HTTPS certificate cache is cleared.
Connections to authentication servers are renegotiated.
Any data in the Web Proxy cache that was not written to disk is lost.
Any logging data that is not written to a log file is lost.
The Cisco SensorBase Network
The Cisco SensorBase Network is a threat management database that tracks millions of domains around the world and maintains a global watch list for Internet traffic. SensorBase provides Cisco with an assessment of reliability for known Internet domains. The Web Security appliance uses the SensorBase data feeds to improve the accuracy of Web Reputation Scores.
Standard SensorBase Network Participation is enabled by default during system setup. You can edit the participation level and other settings on the Security Services > SensorBase page after system setup.
To edit SensorBase Network Participation:
Step 1 Navigate to the Security Services > SensorBase page.
Figure 2-4 Editing SensorBase Global Settings
Step 2 Verify that SensorBase Network Participation is enabled.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-11
Chapter 2 Using the Web Security Appliance
The Cisco SensorBase Network
Step 3
Step 4
Step 5
Step 6
When it is disabled, none of the data that the appliance collects is sent back to the SensorBase Network servers.
In the Participation Level section, choose one of the following levels:
• Limited.
Basic participation summarizes server name information and sends MD5-hashed path segments to the SensorBase Network servers.
• Standard.
Enhanced participation sends the entire URL with unobfuscated path segments to the
SensorBase Network servers. This option assists in providing a more robust database, and continually improves the integrity of Web Reputation Scores.
In the AnyConnect Network Participation field, choose whether or not to include information collected from clients that connect to the Web Security appliance using Cisco AnyConnect Client.
AnyConnect Clients send their web traffic to the appliance using the Secure Mobility feature. For more information, see
Achieving Secure Mobility, page 15-1 .
In the Excluded Domains and IP Addresses field, optionally enter any domains or IP addresses to exclude from traffic sent to the SensorBase servers.
Submit and commit your changes.
Sharing Data
Participating in the Cisco SensorBase Network means that Cisco collects data and shares that information with the SensorBase threat management database. This data includes information about request attributes and how the appliance handles requests.
Cisco recognizes the importance of maintaining your privacy, and does not collect or use personal or confidential information such as usernames and passwords. Additionally, the file names and URL attributes that follow the hostname are obfuscated to ensure confidentiality. When it comes to decrypted
HTTPS transactions, the SensorBase Network only receives the IP address, web reputation score, and
URL category of the server name in the certificate.
If you agree to participate in the SensorBase Network, data sent from your appliance is transferred securely using HTTPS. Sharing data improves Cisco’s ability to react to web-based threats and protect your corporate environment from malicious activity.
2-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 2 Using the Web Security Appliance
The Cisco SensorBase Network
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
2-13
The Cisco SensorBase Network
Chapter 2 Using the Web Security Appliance
2-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
3
Deployment
This chapter contains the following topics:
•
•
•
•
•
•
•
•
Appliance Interfaces, page 3-2
Deploying the Web Proxy in Explicit Forward Mode, page 3-4
Deploying the Web Proxy in Transparent Mode, page 3-5
Connecting the Appliance to a WCCP Router, page 3-6
Using the Web Security Appliance in an Existing Proxy Environment, page 3-10
Deploying the L4 Traffic Monitor, page 3-11
Physical Dimensions, page 3-13
Deployment Overview
The Web Security appliance is typically installed as an additional layer in the network between clients and the Internet. Depending on how you deploy the appliance, you may need a Layer 4 (L4) switch or a
WCCP router to direct client traffic to the appliance.
These deployment options are available on the Web Security appliance:
•
•
Secure web proxy.
The appliance web proxy service monitors and scans web traffic for malicious content. When you enable the web proxy, you can configure it to be in transparent or explicit forward mode.
L4 Traffic Monitor.
The L4 Traffic Monitor detects and blocks rogue traffic across all ports and IP addresses. The L4 Traffic Monitor listens to network traffic that comes in over all ports and IP addresses on the appliance and matches domain names and IP addresses against entries in its own database tables to determine whether to allow outgoing traffic.
• Cloud Web Security Connector.
The Cloud Web Security Connector connects the Web Security
Appliance to Cisco Cloud Web Security, redirecting web traffic to the Cloud Web Security tower.
When deployed as a Cloud Web Security Connector, the standard web proxy services and L4 Traffic
Monitor services are not available. Information about deploying as a Cloud Web Security Connector is in
Chapter 7, “Cloud Web Security Connector.”
When deployed in standard mode (not as a Cloud Web Security Connector), by default, both the L4
Traffic Monitor and Web Proxy are enabled in the System Setup Wizard. If you need to disable one or both of these features, you can do so after initial setup from the web interface.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-1
Chapter 3 Deployment
Appliance Interfaces
The features you enable determine how you deploy and physically connect the appliance to the network.
For more information about how the features you enable affect appliance deployment, see
.
Preparing for Deployment
Before installing the Web Security appliance, read through the following questions and use the responses to each question to help you decide how to deploy the appliance and where to locate it in your network.
Each response includes a reference to a different section that covers the response in more detail.
1.
Will you deploy the Web Security appliance as a transparent proxy or an explicit forward proxy?
–
–
Explicit Forward Proxy.
Client applications, such as web browsers, are aware of the Web
Proxy and must be configured to point to a single Web Security appliance. This deployment requires a connection to a standard network switch. When you deploy the Web Proxy in explicit forward mode, you can place it anywhere in the network. For more information, see
Deploying the Web Proxy in Explicit Forward Mode, page 3-4 .
Transparent Proxy. Clients applications are unaware of the Web Proxy and do not have to be configured to connect to the proxy. This deployment requires an Layer 4 switch or a WCCP v2 router. For more information, see
Deploying the Web Proxy in Transparent Mode, page 3-5
.
Note A Layer 4 switch is a switch capable of doing policy based routing.
2.
3.
Does the network have an existing proxy?
If yes, it is recommended you deploy the Web Security appliance downstream from an existing proxy server, meaning closer to the clients. The System Setup Wizard refers to this as an upstream proxy configuration.
For more information, see
Using the Web Security Appliance in an Existing Proxy Environment, page 3-10 .
Will you enable the L4 Traffic Monitor?
L4 Traffic Monitor deployment is independent of the Web Proxy deployment. You can connect the
L4 Traffic Monitor to a network tap or the mirror/span port of a switch.
For more information, see
Deploying the L4 Traffic Monitor, page 3-11
.
Appliance Interfaces
The Web Security appliance includes six physical Ethernet ports on the back of the system. Each
Ethernet port corresponds to a different network interface. The Ethernet ports are grouped into the following types of network interfaces:
• Management.
The Management interfaces include M1 and M2. However, only the M1 interface is enabled on the appliance. For more information, see
Management Interface, page 3-3 .
• Data.
The Data interfaces include P1 and P2. Use the Data interfaces for Web Proxy data traffic. For more information, see
3-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Appliance Interfaces
• L4 Traffic Monitor.
The L4 Traffic Monitor interfaces include T1 and T2. Use these interfaces for monitoring and blocking L4 Traffic Monitor traffic. For more information, see
.
Figure 3-1 shows the Ethernet ports on the back of the Web Security appliance blade.
Figure 3-1 Web Security Appliance Ethernet Ports
Use the “T” ports for the L4 Traffic Monitor.
Use the M1 port for administering the appliance.
Use the “P” ports for the Web Proxy.
Management Interface
Use M1 to administer the appliance. Optionally, you can also configure the M1 interface to handle Web
Proxy data traffic. You might want to use the M1 interface for data traffic if your organization does not use a separate management network.
For more information about using the M1 port to set up and manage the appliance, see
Laptop to the Appliance, page 4-2 .
.
Data Interfaces
The appliance uses the Data interfaces for Web Proxy data traffic. You can enable and use just the P1 port or both the P1 and P2 ports for data traffic.
•
•
P1 only enabled.
When only P1 is enabled, connect it to the network for both incoming and outgoing traffic.
P1 and P2 enabled.
When both P1 and P2 are enabled, you must connect each interface to a different subnet. Typically, P1 is connected to the internal network and P2 toward the Internet. Note, however, that the appliance cannot be supported in inline mode.
Note You can only enable and configure the P1 interface for data traffic in the System Setup Wizard. If you want to enable the P2 interface, you must do so after system setup in the web interface or using the ifconfig
command. For more information about configuring the P2 interface, see
.
How you physically connect the data interfaces to the network depends on how you deploy the appliance.
For more information, see
Deploying the Web Proxy in Explicit Forward Mode, page 3-4 and
Deploying the Web Proxy in Transparent Mode, page 3-5
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-3
Chapter 3 Deployment
Deploying the Web Proxy in Explicit Forward Mode
L4 Traffic Monitor Interfaces
The appliance uses the T1 and T2 interfaces for listening to traffic on all TCP ports. You can connect just T1 or both T1 and T2 using an Ethernet cable, depending on whether you use simplex or duplex communication.
• T1 only connected (duplex).
When you configure the appliance to use duplex communication, connect T1 to the network so it receives all incoming and outgoing traffic.
• T1 and T2 connected (simplex).
When you configure the appliance to use simplex communication, connect T1 to the network so it receives all outgoing traffic (from the clients to the Internet), and connect T2 to the network so it receives all incoming traffic (from the Internet to the clients).
For more information about how to connect the L4 Traffic Monitor ports to the network, see
Deploying the L4 Traffic Monitor, page 3-11 .
Example Deployment
shows a sample deployment scenario with both the Web Proxy and L4 Traffic
Monitor enabled. In this example, the Web Proxy is deployed in transparent mode and only the P1 port is connected to either a Layer 4 switch or a WCCP router.
Figure 3-2 Web Security Appliance Deployment Scenario
Deploying the Web Proxy in Explicit Forward Mode
When the appliance is configured as an explicit forward proxy, client applications must be configured to direct its traffic to the appliance. When you want to configure the Web Proxy in explicit forward mode, you must configure the following components:
• Client applications
• Appliance ports
Tip If your organization needs to use explicit forward mode now, but might need transparent mode in the future, consider deploying the Web Proxy in transparent mode and then choosing Layer 4 switch as the connection type. If you do not have an Layer 4 switch, you can connect the appliance to the network normally and the appliance will work in explicit forward mode. When the Web Proxy is deployed in transparent mode, it can accept both transparently redirected and explicitly forwarded transactions. To
3-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Deploying the Web Proxy in Transparent Mode use transparent mode in the future, you can connect the appliance to an Layer 4 switch and it will work in transparent mode without needing to change the Web Proxy mode later. However, it is easy to change the deployment mode at any time on the Security Services > Web Proxy page.
Configuring Client Applications
You must configure all client applications, such as web browsers and FTP clients, used on the network to point to the Web Proxy. You can configure each client in the following ways:
• Manual.
Configure each client application to point the appliance Web Proxy by specifying the appliance hostname or IP address and the port number, such as 3128, used for listening to data traffic.
• Automatic.
Configure each client application to use a PAC file to detect the appliance Web Proxy automatically. Then you can edit the PAC file to specify the appliance Web Proxy information. PAC files work with web browsers only. For more information, see
Working with PAC Files, page 6-14
.
Connecting Appliance Interfaces
You can connect the P1 interface or both the P1 and P2 interfaces to a network switch using an Ethernet cable. You do not need special hardware, such as a particular switch or router. For more information about how to connect the data interfaces (P1 and P2), see
.
Testing an Explicit Forward Configuration
If you want to test an explicit forward proxy configuration, you can separate and forward traffic from a subset of your network infrastructure. To individually test this configuration, clients can forward traffic to the appliance from one web browser and connect to the Internet using another web browser. This method also ensures an alternate path to the Internet while testing.
Deploying the Web Proxy in Transparent Mode
When the appliance is configured as a transparent proxy, client applications are not aware that their traffic gets redirected to the appliance, and they do not need to be configured to point to the appliance.
To deploy the appliance in this mode, you need one of the following types of hardware to transparently redirect web traffic to the appliance:
• WCCP v2 router.
When you specify a WCCP router, you need to configure additional settings on the appliance. For more information about using the appliance with a WCCP router, see
Connecting the Appliance to a WCCP Router, page 3-6
.
• Layer 4 switch.
When you specify an Layer 4 switch, you only need to specify that the appliance is connected to an Layer 4 switch when you configure the appliance. You do not need to configure anything else on the appliance.
Typically, you configure the appliance to use an Layer 4 switch or a WCCP v2 router during initial system setup. However, you can configure it to use either an Layer 4 switch or a WCCP v2 router anytime after initial setup on the Network > Transparent Redirection page. For more information about the
Network > Transparent Redirection page, see
Configuring Transparent Redirection, page 26-11 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-5
Chapter 3 Deployment
Connecting the Appliance to a WCCP Router
Note When the Web Proxy is configured in transparent mode, you must enable the HTTPS Proxy if the appliance receives HTTPS traffic. When the HTTPS Proxy is disabled, the Web Proxy passes through explicit HTTPS connections and it drops transparently redirected HTTPS requests. The access logs contain the CONNECT requests for explicit HTTPS connections, but no entries exist for dropped transparently redirected HTTPS requests.
Connecting Appliance Interfaces
When you configure the Web Proxy in transparent mode, you can connect the P1 port or both the P1 and
P2 ports to an Layer 4 switch or WCCP router using an Ethernet cable. For more information about how
to connect the data interfaces (P1 and P2), see Data Interfaces, page 3-3
.
Connecting the Appliance to a WCCP Router
When you connect the appliance to a WCCP router, you must perform the following tasks:
1.
You must create at least one WCCP service on the appliance. For more information, see
Configuring the Web Security Appliance, page 3-6 .
2.
After you create a WCCP service, you must configure the router to work with the Web Security appliance. For more information, see
Configuring the WCCP Router, page 3-6
.
You can also connect an appliance to multiple WCCP routers. For more information, see
Multiple Appliances and Routers, page 3-10 .
Configuring the Web Security Appliance
A WCCP service is an appliance configuration that defines a service group to a WCCP v2 router. It includes information such as the service ID and ports used. Service groups allow a web proxy to establish connectivity with a WCCP router and to handle redirected traffic from the router.
Create WCCP services on the Network > Transparent Redirection page. The WCCP services you create determine how you configure the WCCP routers. For more information about creating WCCP services, see
Adding and Editing a WCCP Service, page 26-14
.
Note You can enable the standard service (also known as the “web-cache” service) during system setup, and you can configure different or additional WCCP service groups after you run the System Setup Wizard.
Configuring the WCCP Router
After you create at least one WCCP service in the Web Security appliance, you can configure the WCCP router(s) in the network.
3-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Connecting the Appliance to a WCCP Router
Use the following syntax for enabling WCCP on the router: ip wccp version 2 ip wccp service_group interface interface_type_number ip wccp service_group redirect direction ip wccp service_group password password
Enter one of the following values for the service_group variable:
• web-cache.
Enter “web-cache” when the appliance WCCP service uses the standard service.
• Service ID number.
Enter a number from 0 to 255 when the appliance WCCP service uses a dynamic service ID. The number should match the service ID number used in the appliance.
describes each part of the WCCP configuration syntax for enabling WCCP on the router.
Table 3-1 WCCP Router Configuration Syntax for Enabling the Router
WCCP Configuration ip wccp version 2 ip wccp service_group password password interface interface_type_number ip wccp service_group redirect direction ip wccp service_group password password
Description
Defines the version of WCCP to use on the router. You must specify version 2 to work with the Web Security appliance.
This command is required.
Specifies a service group to enable on the router. It also enables the
WCCP service on the router.
This command is required.
Specifies an interface to configure and enters interface configuration mode. Enter the interface number for the interface_type_number variable.
This command is required.
Enables WCCP redirection on the specified interface.
Enter one of the following values for the direction variable:
•
• in.
Use in when you want the router to redirect packets as they enter the router.
out.
Use out
when you want the router to redirect packets right before they leave the router.
This command is required.
Sets a password on the router for the specified service group.
This command is only required when the WCCP service defined on the appliance has password security enabled.
You can also configure a WCCP router to perform other tasks, such as the following:
• Configure the router from exclude redirecting traffic received on a particular interface.
• If the network uses multiple Web Security appliances, you can configure the router to determine which traffic should be directed to which appliance by using an access list. You might want to redirect only some of the network traffic to the appliance if you are evaluating the Web Security appliance.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-7
Chapter 3 Deployment
Connecting the Appliance to a WCCP Router
Note The Web Security appliance does not support using a multicast address in the WCCP service group. To use multiple routers in a service group, you must specify the IP address of each router in the service group and configure each router separately. You cannot register a router to a multicast address.
Example WCCP Configurations
This section shows some sample WCCP services defined in the appliance and the corresponding WCCP configuration you should use to configure the router that connects to the appliance.
Example 1
Suppose you have the WCCP service shown in
Figure 3-3 Example WCCP Service — Standard Service, No Password Required
In this example, the WCCP service defines the standard service group (also known as a well known service group). The redirection basis is on the destination port by default. Also suppose in this example that you want to configure the ethernet1 interface on the router for this service group.
Use the following WCCP configuration for this example: ip wccp version 2 ip wccp web-cache interface ethernet1 ip wccp web-cache redirect in
3-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Example 2
Connecting the Appliance to a WCCP Router
Figure 3-4 shows a dynamic service you might create when IP spoofing is enabled and the WCCP service
shown in
Figure 3-3 on page 3-8 is defined.
Figure 3-4 Example WCCP Service — Dynamic Service for IP Spoofing
Example 3
In this example, the WCCP service defines a dynamic service group with service ID of 90. The redirection basis is on the source port so it can be used for the return path with IP spoofing enabled.
Suppose in this example that you want to configure the ethernet0 interface on the router for this service group.
Use the following WCCP configuration for this example: ip wccp version 2 ip wccp 90 interface ethernet0 ip wccp 90 redirect in
For more information about enabling IP spoofing when using a WCCP router, see
.
Suppose you have the WCCP service shown in
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-9
Using the Web Security Appliance in an Existing Proxy Environment
Figure 3-5 Example WCCP Service — Dynamic Service, Password Required
Chapter 3 Deployment
In this example, the WCCP service defines a dynamic service group with service ID of 120. The redirection basis is on the destination port, and it has enabled a password for this service group of
“admin99” (hidden in the appliance configuration). Also suppose in this example that you want to configure the ethernet0 interface on the router for this service group.
Use the following WCCP configuration for this example: ip wccp version 2 ip wccp 120 interface ethernet0 ip wccp 120 redirect in ip wccp 120 password admin99
Working with Multiple Appliances and Routers
When you connect one or more Web Security appliances to one or more WCCP routers, you have a cluster. You can include up to 32 appliances and up to 32 routers in a cluster. You must configure all appliances and routers in a cluster to communicate with each other.
Using the Web Security Appliance in an Existing Proxy
Environment
The Web Security appliance is a proxy-compatible device, and is easily deployed within an existing proxy environment. However, it is recommended that you place the appliance downstream from existing proxy servers, meaning closer to the clients.
3-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Deploying the L4 Traffic Monitor
You can configure the appliance to work with an existing, upstream proxy in the System Setup Wizard or after the initial setup in the web interface. Use the Network > Upstream Proxies page to enable an upstream proxy or to modify existing settings.
When configuring an upstream proxy, you specify whether the existing proxy is in transparent or explicit forward mode.
Transparent Upstream Proxy
If a transparent upstream proxy uses client IP addresses to manage user authentication and access control, you must enable IP spoofing on the Web Security appliance to send client IP addresses to the upstream proxy. Use the Security Services > Web Proxy page to enable IP spoofing.
When you enable IP spoofing and connect the appliance to a WCCP router, you must create at least two
WCCP services. For more information about configuring WCCP services when you enable IP spoofing, see
IP Spoofing when Using WCCP, page 26-14
.
Explicit Forward Upstream Proxy
If the upstream proxy is in explicit forward mode, consider the following rules and guidelines:
•
•
You must enter the IP address or hostname and port of the upstream proxy.
Consider whether the hostname of the upstream proxy resolves to multiple IP addresses. The Web
Security appliance only queries the DNS server for the IP address at startup. If an IP address is added or removed from that hostname, the proxy must restart to resolve and add the hostname to the new set of IP addresses.
•
•
If the upstream proxy manages user authentication or access control using proxy authentication, you must enable the X-Forwarded-For header to send the client host header to the upstream proxy. Use the Security Services > Web Proxy page to enable the X-Forwarded-For header setting.
If you want to send authentication credentials to an upstream proxy when the Web Security appliance is deployed in explicit forward mode, you must configure the Web Proxy to forward authorization request headers to a parent proxy server using the advancedproxyconfig > authentication
CLI command.
Note By default, the Web Proxy does not forward proxy authorization headers to upstream proxy servers for security reasons.
• If the upstream proxy manages client traffic using a PAC file or a login script, you must update these files to use the IP address or hostname of the Web Security appliance.
Deploying the L4 Traffic Monitor
L4 Traffic Monitor (L4TM) deployment is independent of the Web Proxy deployment. When connecting and deploying the L4 Traffic Monitor, consider the following:
• Physical connection.
You can choose how to connect the L4 Traffic Monitor to the network. For more information, see
Connecting the L4 Traffic Monitor, page 3-12 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-11
Chapter 3 Deployment
Deploying the L4 Traffic Monitor
•
•
Network address translation (NAT).
When configuring the L4 Traffic Monitor, connect it at a point in your network where it can see as much network traffic as possible before getting out of your egress firewall and onto the Internet. It is important that the L4 Traffic Monitor be ‘logically’ connected after the proxy ports and before any device that performs network address translation
(NAT) on client IP addresses.
L4 Traffic Monitor action setting.
The default setting for the L4 Traffic Monitor is monitor only.
After setup, if you configure the L4 Traffic Monitor to monitor and block suspicious traffic, ensure that the L4 Traffic Monitor and the Web Proxy are configured on the same network so that all clients are accessible on routes that are configured for data traffic.
Connecting the L4 Traffic Monitor
You can connect the L4 Traffic Monitor to the network in any of the following ways:
• Network tap.
–
When you use a network tap, you can choose the following communication types:
Simplex. This communication type uses one cable for all traffic between clients and the appliance, and one cable for all traffic between the appliance and external connections. Connect port T1 to the network tap so it receives all outgoing traffic (from the clients to the Internet), and connect port T2 to the network tap so it receives all incoming traffic (from the Internet to the clients).
– Duplex. This mode uses one cable for all incoming and outgoing traffic. You can use half- or full-duplex Ethernet connections. Connect port T1 to the network tap so it receives all incoming and outgoing traffic.
Note Cisco recommends using simplex when possible because it can increase performance and security.
•
•
Span/mirror port of an L2 switch.
Connecting is similar to a simplex or duplex tap, depending on whether the connection uses two separate devices or one device.
Hub.
Choose duplex when you connect the L4 Traffic Monitor to a hub.
Regardless of how the appliance is connected to the network, you must configure the wiring type. For more information, see
Configuring an L4 Traffic Monitor Wiring Type, page 3-12 .
For more information about the T1 and T2 ports, see
Appliance Interfaces, page 3-2 .
Note Use a network tap instead of the span/mirror port of a switch when possible. Network taps use hardware to move packets to the L4 Traffic Monitor and span and mirror ports of a switch use software to move packets. Hardware solutions move packets with better performance than software solutions and are less likely to drop packets in the process.
Configuring an L4 Traffic Monitor Wiring Type
Typically, the L4 Traffic Monitor wiring type is configured during system setup. However, you can configure the wiring type after running the System Setup Wizard on the Network > Interfaces page. Click
Edit Settings and select a wiring type for the T1 and T2 ports.
3-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Figure 3-6 L4 Traffic Monitor Wiring Types
Physical Dimensions
Physical Dimensions
The following physical dimensions apply to the Cisco IronPort S670 and S370 Web Security appliances:
•
•
Height: 8.64 cm (3.40 inches)
Width: 48.24 cm (18.99 inches) with or without rails
•
•
Depth: 72.06 cm (28.40 inches)
Weight: maximum 23.59 kg (52 pounds)
The following physical dimensions apply to the Cisco IronPort S160 Web Security appliance:
• Height: 4.2 cm (1.68 inches)
•
•
•
Width: 48.26 cm (19.0 inches) with rails installed (without rails, 17.5 inches)
Depth: 57.6 cm (22.7 inches)
Weight: maximum 9.8 kg (21.6 pounds)
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-13
Physical Dimensions
Chapter 3 Deployment
3-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 3 Deployment
Physical Dimensions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
3-15
Physical Dimensions
Chapter 3 Deployment
3-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
4
Installation and Configuration
This chapter contains the following topics:
•
•
Before You Begin
To use the Web Security appliance, you must run the System Setup Wizard. However, first you must do some steps to prepare the appliance for the System Setup Wizard.
For more information about preparing the appliance for installation, see the Web Security appliance
QuickStart Guide . You can find this guide and other useful information about the Web Security appliance on the Cisco IronPort Customer Support site: http://www.cisco.com/web/ironport/index.html
Complete the following tasks before you run the System Setup Wizard:
•
•
Deployment.
Decide how you are going to configure the appliance within your network. For details, see
Laptop network connection.
Configure your laptop’s network connection to use an IP address on the same subnet as the Web Security appliance (192.168.42.xx). For details, see
Laptop to the Appliance, page 4-2 .
•
•
•
Appliance physical connections.
Plug the Ethernet cables into the appropriate ports on the back panel of the appliance. For details, see
Connecting the Appliance to the Network, page 4-2 .
Setup information.
Once you know how you will install the appliance in your network, gather all the information, such as IP addresses, necessary for the System Setup Wizard. For details, see
Gathering Setup Information, page 4-3 .
Existing proxy server.
If you plan to use the Web Security appliance in a network that has an existing proxy server, you must locate it downstream from other proxy servers. Also, after you finish the initial setup of the appliance, you must configure it to work with the existing proxy server. For more information about deploying the appliance in a network with an existing proxy, see
Web Security Appliance in an Existing Proxy Environment, page 3-10
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-1
Chapter 4 Installation and Configuration
Before You Begin
Connecting a Laptop to the Appliance
In order to run the System Setup Wizard the first time, you must connect a computer, such as a laptop, to the appliance. To connect to the appliance, the laptop subnet must be the same as the appliance subnet.
The Management ports are labeled M1 and M2. The Web Security appliance only uses the M1
Management port. It does not use M2.
Configure the laptop IP address so it is on the same subnet as the appliance (192.168.42.xx). Then, connect the laptop to the M1 port on the back of the appliance.
Connecting the Appliance to the Network
You must plug the Ethernet cables into the appropriate ports on the back panel of the appliance. For more information about the Ethernet ports on the appliance, see
Appliance Interfaces, page 3-2 .
How you deploy the appliance determines which Ethernet cables to plug in where:
• Web proxy in transparent mode.
If you want to use one proxy port for all traffic, connect port P1 to an Layer 4 switch or a WCCP router using an Ethernet cable. If you want to use two proxy ports for traffic, connect port P2 to an Layer 4 switch or a WCCP router using an Ethernet cable, and connect port P1 to the internal network.
For more information about deploying the Web Proxy in transparent mode, see
Proxy in Transparent Mode, page 3-5
.
Note When you configure the proxy in transparent mode and connect it to a WCCP router, you must configure the appliance after you run the System Setup Wizard to create at least one WCCP service. For more information about creating WCCP services, see
•
•
Web proxy in explicit forward mode.
If you want to use one proxy port for all traffic, connect port
P1 to a network switch using an Ethernet cable. If you want to use two proxy ports for traffic, connect port P2 to a network switch using an Ethernet cable, and connect port P1 to the internal network.
For more information about deploying the Web Proxy in explicit forward mode, see Deploying the
Web Proxy in Explicit Forward Mode, page 3-4
.
L4 Traffic Monitor.
Connect the Traffic Monitor ports to the Ethernet tap according to the tap communication type:
–
–
Ethernet tap using simplex.
Connect port T1 to the Ethernet tap so it receives all outgoing traffic (from the clients to the Internet), and connect port T2 to the Ethernet tap so it receives all incoming traffic (from the Internet to the clients).
Ethernet tap using duplex.
Connect port T1 to the Ethernet tap so it receives all incoming and outgoing traffic.
For more information about deploying the L4 Traffic Monitor, see
Deploying the L4 Traffic Monitor, page 3-11 .
4-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
Before You Begin
Gathering Setup Information
Once you know how you will install the appliance in your network, you can gather the necessary information, such as IP addresses, to enter in the System Setup Wizard. You can use the worksheet in
to write down the configuration options you decide on. Then, when you run the System Setup
Wizard, you can use the information you enter in the worksheet to configure the initial setup.
Table 4-1 System Setup Worksheet
Network Settings
Default System Hostname:
DNS Servers:
Organization DNS Servers:
(maximum 3)
1.
2.
See
for more information.
Internet root DNS servers / organization DNS servers
3.
Network Time Protocol Server:
Time Zone Region:
Time Zone Country:
Time Zone / GMT Offset:
Network Context
Is there another proxy on the network:
Other Proxy IP Address:
Other Proxy Port:
Interface Settings
L4 Traffic Monitor
L4 Traffic Monitor Wiring Type:
Routes
Management Traffic
Default Gateway:
Yes / No
Management Port
IP Address:
Network Mask:
Hostname:
Data Port
IP Address:
Network Mask:
Hostname:
Note: The Web Proxy can share the Management interface. If configured separately, the Data interface
IP address and the Management interface IP address cannot share the same subnet.
Simplex network tap / Duplex network tap
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-3
Before You Begin
Chapter 4 Installation and Configuration
Table 4-1 System Setup Worksheet (continued)
Static Route Table Name:
Static Route Table Destination Network:
Static Route Table Gateway:
Data Traffic
Default Gateway:
Static Route Table Name:
Static Route Table Destination Network:
Static Route Table Gateway:
Transparent Connection Settings
Device Type:
If WCCP v2 Router, enable standard service:
Standard Service Router Addresses:
Layer 4 switch or No Device / WCCP Router
Yes / No
Enable Router Security?
No / Yes, password: ______________________________
Note: When you connect the appliance to a WCCP router, you might need to configure the Web
Security appliance to create WCCP services after you run the System Setup Wizard. For more information about creating WCCP services, see
Adding and Editing a WCCP Service, page 26-14
.
Administrative Settings
Administrator Password:
Email System Alerts To:
SMTP Relay Host:
AutoSupport:
SensorBase Network Participation:
Participation Level:
Security Services
(optional)
Enable / Disable
Enable / Disable
Limited / Standard
Global Policy Default Action:
L4 Traffic Monitor:
Acceptable Use Controls:
Reputation Filtering:
Monitor all traffic / Block all traffic
Monitor only / Block
Enable / Disable
Enable / Disable
Malware and Spyware Scanning:
Action for Detected Malware:
Enable Webroot / Enable McAfee / Enable both
Monitor only / Block
Cisco IronPort Data Security Filtering: Enable / Disable
DNS Support
To connect to the management interface using a hostname (http://hostname:8080), you must add the appliance hostname and IP address to your DNS server database.
4-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
System Setup Wizard
System Setup Wizard
The Cisco IronPort AsyncOS for Web operating system provides a browser-based wizard to guide you through initial system configuration. This System Setup Wizard prompts you for basic initial configuration, such as network configuration and security settings. The System Setup Wizard is located on the System Administration tab.
You must run the System Setup Wizard when you first install the Web Security appliance. After you finish the System Setup Wizard, the appliance is ready to monitor web traffic. However, you may want to make more custom configurations to the appliance that the System Setup Wizard does not cover. For more information about configuration options, see most of the other chapters in this guide.
Before you run the System Setup Wizard, see Before You Begin, page 4-1 to verify you have all the
information you need to configure the appliance. Having this information prepared ahead of time can reduce the amount of time required to complete the initial setup. You should also read the QuickStart
Guide for more information about product setup.
Warning Running the System Setup Wizard completely reconfigures the Web Security appliance and resets the administrator password. Only use the System Setup Wizard the first time you install the appliance, or if you want to completely overwrite the existing configuration. Running the System Setup Wizard after the appliance is already configured can also interrupt client access to the web. If you choose to run the System Setup Wizard after performing an initial setup, use the System Administration >
Configuration File pages to print a configuration summary and archive the current configuration file.
Warning The appliance ships with a default IP address of 192.168.42.42 on the Management interface (port).
Before connecting the appliance to the network, ensure that no other device on the network has the same IP address.
If you are connecting multiple factory-configured appliances to your network, add them one at a time, reconfiguring each appliance’s default IP address as you go.
The System Setup Wizard includes the following tabs where you enter configuration information:
• Start.
For details, see
.
•
•
Network.
For details, see
Security.
For details, see
.
• Review.
For details, see
.
Accessing the System Setup Wizard
To access the System Setup Wizard, open a browser and enter the IP address of the Web Security appliance. The first time you run the System Setup Wizard, use the default IP address: https://192.168.42.42:8443
-orhttp://192.168.42.42:8080 where
192.168.42.42 is the default IP address, and
8080 is the default admin port setting for HTTP, and
8443
is default admin port for HTTPS.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-5
Chapter 4 Installation and Configuration
System Setup Wizard
The appliance login screen appears. Enter the username and password to access the appliance. By default, the appliance ships with the following username and password:
•
•
Username: admin
Password: ironport
Note Your session will time out if it is idle for over 30 minutes or if you close your browser without logging out. If this happens, you must re-enter the username and password.
Step 1. Start
When you first start the System Setup Wizard, it displays an end user license agreement.
Step 1 Accept the terms of the agreement by clicking the check box at the bottom of the page.
Figure 4-1 System Setup Wizard — Start Tab
Step 2 Click Begin Setup to continue.
The Network tab appears.
Step 2. Network
On the Network tab, you configure appliance system properties, such as the appliance hostname and time zone. The first page of the Network tab is the System Settings page.
Step 1 Verify that you are viewing the System Configuration page.
4-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
Figure 4-2 System Setup Wizard — Network Tab, System Settings
System Setup Wizard
Step 2 Configure the System Setting options.
describes the System Setting options.
Table 4-2 System Setting Options in System Setup Wizard
Option
Default System
Hostname
DNS Server(s):
Use the Internet’s Root
DNS Servers
Description
The fully-qualified hostname for the Web Security appliance. This name should be assigned by your network administrator. This hostname is used to identify the appliance in system alerts.
Configures the appliance to use the Internet root DNS servers for domain name service lookups.
You might choose this option when the appliance does not have access to
DNS servers on your network.
The appliance requires access to a working DNS server in order to perform
DNS lookups for incoming connections. If you cannot specify a working
DNS server that the appliance can reach while you set up the appliance, you can configure it to use the Internet root DNS servers or temporarily assign the
IP address of the Management interface so that you can complete the System
Setup Wizard.
DNS Server(s):
Use these DNS Servers
For more information about configuring DNS settings, see
.
Specifies local DNS servers for domain name service lookups. You must enter at least one DNS server, and up to three total.
You can choose to use the Internet root DNS servers or specify your own
DNS servers.
For more information about configuring DNS settings, see
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-7
Chapter 4 Installation and Configuration
System Setup Wizard
Table 4-2
Option
NTP Server
Time Zone
System Setting Options in System Setup Wizard (continued)
Description
Uses a Network Time Protocol (NTP) server to synchronize the system clock with other servers on the network or the Internet.
By default, the Cisco IronPort time server (time.ironport.com) is entered.
Sets the time zone on the appliance so that timestamps in message headers and log files are correct. Use the drop-down menus to locate your time zone or to define the time zone using the GMT offset.
For more information about the GMT offset, see
Selecting a Time Zone, page 27-27
.
Step 3 Click Next .
The Network Context page appears.
Figure 4-3 System Setup Wizard — Network Tab, Network Context Page
Step 4 Configure the Network Context options by indicating whether or not there exists another proxy server on the network.
Note You can configure the Web Security appliance to interact with multiple proxy servers on the network after you run the System Setup Wizard. For more information about configuring external proxy servers, see
Working with External Proxies Overview, page 11-1 .
Step 5 If there is an external proxy server on the network, configure the proxy settings.
Table 4-3 describes the proxy settings.
Table 4-3 Network Context Options in System Setup Wizard
Option
Proxy group name
Address
Port
Description
Choose a name for the proxy group.
Enter the address of the proxy server in your organization network.
The port number of the proxy server in your organization network.
4-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
System Setup Wizard
edit the proxy group later to include additional proxy servers and to configure load balancing options.
You can also create additional proxy groups after system setup.
Note When you use the Web Security appliance in a network that contains another proxy server, it is recommended that you place the Web Security appliance downstream from the proxy server, closer to the clients.
Step 6 Click Next .
The Network Interfaces and Wiring page appears.
The Web Security appliance has network interfaces that are associated with the physical ports on the machine.
Figure 4-4 System Setup Wizard — Network Tab, Network Interfaces and Wiring Page
Step 7 Configure the Network Interfaces and Wiring options.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-9
Chapter 4 Installation and Configuration
System Setup Wizard
The appliance has network interfaces that are associated with the physical ports on the machine.
Table 4-4 describes the Network Interfaces and Wiring options.
Table 4-4 Network Interfaces and Wiring Options in System Setup Wizard
Option
Management
Data
L4 Traffic
Monitor
Description
Enter the IP address, network mask, and hostname to use to manage the Web Security appliance. Enter an IP address that exists on your management network.
By default, the appliance uses the M1 interface for both management and proxy
(data) traffic (the “Use M1 port for management only” check box is disabled ).
However, optionally, you can use the M1 interface for only management traffic by enabling the “Use M1 port for management only” check box. You might want to do this if your organization uses a separate management network. This can increase security by ensuring no proxy traffic can reach the appliance on management interface.
When you use M1 for management traffic only, you must configure at least one data interface for proxy traffic. Also, you must define different routes for management and data traffic.
Enter the IP address, network mask, and hostname to use for data traffic.
If you configure the M1 interface for management traffic only, you must configure the P1 interface for data traffic. However, you can configure the P1 interface even when the M1 interface is used for both management and data traffic.
You can use the Data interface for Web Proxy monitoring and optional L4 traffic monitoring. You can also configure this interface to support outbound services, such as DNS, software upgrades, NTP, and traceroute data traffic.
Note: You can only enable and configure the P1 network interface for data traffic in the System Setup Wizard. If you want to enable the P2 interface, you must use the ifconfig command after finishing the System Setup Wizard. For more information about configuring the P2 interface, see
Configuring Network Interfaces, page 26-2 .
Choose the type of wired connections plugged into the “T” interfaces:
•
•
Duplex TAP.
Choose Duplex TAP when the T1 port receives both incoming and outgoing traffic. You can use half- or full-duplex Ethernet connections.
Simplex TAP.
Choose Simplex TAP when you connect the T1 port to the internal network (traffic flows from the clients to the Internet) and you connect the T2 port to the external network (traffic flows from the Internet to the clients).
Cisco recommends using Simplex when possible because it can increase performance and security.
Step 8 Click Next .
The Routes for Management and Data Traffic page appears.
4-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
Figure 4-5 System Setup Wizard — Network Tab, Routes for Traffic Page
System Setup Wizard
Step 9 Configure the Routes for Management and Data Traffic options.
The number of sections on this page depend on how you configured the “Use M1 port for management only” check box on the previous wizard page:
• Enabled.
When you use the Management interface for management traffic only, then this page includes two sections to enter gateway and static route table information, one for management traffic and one for data traffic.
• Disabled.
When you use the Management interface for both management and data traffic only, then this page includes one section to enter gateway and static route table information. AsyncOS uses the route information for both management and data traffic.
describes the Routes for Management and Data Traffic options.
Table 4-5 Routes for Management and Data Traffic Options in System Setup Wizard
Option
Static Routes
Table
Description
Default Gateway Enter the default gateway IP address to use for the traffic through the Management and/or Data interface.
Optionally, you can add one or more static routes for management or data traffic.
To add a static route, enter a name for the route, its destination network, and gateway IP address, and then click Add Route . A route gateway must reside on the same subnet as the Management or Data interface on which it is configured.
To delete a static route you entered, click the Delete button next to the static route entry in the table.
For more information about static routes, see Configuring TCP/IP Traffic Routes, page 26-5 .
Step 10 Click Next .
The Transparent Connection Settings page appears. By default, when you run the System Setup Wizard, the Web Proxy is deployed in transparent mode. When the Web Proxy is deployed in transparent mode, you must connect it to a Layer 4 switch or a version 2 WCCP router.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-11
System Setup Wizard
Figure 4-6
Chapter 4 Installation and Configuration
System Setup Wizard — Network Tab, Transparent Connection Settings Page
Step 11 Choose one of the following options described in
.
Table 4-6 Transparent Connection Options in System Setup Wizard
Option
Layer 4 Switch or
No Device
Description
Choose this option when the Web Security appliance is connected to a layer 4 switch or if you will deploy the Web Proxy in explicit forward mode after running the System Setup Wizard.
WCCP v2 Router Choose this option when the Web Security appliance is connected to a version 2
WCCP capable router.
If you connect the appliance to a version 2 WCCP router, you must create at least one WCCP service. You can enable the standard service (also known as the
“web-cache” service) during system setup, and you can configure different or additional WCCP service groups after you run the System Setup Wizard.
When you enable the standard service, choose whether or not to require a password for the standard service group. If required, enter the password in the password fields. The password can contain up to seven characters.
For more information about creating WCCP services, see
Step 12 Click Next .
The Administrative Settings page appears.
4-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
Figure 4-7
System Setup Wizard
System Setup Wizard — Network Tab, Administrative Settings Page
Step 13 Configure the Administrative Settings options.
describes the Administrative Settings.
Table 4-7 Administrative Settings in System Setup Wizard
Option
Administrator
Password
Email System Alerts
To
Enter an email address for the account to which the appliance sends alerts.
For more information about alerts, see
Send Email via
SMTP Relay Host
Description
Enter a password to access the Web Security appliance. The password must be six characters or more.
You can enter a hostname or address for an SMTP relay host that AsyncOS uses for sending system generated email messages.
Optionally, you can enter the port number, too. If no port number is defined,
AsyncOS uses port 25.
If no SMTP relay host is defined, AsyncOS uses the mail servers listed in the
MX record.
For more information about configuring the SMTP relay hosts, see
SMTP Relay Hosts, page 26-16 .
AutoSupport
SensorBase Network
Participation
Choose whether or not the appliance sends system alerts and weekly status report to Cisco IronPort Customer Support.
Choose whether or not to participate in the Cisco SensorBase Network. If you participate, you can configure Limited or Standard (full) participation. Default is Standard.
The SensorBase Network is a threat management database that tracks millions of domains around the world and maintains a global watch list for Internet traffic. When you enable SensorBase Network Participation, the Web Security appliance sends anonymous statistics about HTTP requests to Cisco to increase the value of SensorBase Network data.
For more information about the SensorBase Network, see
SensorBase Network, page 2-11 .
Step 14 Click Next .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-13
Chapter 4 Installation and Configuration
System Setup Wizard
The Security tab appears.
Step 3. Security
On the Security tab, you can configure which security services to enable, such as whether to block or monitor certain components. The Security tab contains one page.
Step 1 Verify that you are viewing the Security tab.
Figure 4-8 System Setup Wizard — Security Tab
Step 2 Choose the Security Services options.
4-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
System Setup Wizard
describes the Security options.
Table 4-8 Security Options in System Setup Wizard
Option
Global Policy
Default Action
Description
Choose whether to block or monitor all web traffic by default after the System
Setup Wizard completes. When you choose to block all traffic, the Global
Access Policy blocks all proxied protocols, such as HTTP, HTTPS, and FTP.
When you choose monitor, no proxied protocols are blocked. You can change this behavior later by editing the Protocols and User Agents settings for the
Global Access Policy.
You might want to block all traffic with the Global Access Policy until you can define appropriately restrictive user-defined Access Policies and then edit the
Global Access Policy as necessary.
L4 Traffic Monitor Choose whether the Layer-4 Traffic Monitor should monitor or block layer 4 traffic.
Acceptable Use
Controls
The L4 Traffic Monitor detects rogue traffic across all network ports and stops malware attempts to bypass port 80.
You might choose to monitor traffic when you evaluate the Web Security appliance, and block traffic when you purchase and use the appliance.
For more information, see
Configuring the L4 Traffic Monitor, page 22-2
.
Choose whether or not to enable Acceptable Use Controls so you can use URL filtering. URL filtering allows you to control user access based on the category of a URL in a request. Enable this option when you want to restrict users from accessing particular types of websites.
For more information, see
.
Reputation Filtering Choose whether or not to enable Web Reputation filtering for the Global Policy
Group. When you create custom Access Policy groups, you can choose whether or not to enable Web Reputation filtering.
Web Reputation Filters is a security feature that analyzes web server behavior and assigns a reputation score to a URL to determine the likelihood that it contains URL-based malware.
Enable this option when you want to identify suspicious activity and stop malware attacks before they occur.
For more information, see
Web Reputation Filters Overview, page 20-2
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-15
Chapter 4 Installation and Configuration
System Setup Wizard
Table 4-8 Security Options in System Setup Wizard (continued)
Option
Malware and
Spyware Scanning
Description
Choose whether or not to enable malware and spyware scanning using Webroot,
McAfee, or Sophos. If enabled, also choose whether to monitor or block detected malware.
You might choose to monitor malware when you evaluate the Web Security appliance, and block malware when you purchase and use the appliance.
You can further configure malware scanning after you finish the System Setup
Wizard. For details, see
Configuring Web Reputation and Anti-Malware in
.
Cisco IronPort Data
Security Filtering
Choose whether or not to enable Cisco IronPort Data Security Filters. The Cisco
IronPort Data Security Filters evaluate data leaving the network over HTTP,
HTTPS, and FTP to control what data goes where and how and by whom.
Enable this option when you want to create Cisco IronPort Data Security
Policies to block particular types of upload requests.
For more information, see
Data Security and External DLP Policies Overview, page 14-1 .
Step 3 Click Next .
The Review tab appears.
Step 4. Review
The last tab of the System Setup Wizard displays a summary of the configuration information you chose.
You can edit any of the configuration options by clicking the Edit button for each section.
Step 1 Verify that you are viewing the Review tab.
4-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 4 Installation and Configuration
Figure 4-9 System Setup Wizard — Review Tab
System Setup Wizard
Step 2
Step 3
Review the configuration information. If you need to change an option, click the Edit button for that section.
Click Install This Configuration after you confirm the configuration is correct.
The Web Security appliance applies the configuration options you selected.
If you changed the Management interface IP address from the current value, then clicking Install This
Configuration will cause the connection to the current URL to be lost. However, your browser will redirect itself to the new IP address. If you did not change the IP address from the current value, the
System Administration > System Setup > Next Steps page appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
4-17
System Setup Wizard
Chapter 4 Installation and Configuration
4-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
5
FIPS Management
This chapter contains the following information:
•
FIPS Management Overview, page 5-1
•
•
•
•
•
Understanding How FIPS Management Works, page 5-1
Managing Certificates and Keys, page 5-6
Backing up and Restoring Certificates and Keys, page 5-13
Using the fipsconfig CLI Command, page 5-14
Working with Multiple HSM Cards, page 5-15
FIPS Management Overview
Some organizations require stricter standards for protecting sensitive, but unclassified, data. The Federal
Information Processing Standards (FIPS) 140 is a publicly announced standard developed jointly by the
United States and Canadian federal governments specifying requirements for cryptographic modules that are used by all government agencies to protect sensitive but unclassified information. The Cisco
IronPort S670 Web Security appliance is offered with a Hardware Security Module (HSM) card that is
FIPS 140-2 level 2 certified. The HSM card is a type of secure cryptoprocessor targeted at managing digital keys for server applications.
When the Cisco IronPort S670 Web Security appliance includes the HSM card, it offloads cryptographic operations to the HSM card in a FIPS compliant manner. The HSM card is responsible for the storage and protection of the cryptographic keys.
FIPS compliance is achieved by use of the CAVIUM Nitrox XL NFBE (HSM), FIPS certificate #1360.
Understanding How FIPS Management Works
FIPS-compliant versions of AsyncOS for Web only run on hardware models that include an HSM card.
The HSM card works by performing all cryptographic operations and storing and protecting all cryptographic keys. The HSM card only stores keys, not the corresponding certificates. Certificates are stored on the Web Security appliance hard drive.
The HSM card stores keys for the following components:
• SSH.
This applies to SSH sessions to the Web Security appliance management interface for administering the appliance using the CLI. The certificate and key pair is automatically generated when you initialize the HSM card.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-1
Chapter 5 FIPS Management
Understanding How FIPS Management Works
• Web interface.
This applies to HTTPS sessions to the Web Security appliance management interface for administering the appliance using the web interface. You can upload a certificate and key pair using the fipsconfig > certconfig
CLI command.
Note To connect to the web interface for managing the appliance, you must use HTTPS. HTTP access to the web interface is not supported.
•
•
HTTPS Proxy.
This applies to HTTPS transactions clients make to HTTPS web servers when the
HTTPS Proxy decrypts the transaction to act as the “man in the middle.” You can upload or generate a certificate and key pair in the web interface. If you have multiple FIPS-compliant Web Security appliances that will decrypt HTTPS transactions, you might want to clone the master key on the
HSM card of each appliance. For more information, see
Working with Multiple HSM Cards, page 5-15 .
Secure authentication.
This applies to HTTPS transactions between the Web Proxy and clients used for transmitting client authentication credentials. For example, this occurs when you enable credential encryption. You can upload a certificate and key pair in the web interface.
Note The only SSL version that AsyncOS for Web supports is TLS version 1.
Someone within your organization should be designated as the FIPS Officer. The FIPS Officer is responsible for managing the certificate and keys on the HSM card. For more information, see
Working with the FIPS Officer Password, page 5-5 .
AsyncOS for Web provides a FIPS management console where the FIPS Officer manages all certificates and keys on the HSM card. Access the FIPS management console from the FIPS Mode > FIPS
Management page. For more information, see
Logging into the FIPS Management Console, page 5-3
.
Because all certificate and key pairs are managed in the FIPS management console, you cannot upload or generate certificate and key pairs elsewhere in the web interface. For example, to enable the HTTPS
Proxy, you must first upload or generate a certificate and key pair in the FIPS management console and then go to the Security Services > HTTPS Proxy page to enable the HTTPS Proxy. You cannot upload or generate a certificate and key pair on the Security Services > HTTPS Proxy page.
Note Enabling FIPS mode limits the cipher suites the Web Security appliance uses when connecting to destination web servers. This may prevent connectivity to web servers which do not implement ciphers required by FIPS.
Initializing the HSM Card
If you need to erase the keys stored on the HSM card, you can initialize the HSM card. Initializing the
HSM card performs the following functions:
• Resets the FIPS Officer password to the default value.
•
•
•
Erases all existing keys stored on the HSM card and erases all corresponding certificates stored on the appliance hard drive.
Disables the HTTPS Proxy and credential encryption.
Sends an email alert to the Web Security appliance administrator users to report the initialization.
5-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Understanding How FIPS Management Works
• Generates a new certificate and key pair for accessing the appliance using SSH and HTTPS. The certificate is stored on the appliance hard drive and the key is stored on the HSM card.
To initialize the HSM card, run the fipsconfig > init CLI command. Three failed login attempts in a row also initializes the HSM card.
When you first receive a FIPS-compliant Web Security appliance, the HSM card is in an initialized state.
This means the HSM card contains a certificate and key pair to allow SSH transactions to the appliance.
It also contains the “Cisco IronPort Web Security Appliance Demo Certificate” and corresponding private key that allows access to the web interface using HTTPS and securely transmitting authentication credentials with clients using credential encryption. It does not contain a certificate and key pair to allow
HTTPS decryption. All corresponding keys are stored on the HSM card. However, client applications are not programmed to recognize these certificates, so you can upload a digital certificate to the appliance that your applications recognize automatically.
When the HSM card is initialized and depending on the organization’s needs, the FIPS Officer may upload different certificates and keys by performing any of the following steps:
• Log into the appliance using the CLI and upload a different certificate and key pair to allow HTTPS access to the web interface. Do this using the fipsconfig > certconfig
CLI command. For more information, see
Using the fipsconfig CLI Command, page 5-14
.
• Log into the web interface using HTTPS and upload or generate certificate and key pairs for HTTPS
Proxy and secure authentication. Do this on the FIPS Mode > FIPS Management page. For more information, see
Managing Certificates and Keys, page 5-6 .
Note Some SSH clients and web browsers automatically lose the SSH or HTTPS connection when the HSM initializes or when the wrong password is entered three times. In this case, the administrator must manually reboot the appliance by powering it off and on.
Logging into the FIPS Management Console
After you log into the Web Security appliance as an administrator user, you can log into the FIPS management console to manage the HSM card. You can log into and out of the FIPS management console separately while remaining logged into the rest of the appliance web interface.
Access the FIPS management console from the FIPS Mode menu in the upper right corner of the web interface.
Figure 5-1 shows the FIPS Mode menu.
Figure 5-1 FIPS Mode Menu
Logging out of the FIPS management console does not affect the session logged into the appliance as the administrator user. However, if you log out of the web interface without manually logging out of the
FIPS management console, AsyncOS for Web automatically logs you out of the FIPS management console.
The default FIPS Officer password is sopin123
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-3
Chapter 5 FIPS Management
Understanding How FIPS Management Works
Warning AsyncOS for Web keeps track of the total number of failed login attempts to the HSM card using the
FIPS Officer password. On the third login failure, the HSM card is initialized, which clears its contents. There is no timeout between failed login attempts. Because the HSM card gets initialized, it loses the certificate and key for accessing the appliance web interface. If the HSM card initializes after the third unsuccessful login attempt, the browser displays a generic error message that it cannot display the webpage. For more information, see
Initializing the HSM Card, page 5-2
.
Note Cisco recommends that you do not use the web browser’s Back button to navigate back toward the FIPS management console login page. If you enter the incorrect FIPS Officer password, navigate away from the page, and use the browser’s Back button to return to the FIPS management console, the browser submits the incorrect password again, causing you to fail the login twice.
To log into the FIPS Management console:
Step 1 From the FIPS Mode menu, choose FIPS Login.
shows the FIPS Login page.
Figure 5-2 FIPS Login Page
Step 2 Enter the FIPS Officer password and click Login .
The FIPS management console appears.
shows the FIPS management console on the FIPS Management page.
5-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Figure 5-3 FIPS Management Console
Understanding How FIPS Management Works
Step 3 If this is the first time accessing the FIPS management console, change the FIPS Officer password by clicking Edit Settings in the Password Management section. For more information, see
Working with the FIPS Officer Password, page 5-5
.
Working with the FIPS Officer Password
To manage certificate and key pairs on the HSM card, you must log into the Web Security appliance as an administrator and then provide the FIPS Officer password. You need the FIPS Officer password to access the FIPS management console or to use the fipsconfig
CLI command.
Note There is no way to retrieve the FIPS Officer password once it is set. If you forget the FIPS Officer password, the only way to access the HSM card is to initialize it, which wipes all certificates and keys it manages. Cisco recommends backing up all data on the HSM card after it is fully configured. For more information, see
Backing up and Restoring Certificates and Keys, page 5-13
.
After you log into the FIPS management console, you can change the FIPS Officer password.
To change the FIPS Officer password:
Step 1
Step 2
Log into the FIPS management console.
Click Edit Settings in the Password Management section.
Figure 5-4 shows the Edit Password Management Settings page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-5
Managing Certificates and Keys
Figure 5-4 Edit Password Management Settings Page
Chapter 5 FIPS Management
Step 3
Step 4
Enter the current FIPS Officer password and the new FIPS Officer password in the appropriate fields.
Click Submit .
Supported Certificate Types
When an SSL session uses an RSA key, the key is protected by the HSM card. When an SSL session uses a DSA key, the key is not protected by the HSM card. The web interface and CLI prevent administrators from uploading certificates that use DSA keys.
Logging
For error messages related to FIPS management, read the Default Proxy Log at the trace or debug level.
You can search for “HSM” in Default Proxy Log to get HSM related information.
Managing Certificates and Keys
You can use the HSM card to manage certificates and keys used by the Web Security appliance. To do this, log into the FIPS management console, and click Edit Settings in the Key Management section.
shows the Edit Key Management Settings page.
5-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Figure 5-5 Edit Key Management Settings Page
Managing Certificates and Keys
On the Edit Key Management Settings page, you can perform the following tasks:
• Upload certificate and key for secure authentication.
For more information, see
Certificate and Key for Secure Authentication, page 5-8
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-7
Chapter 5 FIPS Management
Managing Certificates and Keys
•
•
•
Upload certificate and key for the HTTPS Proxy.
For more information, see
Generating a Certificate and Key for the HTTPS Proxy, page 5-9
.
Upload certificate and key for SaaS Access Control.
For more information, see
Generating a Certificate and Key for SaaS Access Control, page 5-11 .
Backup and restore certificates and keys the HSM card manages.
For more information, see
Backing up and Restoring Certificates and Keys, page 5-13 .
Uploading a Certificate and Key for Secure Authentication
When credential encryption is enabled, the appliance uses a digital certificate to securely establish a connection with the client application. Then, using the secure HTTPS connection, the clients send the authentication credentials to the Web Proxy for authentication. To configure the appliance to use credential encryption, enable the Credential Encryption setting in the global authentication settings. For more information, see
Sending Authentication Credentials Securely, page 21-25
.
By default, the appliance uses the “Cisco IronPort Web Security Appliance Demo Certificate” and a corresponding private key that is stored on the HSM card. However, you can choose to upload a different certificate that the client applications on the network recognize along with a private key that is stored on the HSM card. The appliance then uses this certificate and key pair to establish the HTTPS session with clients.
To upload a certificate and key to use for securely communicating authentication:
Step 1
Step 2
Step 3
Log into the FIPS management console.
Click Edit Settings in the Key Management section.
View the Secure Authentication Certificate and Key section on the Edit Key Management Settings page.
shows the Secure Authentication Certificate and Key section.
Figure 5-6 Secure Authentication Certificate and Key Section
5-8
Step 4 To upload a certificate, click Browse for the Certificate field and navigate to the certificate file on your local machine.
If the file you upload contains multiple certificates or keys, the Web Proxy uses the first certificate or key in the file.
Note The certificate file must be in PEM format. DER format is not supported.
Step 5 To upload a key, click Browse for the Key field and navigate to the key file on your local machine. The private key must be unencrypted.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Managing Certificates and Keys
Step 6
Step 7
Note The key length must be 1024 or 2048 bits. Only RSA keys are supported. Also, the private key file must be in PEM format. DER format is not supported.
Click Upload Files after you select the files you want.
Submit your changes.
Uploading and Generating a Certificate and Key for the HTTPS Proxy
To monitor and decrypt HTTPS traffic, you must enable the HTTPS Proxy on the Security Services >
HTTPS Proxy page. When you enable the HTTPS Proxy, you must configure what the appliance uses for a root certificate when it sends self-signed server certificates to the client applications on the network. You can upload a root certificate and key that your organization already has, or you can configure the appliance to generate a certificate and key with information you enter. However, to enable the HTTPS Proxy on a FIPS-compliant Web Security appliance, you must first use the FIPS management console to upload or generate a root certificate and key. After the certificate and key pair is uploaded or generated, then you can enable the HTTPS Proxy.
For more information, see
Enabling the HTTPS Proxy, page 12-15 .
To upload a certificate and key for the HTTPS Proxy:
Step 1
Step 2
Step 3
Log into the FIPS management console.
Click Edit Settings in the Key Management section.
Scroll down to the HTTPS Proxy Certificate and Key section on the Edit Key Management Settings page.
Figure 5-7 shows the HTTPS Proxy Certificate and Key section.
Figure 5-7 HTTPS Proxy Certificate and Key Section
Step 4 Choose which root certificate to use for signing self-signed certificates the appliance sends to clients:
•
•
Uploaded certificate and key.
Go to step
Generated certificate and key.
Go to step
For more information about how the appliance uses these root certificates, see
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-9
Chapter 5 FIPS Management
Managing Certificates and Keys
Note If the appliance has both an uploaded certificate and key pair and a generated certificate and key pair, it only uses the certificate and key pair currently selected in the Root Certificate for Signing section.
Step 5 To upload a root certificate and key: a.
b.
Select Use Uploaded Certificate and Key.
Click Browse for the Certificate field to navigate to the certificate file stored on the local machine.
If the file you upload contains multiple certificates or keys, the Web Proxy uses the first certificate or key in the file.
Note The certificate file must be in PEM format. DER format is not supported.
c.
Click Browse for the Key field to navigate to the private key file. The private key must be unencrypted.
Note The key length must be 1024 or 2048 bits. Only RSA keys are supported. Also, the private key file must be in PEM format. DER format is not supported.
Step 6 d.
Click Upload Files .
The uploaded certificate information is displayed on the Edit Key Management Settings page.
e.
Go to step
To generate a certificate and key: a.
b.
Select the Use Generated Certificate and Key option.
Click Generate New Certificate and Key .
c.
In the Generate Certificate and Key dialog box, enter the information to display in the root certificate.
Note You can enter any ASCII character except the forward slash ( / ) in the Common Name field.
d.
Click Generate . The Web Security appliance generates the certificate with the data you entered and generates a key.
The generated certificate information is displayed on the Edit Key Management Settings page.
5-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Managing Certificates and Keys
Step 7
Note After you generate the certificate and key, you can download the generated certificate to transfer it to the client applications on the network. Do this using the Download Certificate link in the generated key area. e.
Optionally, you can download the Certificate Signing Request (CSR) using the Download
Certificate Signing Request link so you can submit it to a certificate authority (CA). After you receive a signed certificate from the CA, click Browse and navigate to the signed certificate location. Click Upload File . You can do this anytime after generating the certificate on the appliance.
Submit your changes.
Uploading and Generating a Certificate and Key for SaaS Access Control
When you configure the Web Security appliance as an identity provider, the settings you define apply to all SaaS applications it communicates with. The Web Security appliance uses a certificate and key to sign each SAML assertion it creates. You can either upload or generate the certificate and key.
For more information, see
Configuring the Appliance as an Identity Provider, page 16-5
.
To upload a certificate and key for SaaS Access Control:
Step 1
Step 2
Step 3
Log into the FIPS management console.
Click Edit Settings in the Key Management section.
Scroll down to the SaaS Single Sign On Certificate and Key section on the Edit Key Management
Settings page.
Figure 5-8 shows the SaaS Single Sign On Certificate and Key section.
Figure 5-8 SaaS Single Sign On Certificate and Key Section
Step 4 Configure a signing certificate the appliance should use when it communicates using a secure connection
(in the SAML flow) with service providers:
•
•
Uploaded certificate and key.
Go to step
Generated certificate and key.
Go to step
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-11
Chapter 5 FIPS Management
Managing Certificates and Keys
Note If the appliance has both an uploaded certificate and key pair and a generated certificate and key pair, it only uses the certificate and key pair currently selected in the Identity Provider Signing Certificate and
Key section.
Step 5 To upload a root certificate and key: a.
b.
Select Use Uploaded Certificate and Key.
Click Browse for the Certificate field to navigate to the certificate file stored on the local machine.
If the file you upload contains multiple certificates or keys, the Web Proxy uses the first certificate or key in the file.
Note The certificate file must be in PEM format. DER format is not supported.
c.
Click Browse for the Key field to navigate to the private key file. The private key must be unencrypted.
Note The key length must be 1024 or 2048 bits. Only RSA keys are supported. Also, the private key file must be in PEM format. DER format is not supported. d.
Click Upload Files .
The uploaded certificate information is displayed on the Edit Key Management Settings page.
Note After you upload the certificate and key, you can download the generated certificate to transfer it to the SaaS applications with which the Web Security appliance will communicate. Do this using the Download Certificate link in the generated key area.
Step 6 e.
b.
Go to step
To generate a certificate and key: a.
Select the Use Generated Certificate and Key option.
Click Generate New Certificate and Key .
c.
In the Generate Certificate and Key dialog box, enter the information to display in the signing certificate.
Note You can enter any ASCII character except the forward slash ( / ) in the Common Name field.
5-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Backing up and Restoring Certificates and Keys d.
Click Generate . The Web Security appliance generates the certificate with the data you entered and generates a key.
The generated certificate information is displayed on the Edit Key Management Settings page.
Note After you generate the certificate and key, you can download the generated certificate to transfer it to the SaaS applications with which the Web Security appliance will communicate. Do this using the Download Certificate link in the generated key area.
Step 7 e.
Optionally, you can download the Certificate Signing Request (CSR) using the Download
Certificate Signing Request link so you can submit it to a certificate authority (CA). After you receive a signed certificate from the CA, click Browse and navigate to the signed certificate location. Click Upload File . You can do this anytime after generating the certificate on the appliance.
Submit your changes.
Backing up and Restoring Certificates and Keys
You can back up the certificates and keys the HSM card manages to an XML file. Similarly, you can restore the certificates and keys from the XML file to the HSM card. Backing up includes all certificates and keys stored in the HSM card in the XML file. The keys are encrypted before being stored to the file.
When you restore from the XML file, you can choose which certificate and key pairs to restore.
Note When you save the appliance configuration to a file, the certificate and keys the HSM card manages are not included in the configuration file. Also, if you restore the appliance configuration from a file that erroneously includes certificate and key information, AsyncOS ignores the certificate and key information in the file.
To back up and restore certificates and keys, use the Backup Certificates and Keys section on the Edit
Key Management Settings page.
Figure 5-9 shows where you back up and restore certificates and keys
on the Edit Key Management Settings page.
Figure 5-9 Backing up and Restoring Certificates and Keys
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-13
Chapter 5 FIPS Management
Using the fipsconfig CLI Command
Backing up Certificates and Keys
To back up the certificates and keys the HSM card manages:
Step 1
Step 2
Step 3
Step 4
Step 5
From the FIPS management console, click Edit Settings in the Key Management section.
The Edit Key Management Settings page displays.
Scroll down to the Backup Certificates and Keys section, and choose the file name to use for the XML file that will contain the encrypted certificate and key pairs. You can define your own file name or
AsyncOS for Web can choose one for you.
Click Backup .
Choose to save the file, and click OK.
Navigate to the directory on the local machine to where you want to save the XML file, and click Save .
Restoring Certificates and Keys
When you back up the certificates and keys the HSM card manages, the keys are encrypted. Because the keys are encrypted, they can only be restored on a different FIPS-compliant Web Security appliance if the master key on the other appliance is the same as the one from which the certificates and keys were backed up. Note that when the HSM card gets initialized, its master key changes. For more information on copying the master key between appliances, see
Working with Multiple HSM Cards, page 5-15 .
To restore a certificate and key pair stored in an XML file:
Step 1
Step 2
Step 3
Step 4
Step 5
From the FIPS management console, click Edit Settings in the Key Management section.
The Edit Key Management Settings page displays.
Scroll down to the Restore Certificates and Keys section, and click Browse .
Navigate to the directory on the local machine where the XML file resides, and click Open .
Click the check boxes for the certificate and key pairs you want to restore.
Click Restore .
Using the fipsconfig CLI Command
AsyncOS for Web includes the fipsconfig CLI command to perform the following tasks:
• Initialize the HSM card.
•
•
Read the HSM card status.
Configure the certificate and key to access the appliance web interface.
• Configure multiple HSM cards to use the same master key.
When you enter fipsconfig
at the command line, the CLI prompts you to enter the FIPS Officer password. For more information, see
Working with the FIPS Officer Password, page 5-5 .
5-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 5 FIPS Management
Working with Multiple HSM Cards
describes the fipsconfig
subcommands.
Table 5-1 fipsconfig Subcommands fipsconfig
Subcommand init getinfo certconfig clonetarget clonesource
Description
Initializes the card and reboots the Web Security appliance.
For more information, see
Initializing the HSM Card, page 5-2 .
Note Some SSH clients automatically lose the SSH connection when the HSM initializes or when the wrong password is entered 3 times. In this case, the administrator must manually reboot the appliance by powering off and on.
Displays the HSM card status.
Allows you to configure the security certificate and key to access the Web Security appliance web interface using HTTPS.
This command works similarly to the certconfig
CLI command. For more information on using certconfig
, see Uploading Certificates to the Web Security
Appliance, page 27-30 . For more information about the requirements involved with
uploading a certificate for web interface access, see Installing a Server Digital
.
Note The key length must be 1024 or 2048 bits. Only RSA keys are supported.
Also, the certificate and private key files must be in PEM format. DER format is not supported. The certificate must be a server certificate, not a root certificate.
Clones the HSM card as a target when copying the master key among multiple HSM cards.
For more information, see
Working with Multiple HSM Cards, page 5-15
.
Clones the HSM card as a source when copying the master key among multiple
HSM cards.
For more information, see
Working with Multiple HSM Cards, page 5-15
.
Working with Multiple HSM Cards
When client HTTPS traffic might be processed by any of several Web Security appliances, the client applications need to be able to recognize the signing certificate used on each Web Security appliance when it mimics HTTPS servers for decrypting traffic. Optionally, you can ensure that each appliance uses the same signing certificate for decrypting HTTPS traffic by uploading the same certificate and key to each appliance.
You can also choose to generate a certificate and key on the FIPS-compliant appliance to use for HTTPS decryption. However, if you want to use that same certificate and key pair on a different FIPS-compliant appliance, you must first clone the master key from one HSM card (the source appliance) to another
HSM card (the target appliance). You might want to clone the master key between HSM cards if you want the client applications on the network to recognize only one certificate used for decrypting HTTPS traffic when the certificate and key are generated on a FIPS-compliant appliance.
Note Cisco recommends you clone the master keys immediately after the HSM card is initialized.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
5-15
Chapter 5 FIPS Management
Working with Multiple HSM Cards
To clone the master key among a source and target HSM card, you need to have access to the following:
•
•
SSH session to the source HSM card machine and another SSH session to the target HSM card machine. Each SSH session needs to remain open during the process. You can run the SSH sessions from the same local machine or different local machines.
FTP session to the source and target HSM card machines. You must run the FTP sessions from the same local machine so you can copy files between the source and target machines.
To clone the master key between HSM cards:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Open an SSH session to the source Web Security appliance and run the fipsconfig > clonesource CLI command. This command creates the Token Wrapping Certificate (TWC) file (twc.file). The CLI command prompts you to enter the name of the part1.file file. Do not enter anything yet. Keep the CLI session open.
Use FTP to copy the TWC file from the source appliance in step
1 to the target appliance. The TWC file
is located in the FTP root directory.
Open an SSH session to the target Web Security appliance and run the fipsconfig > clonetarget CLI command. Enter the name of the TWC file (twc.file by default) and press Enter. This command generates the key.file and part1.file using the twc.file copied from the source appliance in step
command prompts you to enter the name of the part2.file file. Do not enter anything yet. Keep the CLI session open.
Use FTP to copy part1.file from the target appliance to the source appliance.
Return to the CLI session for the source appliance and that has the open CLI command. Enter the name of the part1.file file you copied from the target appliance and press Enter. This generates the part2.file file.
Use FTP to copy the part2.file file from the source appliance to the target appliance.
Return to the CLI session for the target appliance and that has the open CLI command. Enter the name of the part2.file file you copied from the source appliance and press Enter. This generates a master key on the target appliance that matches the master key on the source appliance.
5-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
6
Web Proxy Services
This chapter contains the following information:
•
About Web Proxy Services, page 6-1
•
•
•
•
•
•
•
•
•
Configuring the Web Proxy, page 6-2
Working with FTP Connections, page 6-6
Bypassing the Web Proxy, page 6-11
Bypassing Application Scanning, page 6-13
Proxy Usage Agreement, page 6-13
Configuring Client Applications to Use the Web Proxy, page 6-13
Working with PAC Files, page 6-14
Adding PAC Files to the Web Security Appliance, page 6-17
Advanced Proxy Configuration, page 6-21
About Web Proxy Services
A web proxy is a computer system or software that handles World Wide Web requests of clients by making requests of other servers on the web. The Web Security appliance can act as a web proxy if you enable the Web Proxy feature.
The Web Proxy service monitors and controls traffic that originates from clients on the internal network.
Typically, the Web Proxy-enabled Web Security appliance is deployed between clients and the firewall where it intercepts requests for content from clients to servers.
You can configure the Web Proxy as one of the following types:
• Transparent Proxy.
When the appliance is configured as a transparent proxy, clients are unaware of the Web Proxy. Client applications, such as web browsers, do not have to be configured to accommodate the appliance. You might want to configure the appliance as a transparent proxy because it eliminates the possibility of users reconfiguring their web browsers to bypass the appliance without knowledge of the administrator. To configure the appliance as a transparent proxy, you must connect it to an Layer 4 switch or a WCCP router.
For information about how to configure the appliance when you configure the proxy in transparent mode, see
Configuring Transparent Redirection, page 26-11 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-1
Chapter 6 Web Proxy Services
Configuring the Web Proxy
• Explicit Forward Proxy.
In an explicit forward proxy configuration, the appliance acts on behalf of client web browsers to handle requests for servers on the web. Users must configure their web browsers to point to a single Web Security appliance. You might want to configure the appliance as an explicit forward proxy if you do not have an Layer 4 switch or a WCCP router.
You can use the Web Security appliance in a network that includes another proxy server. For more information about how to deploy and configure the appliance when the network contains another proxy, see
Using the Web Security Appliance in an Existing Proxy Environment, page 3-10
.
The Web Proxy handles both HTTP and native FTP transactions. For more information about working with FTP, see
Working with FTP Connections, page 6-6
.
Web Proxy Cache
By default, AsyncOS uses a web proxy cache to increase performance for users accessing the web in some cases.
You can edit the web proxy and proxy cache in the following ways:
•
•
Remove a URL from the cache.
Use the evict subcommand of the webcache CLI command to remove one or more URLs from the cache.
Specify a domain or URL to never cache.
Use the ignore
subcommand of the webcache
CLI command to specify one or more domains or URLs that the web proxy should never store in the proxy cache. You can include embedded regular expression (regex) characters in the URL you specify to never cache.
Each access log file entry includes transaction result codes that describe how the appliance resolved client requests. Transaction result codes indicate whether the transaction was served from the proxy cache or from the destination server. For more information about transaction result codes, see
Transaction Result Codes, page 25-17
.
Configuring the Web Proxy
Web Proxy settings are configured as part of an initial setup using the System Setup Wizard. To enable
Web Proxy services or modify proxy settings after an initial configuration, use the Security Services >
Web Proxy page. This page allows you to configure basic and advanced settings to customize proxy services.
The Web Proxy settings apply to all connections that go over HTTP or HTTPS. To configure proxy settings for native FTP connections, see
Working with FTP Connections, page 6-6 .
To edit the Web Proxy settings:
Step 1
Step 2
Navigate to the Security Services > Web Proxy page.
Click Edit Settings .
6-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Figure 6-1 Editing Web Proxy Settings
Configuring the Web Proxy
Step 3
Step 4
Verify the Enable Proxy field is selected.
Configure the basic and advanced Web Proxy settings defined in
.
Table 6-1 Web Proxy Settings
Property
HTTP Ports to Proxy
Caching
Proxy Mode
Description
Enter which ports the Web Proxy monitors for HTTP requests.
Default is 80 and 3128.
Choose whether or not the Web Proxy should cache requests and responses.
Default is enabled.
Choose how to deploy the Web Proxy:
• Transparent mode. Clients applications are unaware of the Web
Proxy and do not have to be configured to connect to the proxy. In transparent mode, the Web Proxy can accept both transparently redirected and explicitly forwarded connections.
For more information, see
Deploying the Web Proxy in Transparent
• Explicit forward mode.
Client applications, such as web browsers, are aware of the Web Proxy and must be configured to point to a single
Web Security appliance. In explicit forward mode, the Web Proxy can only accept explicitly forwarded connections.
For more information, see
Deploying the Web Proxy in Explicit
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-3
Chapter 6 Web Proxy Services
Configuring the Web Proxy
Table 6-1
Property
IP Spoofing
Persistent Connection
Timeout
Web Proxy Settings (continued)
Description
Choose whether or not the Web Proxy should spoof IP addresses when sending requests to upstream proxies and servers.
When the Web Proxy is deployed in transparent mode, you can enable IP spoofing for transparently redirected connections only or all connections
(transparently redirected and explicitly forwarded).
When IP spoofing is enabled, requests originating from a client retain the client’s source address and appear to originate from the client rather than from the Web Security appliance.
Note: When IP spoofing is enabled and the appliance is connected to a
WCCP router, configure a WCCP service to redirect the return path.
Enter how long the Web Proxy keeps open a connection to a client or server after a transaction has been completed. Keeping a connection open allows the Web Proxy to use it again for another request.
For example, after a client finishes a transaction with google.com, the Web
Proxy keeps the connection to the server google.com open for the amount of time specified in the server side persistent timeout if no other client makes a request for google.com.
•
•
Client side.
The maximum number of seconds the Web Proxy keeps a connection open with a client on the network with no activity from the client.
Server side.
The maximum number of seconds the Web Proxy keeps a connection open with a destination server with no activity from any client on the network to that server.
Default is 300 seconds for both client and server side persistent timeouts.
You might want to increase the server side persistent timeout if clients on the network frequently connect to the same server, or if the network has a relatively slow connection to outside servers.
Cisco recommends keeping the default values. However, you might want to increase or decrease these values to keep connections open longer to reduce overhead used to open and close connections repeatedly. Consider that if you increase the persistent timeout values, you also reduce the ability of the Web Proxy to open new connections if the maximum number of simultaneous persistent connections has been reached.
6-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Configuring the Web Proxy
Table 6-1 Web Proxy Settings (continued)
Property
In-Use Connection
Timeout
Simultaneous Persistent
Connections (Server
Maximum Number)
Generate Headers
Description
Enter how long the Web Proxy waits for more data from an idle client or server when the current transaction has not been completed.
For example, if a client opens a connection and sends only half of the request, the Web Proxy waits for the amount of time specified for the client side reserve timeout for the rest of the request before closing the open connection.
• Client side.
The maximum number of seconds the Web Proxy keeps a connection open with an idle client.
• Server side.
The maximum number of seconds the Web Proxy keeps a connection open with an idle destination server.
Default is 300 seconds for both client and server side reserve timeouts.
Enter the maximum number of connections (sockets) the Web Proxy keeps open with servers.
Use Received Headers
•
•
X-Forwarded-For.
Choose whether or not to forward HTTP
“X-Forwarded-For” headers. Default is Do Not Send.
Note: If the network contains an explicit forward upstream proxy that manages user authentication or access control using proxy authentication, you must enable the X-Forwarded-For header to send the client host header to the upstream proxy.
VIA.
Choose whether or not to forward HTTP “VIA” headers in
HTTP requests from clients and HTTP responses from servers.
Default is Send.
Check the Enable Identification of Client IP Addresses using
X-Forwarded-For check box if the appliance has been deployed as an upstream proxy and you want it to identify clients using the IP address specified in the X-Forwarded-For header instead of the IP address from the downstream proxy. You should only enable this option when the appliance receives client requests from a trustworthy downstream proxy or load balancer.
When you enable this option, enter the IP address of a downstream proxy or load balancer. You cannot enter subnets or hostnames. Click Add Row to add more than one IP address. The Web Proxy will not accept the IP address in a X-Forwarded-For header from a machine that is not included in the list.
Note You can display the downstream IP address in the access logs using the %XV custom format specifier, and in the W3C access logs using the x-request-source-ip variable.
Step 5 Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-5
Chapter 6 Web Proxy Services
Working with FTP Connections
Working with FTP Connections
The Web Security appliance Web Proxy provides proxy services for the File Transfer Protocol (FTP) as well as HTTP. FTP is a protocol used to transfer data between computers over a network. The Web Proxy can handle the following FTP transactions:
• FTP over HTTP.
Most web browsers support FTP transactions, but sometimes the transactions are encoded inside an HTTP transaction. All policies and configuration options that apply to HTTP transactions also apply to FTP over HTTP transactions.
• Native FTP.
FTP clients use FTP to transfer data without invoking an HTTP connection. Native FTP connections are treated and handled differently than HTTP connections.
The component of the Web Proxy that handles native FTP transactions is referred to as the FTP Proxy.
Native FTP connections can be served when the Web Proxy is deployed in either transparent or explicit forward mode.
Computers that transfer data using FTP create two connections between them. The control connection is used to send and receive FTP commands, such as RETR and STOR, and to communicate other information, such as the connection mode and file properties. The data connection is used to transfer the data itself. Typically, computers use port 21 for the control connection, and use a randomly assigned port
(usually greater than 1023) for the data connection.
The FTP Proxy supports the following connection modes:
• Passive.
In passive mode, the FTP server chooses the port used for the data connection and communicates this assignment to the FTP client. Passive mode is typically favored in most network environments where the FTP client is located behind a firewall and inbound connections (such as from an FTP server) are blocked. The default for the FTP Proxy is passive mode.
• Active.
In active mode, the FTP client chooses the port used for the data connection and communicates this assignment to the FTP server.
FTP clients may support passive mode, active mode, or both. No matter which mode the FTP client uses to connect to the FTP Proxy, the FTP Proxy first attempts to use passive mode to connect to the FTP server. However, if the FTP server does not allow passive mode, the FTP Proxy uses active mode.
Consider the following rules and guidelines when working with native FTP connections:
• You can define which Identity groups apply to native FTP transactions.
•
•
You configure FTP Proxy settings that apply to native FTP connections. For more information, see
Configuring FTP Proxy Settings, page 6-8
.
You can configure which welcome message users see in the FTP client when they connect to an FTP server. Configure the welcome banner when you configure the FTP Proxy settings.
•
•
•
You can define a custom message the FTP Proxy displays in IronPort FTP notification messages when the FTP Proxy cannot establish a connection with the FTP server for any reason, such as an error with FTP Proxy authentication or a bad reputation for the server domain name. For more information, see
Working with FTP Notification Messages, page 17-17
.
When the FTP Proxy is configured to cache native FTP transactions, it only caches content accessed by anonymous users.
You can configure the FTP Proxy to spoof the IP address of the FTP server. You might want to do this when FTP clients do not allow passive data connections when the source IP address of the data connection (FTP server) is different than the source IP address of the control connection (FTP
Proxy).
6-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Working with FTP Connections
•
•
•
•
If the connection between the FTP Proxy and the FTP server is slow, uploading a large file may take a long time when Cisco IronPort Data Security Filters are enabled. If the FTP client times out before the FTP Proxy uploads the entire file, users may notice a failed transaction.
FTP clients can specify any TCP port for the control connection as long as they use proper formatting (hostname:port).
Regardless of which mode the FTP client uses to connect to the FTP Proxy, the FTP Proxy first attempts to use passive mode to connect to the FTP server. However, if the FTP server does not allow passive mode, the FTP Proxy uses active mode.
Access logs include entries for when users first start a native FTP session. Search the access log file for “FTP_CONNECT” (explicit forward connections) and “FTP_TUNNEL” (transparent connections).
Using Authentication with Native FTP
The FTP Proxy performs user authentication to control which users can make native FTP requests. This user authentication determines which policy groups apply to the native FTP transaction.
However, due to the nature of FTP and FTP clients, only the following transactions can authenticate users for native FTP transactions:
• Explicit forward connections.
• Transparently redirected connections under any of the following conditions:
– When users are identified transparently using either Novell eDirectory or Active Directory.
–
–
When the authentication surrogate is IP address and users make an HTTP transaction before the
FTP transaction.
When users are remote users and they are identified by a Cisco adaptive security appliance using the Secure Mobility solution.
Due to this limitation, you may want to configure at least one Identity and Access Policy for native FTP transactions that do not require authentication when the Web Proxy is deployed in transparent mode.
This allows all FTP connections that are transparently redirected to the Web Security appliance to work.
If authentication is required for all policy groups, some transparently redirected native FTP transactions will fail. For example, transparently redirected native FTP transactions that use cookie authentication surrogates will fail.
You can configure the authentication format the FTP Proxy uses when communicating with FTP clients.
The FTP Proxy supports the following formats for proxy authentication:
•
•
Check Point.
Uses the following formats:
– User: ftp_user@proxy_user@remote_host
– Password: ftp_password@proxy_password
Raptor.
Uses the following formats:
–
–
User: ftp_user@remote_host proxy_user
Password: ftp_password
– Account: proxy_password
When using authentication with native FTP, ensure that the FTP client uses the same authentication settings configured for the FTP Proxy.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-7
Chapter 6 Web Proxy Services
Working with FTP Connections
You can use spaces and the @ character in FTP user names. However, you must precede these characters with a backslash character (\).
Note Be careful when requiring authentication for native FTP transactions. FTP is inherently insecure because data (including the authentication credentials) is transmitted directly over the wire without encryption.
Working with Native FTP in Transparent Mode
When the Web Security appliance is deployed in transparent mode, FTP clients typically are not explicitly configured to use the FTP Proxy. Native FTP connections are transparently redirected to the
FTP Proxy and then processed.
When a native FTP request is transparently redirected to the FTP Proxy, it contains no hostname information for the FTP server, only its IP address. Because of this, the FTP Proxy only matches native
FTP transactions with IP addresses configured in the Access Policies.
The predefined URL categories and Web Reputation Filters block by hostname and IP address, but for some servers, they may only have hostname information and not the server’s IP address. For example, if the “News” predefined URL category contains the cnn.com, but not the corresponding IP address for that server, and if that URL category is configured to block, then native FTP connections to cnn.com will successfully connect instead of being blocked. Therefore, to make sure the FTP Proxy blocks native FTP connections to certain sites, you must create custom URL categories and enter the IP addresses in the list of sites to block or in the regular expression field.
Configuring FTP Proxy Settings
The FTP Proxy settings apply to native FTP connections. To configure proxy settings that apply to FTP over HTTP connections, configure the Web Proxy. For more information, see
.
To configure the FTP Proxy settings:
Step 1 Navigate to the Security Services > FTP Proxy page, and click Edit Settings .
6-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Figure 6-2 Configuring FTP Proxy Settings
Working with FTP Connections
Step 2
Step 3
Verify the Enable FTP Proxy field is selected.
Configure the basic and advanced FTP Proxy settings defined in
.
Table 6-2 FTP Proxy Settings
Property Description
Proxy Listening Port
Caching
Server Side IP Spoofing Choose whether or not the FTP Proxy should spoof the FTP server IP address. You might want to do this for FTP clients that do not allow transactions when the IP address is different for the control and data connections.
Authentication Format Choose the authentication format the FTP Proxy uses when communicating with FTP clients. For more information, see
Passive Mode Data Port
Range
Specify the port FTP clients should use to establish a control connection with the FTP Proxy.
Choose whether or not to cache contents of data connections from anonymous users.
Specify a range of TCP ports FTP clients should use to establish a data connection with the FTP Proxy for passive mode connections.
Default is 11000-11009.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-9
Chapter 6 Web Proxy Services
Working with FTP Connections
Table 6-2 FTP Proxy Settings (continued)
Property
Active Mode Data Port
Range
Welcome Banner
Control Connection
Timeouts
Description
Specify a range of TCP ports FTP servers should use to establish a data connection with the FTP Proxy for active mode connections. This setting applies to both native FTP and FTP over HTTP connections.
Default is 12000-12099.
You might want to increase the port range in this field to accommodate more requests from the same FTP server. Because of the TCP session
TIME-WAIT delay (usually a few minutes), a port does not become available again for the same FTP server immediately after being used. As a result, any given FTP server cannot connect to the FTP Proxy in active mode more than n times in a short period of time, where n is the number of ports specified in this field.
Choose which welcome message should appear in FTP clients:
•
•
FTP server message.
The FTP server message only displays for transparently redirected connections. When a native FTP connection is explicitly sent to the FTP Proxy, the FTP client displays a message predefined by the FTP Proxy.
Custom message.
Enter a message to display for all native FTP connections.
Enter how long the FTP Proxy waits for more communication in the control connection from an idle FTP client or FTP server when the current transaction has not been completed.
For example, if an FTP client opens a control connection and sends some requests, the FTP Proxy waits for the amount of time specified for the client side control connection timeout for the next request before closing the open connection.
•
•
Client side.
The maximum number of seconds the FTP Proxy keeps a control connection open with an idle client.
Server side.
The maximum number of seconds the FTP Proxy keeps a control connection open with an idle FTP server.
Default is 300 seconds for both client and server side control connection timeouts.
6-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Bypassing the Web Proxy
Table 6-2 FTP Proxy Settings (continued)
Property
Data Connection
Timeouts
Description
Enter how long the FTP Proxy waits for more communication in the data connection from an idle FTP client or FTP server when the current transaction has not been completed.
For example, if an FTP client opens a data connection and sends only half of the request, the FTP Proxy waits for the amount of time specified for the client side data connection timeout for the rest of the request before closing the open connection.
• Client side.
The maximum number of seconds the FTP Proxy keeps a data connection open with an idle client.
• Server side.
The maximum number of seconds the FTP Proxy keeps a data connection open with an idle FTP server.
Default is 300 seconds for both client and server side data connection timeouts.
Step 4 Submit and commit your changes.
Bypassing the Web Proxy
You can configure the Web Security appliance so client requests to or from particular addresses bypass all processing by the Web Proxy. The proxy bypass list only works for requests that are transparently redirected to the Web Proxy using an Layer 4 switch or a WCCP v2 router. When the appliance is deployed in explicit forward mode, or when a client makes an explicit request to the Web Proxy, the request is processed by the Web Proxy.
You might want to create a proxy bypass list to accomplish any of the following:
• Prevent the Web Proxy from interfering with non-HTTP-compliant (or proprietary) protocols using
HTTP ports that do not work properly when they connect to a proxy server.
• Ensure that traffic from a particular machine inside the network, such as a malware test machine, bypasses the Web Proxy and all its built-in security protection.
Define the proxy bypass list on the Web Security Manager > Bypass Settings page.
Figure 6-3 shows a sample proxy bypass list.
Figure 6-3 Proxy Bypass List
To include an address in the proxy bypass list, click Edit Proxy Bypass Settings . You can enter multiple addresses separated by line breaks or commas. You can enter addresses using any of the following formats:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-11
Chapter 6 Web Proxy Services
Bypassing the Web Proxy
•
•
•
•
IP address, such as 10.1.1.0
CIDR address, such as 10.1.1.0/24
Hostname, such as crm.example.com
domain names, such as example.com
Note For the proxy bypass list to work with domain names, you need to connect the T1 and T2 network interfaces to the network even if you do not enable the L4 Traffic Monitor . For more information, see
Understanding How the Proxy Bypass List Works, page 6-12
.
When transactions bypass the Web Proxy, AsyncOS for Web records them in the proxy bypass logs. For more information about logging, see
Working with Log Subscriptions, page 25-7 .
Note If the proxy bypass list contains an address that is a known malware address according to the L4 Traffic
Monitor and the L4 Traffic Monitor sees a request for that address, then the request will still be blocked by the L4 Traffic Monitor. If you want to ensure traffic to that address is always allowed, you must also bypass the address from the L4 Traffic Monitor. For more information, see
Traffic Monitor Works, page 22-1 .
Understanding How the Proxy Bypass List Works
When the Web Proxy receives an HTTP or HTTPS request, it checks both the source and destination IP address to see if it is in the proxy bypass list. If it is, the packet is sent to the next hop on the network.
(In some cases, the packet is sent back to the transparent redirection device that redirected the packet, if the packet arrived on a WCCP service using GRE.)
The proxy bypass list works by matching the IP addresses of the request to an IP address in the proxy bypass list. When names are entered in the bypass list, the Web Proxy must resolve them to an IP address using DNS. The Web Proxy DNS resolves hostnames differently than domain names:
•
•
Hostnames.
Hostnames are resolved to IP addresses using DNS queries immediately after they are entered into the proxy bypass list. (An example hostname is www.example.com.)
Domain names.
Domain names cannot be resolved to IP addresses using DNS queries, so the Web
Proxy uses DNS snooping using the T1 and T2 network interfaces. (An example domain name is example.com, and it matches both www.example.com and webmail.example.com.)
Because of these differences, if the proxy bypass list contains only IP addresses and hostnames, then the
Web Proxy can easily match the IP address in the request header to the IP addresses in the proxy bypass list.
However, for the proxy bypass list to work with domain names, you must connect both the T1 and T2 network interfaces (if using simplex mode) or just connect the T1 network interface (if using duplex mode) to the network even if you do not enable the L4 Traffic Monitor . However, the proxy bypass list only bypasses the Web Proxy scanning. It does not bypass the L4 Traffic Monitor.
Note If the transparent redirection device is a WCCP router, some are intelligent enough to not forward any other packets to the Web Proxy for the same session. In this case, the packets are not physically sent to the Web Proxy for the rest of the session and are truly bypassing it for the rest of the session.
6-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Bypassing Application Scanning
Using WCCP with the Proxy Bypass List
When the Web Security appliance is configured to use a WCCP v2 router, you must ensure that all WCCP services defined in the Web Security appliance use the same forwarding and return method (either L2 or
GRE) to work properly with the proxy bypass list. If the forwarding and return methods do not match, some WCCP enabled routers will act inconsistently.
For more information, see
Working with the Forwarding and Return Method, page 26-13 .
Bypassing Application Scanning
To bypass an application from Web Proxy scanning:
Step 1
Step 2
Navigate to the Web Security Manager > Bypass Settings page.
Click Edit Application Bypass Settings .
The Edit Application Scanning Bypass Settings page appears.
Figure 6-4 Application Scanning Bypass Settings Page
Step 3
Step 4
Enable Bypass Scanning for the application to bypass.
Submit and commit your changes.
Proxy Usage Agreement
You can configure the Web Security appliance to inform users that it is filtering and monitoring their web activity. The appliance does this by displaying an end-user acknowledgement page when a user first accesses a browser after a certain period of time. When the end-user acknowledgement page appears, users must click a link to access the original site requested or any other website. For more information about end-user acknowledgement pages, see
End-User Acknowledgement Page, page 17-12 .
Configuring Client Applications to Use the Web Proxy
Web browsers and other user agents sometimes need to know how to connect to the Web Proxy in order to access the World Wide Web. When you deploy the Web Security appliance in explicit forward mode, you must configure client applications so they use the Web Proxy. If you deploy the appliance in transparent mode, you can choose whether or not to configure client applications to explicitly use the
Web Proxy.
You can configure client applications to explicitly use the Web Proxy by using any of the following configuration methods:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-13
Chapter 6 Web Proxy Services
Working with PAC Files
• Manual.
Manual configuration involves typing the Web Security appliance hostname and port number, such as 3128, in each client application. If the appliance changes, you must edit each application individually. You might want to manually configure an application when you are testing proxy access on a single client machine. Cisco does not recommend manually configuring each client application to use the appliance Web Proxy.
• Proxy auto-config (PAC) file.
For web browsers, you can configure each browser to use a PAC file to find the Web Proxy. Then you can edit the PAC file to specify the appliance Web Proxy
information. For more information, see Working with PAC Files, page 6-14 .
For more information about how to configure client applications to use a proxy, see the client application documentation.
Working with PAC Files
A proxy auto-config (PAC) file is a text file that defines how web browsers can automatically choose the appropriate proxy server for fetching a given URL.
When you use a PAC file, you only need to configure each browser once with the PAC file information.
Then, you can edit the PAC file multiple times to add, delete, or change Web Proxy connection information without editing each browser. This way you can configure the proxy information about your network in a centralized location and update it easily.
Note Once a browser has read a PAC file, it stores it in memory for the remainder of the browser session.
You might want to use a PAC file for the following reasons:
• Centralized management.
You can manage the PAC file in a single, central location.
•
•
•
Complex network environment.
If the network of proxy servers is complicated, you can create a
PAC file to accommodate different server and client needs.
Changing network environment.
If your network environment is likely to change in the future, you can easily add, edit, or delete proxy servers in the PAC and have the changes automatically affect all browsers.
Failover.
If you have multiple proxy servers, you can provide redundancy in case of failure. You can either program the PAC file to be redundant, or if a failure occurs, change the PAC file to use a different proxy server.
Note Different browsers take different amounts of time to fail over to a secondary proxy. For example,
Internet Explorer takes about 25 seconds, and Firefox takes about 50 seconds.
• Load balancing.
If you have multiple proxy servers, you can use the PAC file to specify which requests go to which proxy server. For example, you might want users on one subnet to use a particular proxy and users on a different subnet to use a different proxy.
PAC File Format
The PAC file must include at least one JavaScript function, FindProxyForURL(url, host). The JavaScript function determines the appropriate proxy to use for each URL.
6-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Working with PAC Files
For example, if the Web Security appliance hostname is WSA.example.com, you could create a PAC file that includes the following text: function FindProxyForURL(url, host) { return “PROXY WSA.example.com:3128; DIRECT”; }
Note The port you specify in the FindProxyForURL() function should be a proxy port for the Web Security appliance configured on the Security Services > Web Proxy page.
However, you can make PAC files more complex. For example, you can create a PAC file that instructs the browser to connect directly to the website under certain conditions, such as matching on a particular hostname or IP address, and to use the proxy server in all other cases. You can create a PAC file that instructs applications to go directly to the website for servers on your intranet.
For more information about creating and using PAC files, see the following locations:
• http://en.wikipedia.org/wiki/Proxy_auto-config
• http://www.mozilla.org/catalog/end-user/customizing/enduserPAC.html
• http://wp.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html
Note Common convention is to use the .pac file extension for PAC file names.
Creating a PAC File for Remote Users
Some laptop users connect to the Internet both from inside your organization’s network and outside the network. For these users, you can create a PAC file that informs the browser to connect to the Web Proxy when they are on the network, and to connect directly to web servers when they are not on the network.
To do this, make sure the PAC file is hosted on a web server that is DNS resolvable inside the network, but not DNS resolvable outside the network. This works because when you enter a URL for the PAC file location, the browser will always try to use the PAC file in the configured location. If the browser cannot resolve the URL, such as when it is outside the network, it tries to access all web sites directly instead.
Then when the laptop connects to the network again, the browser can access the PAC file and will use the Web Proxy to access web sites.
Specifying the PAC File in Browsers
To use a PAC file, you must publish the PAC file in a location that can be accessed by each browser that needs to access it. When you configure a browser to use a PAC file, you can use either of the following methods:
•
•
Enter the PAC file location.
See
Entering the PAC File Location, page 6-16 .
Detect the PAC file location automatically.
See Detecting the PAC File Location Automatically, page 6-16
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-15
Chapter 6 Web Proxy Services
Working with PAC Files
Entering the PAC File Location
You can configure a browser to use a PAC file by specifying the exact location of the file. You might want to enter the exact PAC file location for laptop users who might need to use different proxy servers depending on their current location.
You can place the PAC file in the following locations:
•
•
Local machine.
You can place the PAC file on each client machine and configure the browsers to use it. You might want to use a local PAC file to test a PAC file before deploying it to the entire organization. Enter the path in the browser configuration. The path you enter depends on the browser type.
Web server.
You can place the PAC file on a web server that each client machine can access. For example, you can place the PAC file on an Apache or Microsoft IIS web server. Enter the URL in the browser configuration.
• Web Security appliance.
You can place the PAC file on the Web Security appliance. You might want to put the PAC file on the Web Security appliance to verify every client machine can access it within the network. Enter the URL in the browser configuration.
For more information about uploading PAC files to the Web Security appliance, see
Files to the Web Security Appliance, page 6-17 .
Detecting the PAC File Location Automatically
If a browser supports the Web Proxy Autodiscovery Protocol (WPAD), you can configure it to automatically detect the PAC file location. WPAD is a protocol that allows the browser determine the location of the PAC file using DHCP and DNS lookups.
Before fetching its first page, a web browser configured to automatically detect the PAC file location tries to find the PAC file using DHCP or DNS. Therefore, to use WPAD, you must set up either a DHCP server or a DNS server to direct web browser requests to the PAC file on a network server. However, not all browsers support DHCP to find the PAC file using WPAD.
This section includes some general guidelines for using WPAD with DNS “A” records. For more detailed information, or for information about using WPAD with DHCP, see the following locations:
•
• http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol http://www.wpad.com/draft-ietf-wrec-wpad-01.txt
• http://www.microsoft.com/technet/isa/2004/plan/automaticdiscovery.mspx
When you use WPAD with DNS, each domain on the network can only use one PAC file for all users on a domain because only domain name can uniquely identify a PAC file using DNS. For example, users on host1.accounting.example.com and host2.finance.example.com can use different PAC files.
To use WPAD with DNS:
Step 1
Step 2
Step 3
Rename the PAC file to wpad.dat.
Create an internally resolvable DNS name that starts with “wpad,” such as wpad.example.com.
Place wpad.dat in the root directory of the website that will host the file, such as wpad.example.com. For information about placing the file on the Web Security appliance, see
.
6-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Adding PAC Files to the Web Security Appliance
Step 4
Note Due to a bug in Internet Explorer 6, create a copy of wpad.dat and change the file name to wpad.da to work with Internet Explorer 6 users. For more information, see http://www.microsoft.com/technet/isa/2004/ts_wpad.mspx.
Configure the web server to set up .dat files with the following MIME type: application/x-ns-proxy-autoconfig
Note If you place wpad.dat on the Web Security appliance, the appliance does this for you already.
Adding PAC Files to the Web Security Appliance
You can configure browsers to explicitly use the Web Proxy by using proxy auto-config (PAC) files. You can place PAC files on the Web Security appliance, and then configure the browsers in one of two ways: enter the URL of a PAC file on the appliance, or set the browsers to automatically detect the PAC file by using the Web Proxy Autodiscovery Protocol (WPAD).
You can add multiple PAC files to the appliance. You might want to add multiple PAC files if the appliance is used by multiple domains on the network. You can use one PAC file for all browsers on a domain.
When you add a PAC file to the appliance, you can specify one or more ports the appliance uses to listen for PAC file requests. For information on specifying the PAC file URL when it is hosted on the Web
Security appliance, see
Specifying the PAC File URL, page 6-18 .
When a browser asks for a PAC file, the appliance sends the file using HTTP. The PAC file is returned using MIME type application/x-ns-proxy-autoconfig
.
Note When browsers are configured to use a PAC file on the appliance, the URL should include the PAC file name. If the URL does not specify the PAC file name, by default, the appliance uses default.pac if it exists and returns an error if it does not. Or, you can configure the default PAC file to use for different hostnames or domains on the network.
For more information about PAC files, see
Working with PAC Files, page 6-14
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-17
Chapter 6 Web Proxy Services
Adding PAC Files to the Web Security Appliance
Specifying the PAC File URL
When you configure a browser to use a PAC file, you can specify the exact location of the file using a
URL. When the PAC file is hosted on the Web Security appliance, you can specify the URL using any of the formats in
.
Table 6-3 PAC File URL Formats
PAC File URL Format Description http://hostname.domain:port/filename The PAC file filename is served if it exists; otherwise an error is returned.
http://hostname.domain:port/ http://hostname:port/filename http://hostname:port/
This assumes port is a configured port on the appliance, and that hostname is the hostname of the appliance network interface configured for PAC file hosting.
The PAC file default.pac is served if it exists; otherwise an error is returned.
This assumes port is a configured port on the appliance, and that hostname is the hostname of the appliance network interface configured for PAC file hosting.
The PAC file filename is served if it exists; otherwise an error is returned.
This assumes port is a configured port on the appliance, and that hostname is the hostname of the appliance network interface configured for PAC file hosting.
The PAC file “default.pac” is served if it exists; otherwise an error is returned.
http://IPAddress:port/filename
This assumes port is a configured port on the appliance, and that hostname is the hostname of the appliance network interface configured for PAC file hosting.
The PAC file filename is served if it exists; otherwise an error is returned.
http://IPAddress:port/
This assumes port is a configured port on the appliance, and that IPAddress is the IP address of the appliance network interface configured for PAC file hosting.
The PAC file “default.pac” is served if it exists; otherwise an error is returned.
This assumes port is a configured port on the appliance, and that IPAddress is the IP address of the appliance network interface configured for PAC file hosting.
http://ConfiguredHostname/filename The PAC file filename is served if it is configured on the appliance and exists; otherwise an error is returned.
This assumes that ConfiguredHostname is a hostname entered in the Hostname field on the Security Services > Proxy
Auto-Configuration File Hosting page.
6-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Adding PAC Files to the Web Security Appliance
Table 6-3 PAC File URL Formats
PAC File URL Format http://ConfiguredHostname/ http://IPAddress/filename http://IPAddress/
Description
The configured default PAC file name for
ConfiguredHostname is served if the hostname is configured on the Security Services > Proxy Auto-Configuration File
Hosting page. If the hostname is not configured, an error is returned.
The PAC file filename is served if it is configured on the appliance and exists; otherwise an error is returned.
This assumes that IPAddress is an IP address entered in the
Hostname field on the Security Services > Proxy
Auto-Configuration File Hosting page. If the IP address is not configured, an error is returned.
The configured default PAC file name for IPAddress is served if the IP address is a configured hostname on the Security
Services > Proxy Auto-Configuration File Hosting page. If the IP address is not configured, an error is returned.
Uploading PAC Files to the Appliance
To store PAC files on the Web Security appliance:
Step 1 Navigate to Security Services > Proxy Auto-Configuration File Hosting page, and click Enable and
Edit Settings .
The Edit Proxy Auto-Configuration File Hosting Settings page appears.
Figure 6-5 Editing the PAC File Host Settings
Step 2 In the PAC Server Ports field, enter one or more port numbers the Web Security appliance should use to listen for PAC file requests.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-19
Chapter 6 Web Proxy Services
Adding PAC Files to the Web Security Appliance
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
In the Interface field, select the interface the Web Proxy uses to listen for PAC file requests. You can choose any interface that is configured for data traffic. This field only appears when multiple interfaces are configured for data traffic.
In the PAC File Expiration section, choose whether to allow the PAC file to expire after a specified number of minutes in the browser’s cache.
Click Browse to upload a PAC file from your local machine to the appliance.
Navigate to the PAC file location, select it, and click Open .
To add another PAC file, click Add Row , and repeat steps
.
Optionally, PAC files can be served through HTTP proxy ports, such as port 80. To allow this, you must explicitly configure the hostnames that should serve PAC files and choose a default PAC file for each hostname. The specified default PAC file name is served when browsers do not include the PAC file name when requesting the PAC file URL (“GET/” requests). Otherwise, the PAC file name specified in the
URL is served. If a PAC file URL uses an IP address, you can enter the IP address as a configured hostname.
To configure a default PAC file name for different hostnames, in the Hostnames field enter the Web
Security appliance hostname or IP address, or any hostname that resolves to the appliance hostname.
Then choose the default PAC file name in the Default PAC File for “Get/” Request through Proxy Port field.
For example, if you enter wsa.example.com
in the Hostnames field and pacfile1.pac
in the Default PAC
File for “Get/” Request through Proxy Port field, then requests for http://wsa.example.com/ fetch pacfile1.pac
and requests for http://wsa.example.com/default.pac fetch default.pac
.
Optionally, repeat step
8 to configure a default PAC file name for all hostnames that resolve to the Web
Security appliance.
Submit and commit your changes.
Understanding WPAD Compatibility with Netscape and Firefox
Netscape and Firefox browsers only use DNS to automatically detect PAC files using WPAD. Therefore, if you want Netscape and Firefox browsers to automatically detect a PAC file stored on the Web Security appliance, you must complete the following steps:
1.
2.
Name the PAC file wpad.dat.
Navigate to the Security Services > Web Proxy page, and delete port 80 from the HTTP Ports to
Proxy field.
3.
Use port 80 as the PAC Server Port when you upload the file to the appliance.
For more information about using WPAD, see
Detecting the PAC File Location Automatically, page 6-16 .
Note These steps also work with Internet Explorer. However, for Internet Explorer version 6, create a copy of wpad.dat and name it wpad.da.
6-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Advanced Proxy Configuration
AsyncOS includes the advancedproxyconfig CLI command so you can configure more advanced Web
Proxy configurations, such as authentication and DNS parameters.
The advancedproxyconfig
command includes the following subcommands:
• Authentication.
Configure authentication parameters, such as the number of outstanding concurrent
Basic or NTLMSSP authentication requests to be authenticated by the authentication server and whether or not to log the username that appears in the request URI. You can also use the authentication subcommand to enable the user acknowledgment page. For more information about the user acknowledgment page, see
Proxy Usage Agreement, page 6-13
.
For more information, see
Authentication Options, page 6-22
.
• Caching.
Configure advanced Web Proxy caching options, such as:
– Whether or not to ignore client requests to not retrieve content from the proxy cache
– Whether or not to cache content from an untrusted server
You can configure the parameters separately by selecting “Customized Mode,” or you can choose a predefined set of parameter values. You can choose the following modes:
–
–
Safe mode.
This mode uses less caching. You might want to use safe mode if clients are encountering web servers sending error responses with Last-Modified headers (so they get cached), and these are transient whereby you do not want to cache the error responses. Or, you might want to use safe mode if some web servers are not responding properly to
If-Modified-Since queries, and caching objects when no cache lifetime is specified is causing incorrect cache hits.
Optimized mode.
This mode uses moderate caching. This is the default mode. Compared to safe mode, in optimized mode the Web Proxy caches objects when no caching time is specified when a Last-Modified header is present. The Web Proxy caches negative responses.
•
•
•
–
–
Aggressive mode.
This mode uses aggressive caching. Compared to optimized mode, in aggressive mode the Web Proxy caches authenticated content, ETag mismatches, and content without a Last-Modified header. The Web Proxy ignores the no-cache parameter.
Customized mode.
This mode allows you to configure each parameter individually.
Safe mode provides more strict adherence to the RFC with respect to caching. Optimized and aggressive modes take some liberties with respect to RFC compliance in exchange for more caching of data (where aggressive modes takes more liberties than optimized mode).
For more information, see
DNS.
Configure DNS-related options, such as the time to cache results of DNS errors and whether or not the Web Proxy should issue an HTTP 302 redirection on DNS lookup failure.
For more information, see
EUN.
Configure the end-user notification page settings, such as whether to use the standard IronPort end-user notification pages or use pages you customize. For more information on configuring the end-user notification pages, see
Working with FTP Notification Messages, page 17-17 .
For more information, see
NATIVEFTP.
Configure the FTP Proxy settings, such as the port ranges to use for active and passive mode and the type of authentication to use for explicit forward connections. Applies to native FTP transactions only. For more information on configuring the FTP Proxy, see
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-21
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
•
•
•
For more information, see
.
FTPOVERHTTP.
Configure the login name and password to use for anonymous FTP access and whether or not to allow active mode for FTP transfers. Applies to FTP over HTTP transactions only.
For more information, see
FTPOVERHTTP Options, page 6-34 .
HTTPS.
Configure the logging style for URIs used in HTTPS transactions. You can choose to record the full URI (“fulluri”) or just a portion of the URI with the query portion removed
(“stripquery”).
For more information, see
Scanning.
Configure how the DVS engine handles anti-malware scanning of web transactions.
For more information, see
.
• Miscellaneous.
Configure whether or not the Web Proxy should respond to health checks from
Layer 4 switches and whether or not the Web Proxy should perform dynamic adjustment of TCP receive window sizes.
For more information, see
Miscellaneous Options, page 6-35 .
Each submenu command is discussed in the detail tables below. For the Default Value column, a string means a name or list of characters such as “hello world.”
Authentication Options
Table 6-4 describes the authentication options for the
advancedproxyconfig
CLI command.
Table 6-4 advancedproxyconfig CLI Command—Authentication Options
Option
When would you like to forward authorization request headers to a parent proxy?
Enter the Proxy
Authorization Realm to be displayed in the end user authentication dialog
Would you like to log the username that appears in the request URI?
Valid
Values
Never,
Always,
Only if not used by the WSA
Never
String
Default
Value
Yes, No
(Boolean)
“Cisco
IronPort
Web
Security
Appliance”
No No
Web Proxy
Must Restart Description
Yes This setting determines whether the Web Proxy includes the
“Proxy-Authorization” header to upstream servers, including proxies.
No Proxy Authorization Realm displayed in the End User
Authentication dialog.
If enabled, ‘<username>:xxxxx’ is logged i.e the username is displayed and the password is represented as a string, ‘xxxxx’.
If disabled, both username and password are stripped. Note that the actual password is never displayed regardless of the value of this variable.
6-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-4
Option advancedproxyconfig CLI Command—Authentication Options (continued)
Should the Group
Membership attribute be used for directory lookups in the Web UI
(when it is not used, empty groups and groups with different membership attributes will be displayed)?
Would you like to use advanced Active
Directory connectivity checks?
Would you like to allow case insensitive username matching in policies?
Valid
Values
Yes, No
(Boolean)
Yes, No
(Boolean)
Yes, No
(Boolean)
Would you like to allow wild card matching with the character * for LDAP group names?
Yes, No
(Boolean)
Default
Value
No
No
Yes
Yes
Web Proxy
Must Restart Description
No Choose whether or not AsyncOS should use the group membership attribute when doing a directory lookup.
No
Yes
Yes
If you do not want to display empty authentication groups and fetch groups whose group membership attribute is different, choose Yes.
Choose whether or not the Web
Proxy should automatically restart the internal authentication process that communicates with
Active Directory servers when it becomes unresponsive, but is still running.
Choose whether or not the Web
Proxy should ignore case when matching user names against the policy groups.
Choose whether or not to match an asterisk as a wildcard in LDAP group filters.
When this option is disabled, using an asterisk (*) in the group filters for LDAP servers works as a literal string.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-23
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-4 advancedproxyconfig CLI Command—Authentication Options (continued)
Option
Enter the charset to be used for basic authentication
[ISO-8859-1/UTF-8].
Would you like to enable referrals for LDAP?
Would you like to enable secure authentication?
Valid
Values
ISO-8859-
1, UTF-8
Default
Value
ISO-8859-
1
Yes, No
(Boolean)
Yes, No
(Boolean)
No
No
Web Proxy
Must Restart Description
No Choose the character encoding that the Web Proxy should use when reading the Basic authentication credentials in the
HTTP request. The setting configured here does not affect the request content, only the
Basic authentication credentials.
Yes
You might want to use
ISO-8859-1 if most web browsers used on your network are Internet
Explorer, Firefox, and Safari, and
UTF-8 if most web browsers on your network are Opera and
Chrome.
Note: The Web Proxy always uses
UTF-8 when sending the Basic authentication credentials to the authentication server.
Choose whether or not the Web
Proxy should perform LDAP queries on a referred LDAP server.
Yes/No
(Web Proxy restarts when it needs to listens on fewer or additional ports)
You might want to disable this option if a referred LDAP server is unavailable to the Web Security appliance.
Choose whether or not the Web
Proxy redirects clients to securely pass authentication credentials to the Web Proxy using HTTPS.
For more information on this feature, see
6-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-4
Option
Enter the redirect port for secure authentication.
Enter the hostname to redirect clients for authentication.
Enter the surrogate timeout for user credentials.
advancedproxyconfig CLI Command—Authentication Options (continued)
Valid
Values
String
Time in seconds
Default
Value
1 to 65535 443
Appliance hostname
3600
Web Proxy
Must Restart Description
Yes/No
(Web Proxy restarts when it needs to listens on fewer or additional ports)
Enter the port to use for redirecting requests using
HTTPS. Cisco recommends using a port greater than 1023.
For more information on configuring this option, see
Authentication Settings, page 21-17
.
No
Note: This option only appears when you enable secure authentication.
Enter the short hostname of the network interface on which the
Web Proxy listens for incoming connections.
No
When you enable secure authentication, the Web Proxy uses this hostname in the redirection URL sent to clients for authenticating users.
For more information on configuring this option, see
Authentication Settings, page 21-17
.
This setting specifies how long the surrogate (IP address or cookie) can be used for user credentials before requiring authentication credentials again.
For more information on configuring this option, see
Authentication Settings, page 21-17
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-25
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-4
Option credentials.
advancedproxyconfig CLI Command—Authentication Options (continued)
Enter the surrogate timeout for machine
Enter re-auth on request denied option [disabled / embedlinkinblockpage]?
Valid
Values
Time in seconds disabled/ embedlink inblockpa ge
Default
Value
10 disabled
Web Proxy
Must Restart
No
No
Description
This setting specifies how long the IP address surrogate used for machine credentials (instead of user credentials) can be used before requiring authentication.
You might want to configure this value if the network contains users on Windows 7 or Windows
Vista machines that use the
Network Connectivity Status
Indicator (NCSI) feature.
For more information, see
.
This setting allows users to authenticate again if the user is blocked from a website due to a restrictive URL filtering policy.
The user sees a block page that includes a link that allows them to enter new authentication credentials. If the user enters credentials that allow greater access, the requested page appears in the browser.
Note: This setting only applies to authenticated users who are blocked due to restrictive URL filtering policies. It does not apply to blocked transactions by subnet with no authentication.
For more information, see
6-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-4
Option logs and reports: advancedproxyconfig CLI Command—Authentication Options (continued)
Would you like to send
Negotiate header along with NTLM header for
NTLMSSP authentication:
Configure username and
IP address masking in
Valid
Values
1, 2
1, 2, 3
Default
Value
1
3
Web Proxy
Must Restart
No
No
Description
Choose whether or not the Web
Proxy sends “Negotiate” as an acceptable authentication protocol when establishing the
NTLM handshake with the Active
Directory server. Choose one of the following values:
1. Do not send Negotiate header
2. Send Negotiate header
Choose whether or not to mask user names and/or IP addresses in lots and reports. Masked user names appear as
“AUTHENTICATED_USER” in the logs, but guest user names are not masked.
Choose one of the following options:
1. Mask both user names and IP addresses in logs and reports
2. Mask only usernames and replace them with IP addresses in logs and reports
3. Show usernames and IP addresses in logs and reports
Caching Options
The Caching submenu provides four options to set the advanced caching mode.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-27
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-5 describes the caching options for the Customized Mode option in the
advancedproxyconfig
CLI command.
Table 6-5 advancedproxyconfig CLI Command—Caching Options
Option
Would you like to allow objects with a heuristic expiration time to be served as not-modified
If-Modified-Since hits from cache?
Would you like to allow
ETAG mismatch on client revalidations?
Valid
Values
Yes, No
(Boolean)
Yes, No
(Boolean)
No
Default
Value
Yes
Web Proxy
Must Restart Description
No 0 = favor freshness on IMS to objects with heuristic expiration time
1 = favor bandwidth conservation
No
No Yes
In some cases, the server might report different ETags for the same version of the same file. This can be seen, for example, with clustered IIS servers. In these cases, requiring both a last modified time (LMT) match and an ETag match on client revalidations would lead to a lot of misses, so it should be sufficient just to match the LMT if it is given.
Note: Setting this to 1 is not
HTTP-compliant.
Allow caching for requests authenticated by origin server.
Would you like to allow caching when requests are authenticated by the origin server?
Would you like to allow caching from servers whose DNS results do not match the TCP destination
IP (not trust-worthy and applicable only in transparent modes)?
Enter the Heuristic maximum age to cache the document with
Last-Modified Time but no actual caching value (in seconds):
Yes, No
(Boolean)
Yes, No
(Boolean)
Time in seconds
Enter the Heuristic maximum age to cache the document without
Last-Modified Time and no actual caching value (in seconds):
Time in seconds
No
86400
0
Yes
No
No
Allow caching from servers whose
DNS results do not match the TCP destination IP.
Heuristic maximum age to cache the document with LMT but no actual caching value.
Heuristic maximum age to cache the document without LMT and no actual caching value.
6-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-5 advancedproxyconfig CLI Command—Caching Options (continued)
Option
Enter the Heuristic age to cache errors
(HTTP_SERVICE_UNAV
AIL,
HTTP_GATEWAY_TIME
OUT etc) (in seconds):
Would you like proxy to ignore client directive to not fetch content from the cache?
Enter the time interval during which reload requests must be ignored by the proxy (in seconds):
Valid
Values
Time in seconds
Yes, No
(Boolean)
Time in seconds
No
0
Would you like to allow proxy to convert reload requests into max-age requests?
Time in seconds after which an explicit IMS
Refresh request must be issued:
Yes, No
(Boolean)
Time in seconds
Default
Value
300
Web Proxy
Must Restart Description
No Heuristic age to cache errors
(HTTP_SERVICE_UNAVAIL,
HTTP_GATEWAY_TIMEOUT etc).
No
300
No
No
No
No
Disable/Enable ignoring of the client directive to not fetch content from the cache. Enabling this is not
HTTP compliant.
Disable/Enable reload requests to be ignored for the specified time interval.
This allows reload requests to be ignored for a certain amount of time, even though it is not
HTTP-compliant.
You might want to enter a value greater than zero to improve bandwidth usage.
Allow reload requests to be converted into max-age requests
(not HTTP-compliant, but may improve bandwidth usage). This gets its max-age value from
“ignoreReloadTime.”
Time in seconds after which an explicit IMS Refresh request must be issued.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-29
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
DNS Options
Table 6-6 describes the DNS options for the
advancedproxyconfig CLI command.
Table 6-6 advancedproxyconfig CLI Command—DNS Options
Option
Enter the URL format for the HTTP 307 redirection on DNS lookup failure:
Valid
Values
String with EUN page variables
Default
Value
%P//www
.%H.com/
%u
Web Proxy
Must Restart Description
No URL format for the HTTP 307 redirection on DNS lookup
End-User Notification Pages,' on page 6 for the list of valid
variables.
Yes Disable/Enable automatic HTTP
307 redirection on DNS lookup failure.
Would you like the proxy to issue a HTTP 307 redirection on DNS lookup failure?
Yes, No
(Boolean)
Would you like proxy not to automatically failover to
DNS results when upstream proxy (peer) is unresponsive?
Find web server by:
Yes, No
(Boolean)
0, 1, 2, 3
Yes
No
1
Yes
Yes
Disable/Enable automatic failover to DNS results when upstream proxy (peer) is unresponsive.
Specify how the appliance should find the location of the requested web server.
• 0 = use DNS answers in order
•
•
•
1 = use client supplied address then DNS
2 = use ONLY client supplied address
3 = use client supplied address for next hop connection and Web
Reputation (Warning:
Destination IP based policies will still use DNS).
6-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
EUN Options
describes the EUN options for the advancedproxyconfig CLI command.
Table 6-7 advancedproxyconfig CLI Command—EUN Options
Option
Choose:
Valid
Values
1, 2, 3
Default
Value
3
Web Proxy
Must Restart
Yes
No
Description
Choose whether to use the
IronPort end-user notification pages or uploaded customized end-user notification pages.
Choose one of the following options:
• 1. Refresh EUN pages
•
•
2. Use Custom EUN pages
3. Use Standard EUN pages
For more information, see
Enable or disable
Acknowledgement page.
Would you like to turn on presentation of the
User
Acknowledgement page?
Enter the method to be used for tracking User
Acknowledgements
(“ip” or “session”).
Yes, No
(Boolean)
No ip, session ip No
Action to be taken for
HTTPS requests with
Session based EUA
(“bypass” or “drop”).
bypass, drop bypass Yes
This setting specifies the way that the Web Proxy tracks users, either by IP address or using a web session cookie, after the user clicked the link on the end-user acknowledgement page.
For more information on configuring this option, see
Choose whether to bypass (pass through) or drop HTTPS requests when the end-user acknowledgement page is enabled and tracks users using session cookies. For more information,
Acknowledgement Page, page 17-14
.
This option only appears if you select Session Cookie for the User
Acknowledgements tracking method.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-31
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-7
Option advancedproxyconfig CLI Command—EUN Options (continued)
Enter maximum time to remember User
Acknowledgement (in seconds):
Valid
Values
30 -
2678400
Enter maximum idle timeout for User
Acknowledgement based on IP Address (in seconds):
30 -
2678400
Default
Value
86400
14400
Web Proxy
Must Restart
No
No
Description
Maximum time to remember User
Acknowledgement. From 30 seconds to one month (2678400).
Maximum idle timeout for User
Acknowledgement based on IP
Address. From 30 seconds to one month (2678400).
NATIVEFTP Options
Table 6-8 describes the NATIVEFTP options for the
advancedproxyconfig
CLI command.
Table 6-8 advancedproxyconfig CLI Command—NATIVEFTP Options
Option
Would you like to enable FTP proxy?
Enter the ports that
FTP proxy listens on.
Valid
Values
Yes, No
Default
Value
Yes
(Boolean)
1 to 65535 8021
Enter the range of port numbers for the proxy to listen on for passive
FTP connections.
port1-port2
(string)
Enter the range of port numbers for the proxy to listen on for active
FTP connections.
1024 -
65535 port1-port2
(string)
1024 -
65535
11000-
11009
12000-
12099
Enter the authentication format:
Check
Point,
Raptor
Would you like to enable caching?
Yes, No
(Boolean)
Check Point Yes
Yes
Web Proxy
Must Restart Description
Yes Choose whether or not to enable the FTP Proxy.
Yes
Yes
Specify the port FTP clients should use to establish a control connection with the FTP Proxy.
Specify a range of TCP ports FTP clients should use to establish a data connection with the FTP
Proxy for passive mode connections.
Yes
Yes
Specify a range of TCP ports FTP servers should use to establish a data connection with the FTP
Proxy for active mode connections. This setting applies to both native FTP and FTP over
HTTP connections.
Choose the authentication format the FTP Proxy uses when communicating with FTP clients.
For more information, see
Authentication with Native FTP, page 6-7
.
Choose whether or not to cache contents of data connections from anonymous users.
6-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-8 directory: advancedproxyconfig CLI Command—NATIVEFTP Options (continued)
Option
Would you like to enable server IP spoofing?
Would you like to pass
FTP server welcome message to the clients?
Enter the customized server welcome message.
Enter the max path size for the ftp server
Valid
Values
Yes, No
(Boolean)
Yes, No
(Boolean)
String
Integer
Default
Value
No
Yes
N/A
1024
Web Proxy
Must Restart
Yes
Yes
Yes
No
Description
Choose whether or not the FTP
Proxy should spoof the FTP server
IP address. You might want to do this for FTP clients that do not allow transactions when the IP address is different for the control and data connections.
Choose which welcome message should appear in FTP clients:
• FTP server message.
Enter
“Yes.” The FTP server message only displays for transparently redirected connections. When a native
FTP connection is explicitly sent to the FTP Proxy, the FTP client displays a message predefined by the FTP Proxy.
• Custom message.
Enter
“No.” You can enter a custom message to display for all native FTP connections in the next question.
This command appears when you enter No for the FTP server welcome message.
Enter the custom message to display for all native FTP connections.
Enter the maximum length FTP clients can use for directory paths on the FTP server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-33
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
FTPOVERHTTP Options
Table 6-9 describes the FTPOVERHTTP options for the
advancedproxyconfig CLI command.
Table 6-9 advancedproxyconfig CLI Command—FTPOVERHTTP Options
Option
Enter the login name to be used for anonymous FTP access:
Enter the password to be used for anonymous FTP access:
Valid
Values
String
String
Default
Value
Web Proxy
Must Restart anonymous No
Description
Anonymous FTP login name.
proxy@ No Anonymous FTP login password.
HTTPS Options
Table 6-10 describes the HTTPS options for the
advancedproxyconfig
CLI command.
Table 6-10 advancedproxyconfig CLI Command—HTTPS Options
Option
HTTPS URI Logging
Style:
Valid
Values fulluri or stripquery
Would you like to decrypt unauthenticated transparent HTTPS requests for authentication purpose?
Action to be taken when HTTPS servers ask for client certificate during handshake:
Yes, No
(Boolean)
1, 2
Default
Value
Web Proxy
Must Restart fulluri Yes
Description
You can log the entire URI (fulluri), or a partial form of the URI with the query portion removed (stripquery).
However, even when you choose to strip the query from the URI, personally identifiable information may still remain.
Yes No Choose how the Web Proxy handles transparently redirected HTTPS transactions it receives before an HTTP request that was authenticated using an identity with an IP-based surrogate.
Select one of the following options:
• Yes.
Decrypt the HTTPS request for authentication purposes.
2 Yes
•
•
No.
Deny the HTTPS request.
Choose how the HTTPS Proxy responds to an HTTPS server when it asks for a client certificate during the
SSL handshake:
1. Pass through the transaction
•
Note
2. Reply with certificate unavailable
You can read the Proxy Logs to learn when an HTTPS server requested a client certificate.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-34
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Scanning Options
describes the scanning options for the advancedproxyconfig CLI command. The scanning options can be edited only when Adaptive Scanning is disabled.
Table 6-11 advancedproxyconfig CLI Command—Scanning Options
Option
Would you like the proxy to do malware scanning all content regardless of content type? Note that this will have serious performance impact and is not recommended.
Valid
Values
Yes, No
(Boolean)
Default
Value
No
Web Proxy
Must Restart Description
No Choose whether or not the DVS engine should scan all response content regardless of the content type.
Note Enabling this setting results in a significant performance impact for the Web Proxy.
Miscellaneous Options
describes the miscellaneous options for the advancedproxyconfig
CLI command.
Table 6-12 advancedproxyconfig CLI Command—Miscellaneous Options
Option
Would you like proxy to respond to health checks from Layer 4 switches
(always enabled if WSA is in L4 transparent mode)?
Valid
Values
Yes, No
(Boolean)
Default
Value
No
Yes
Web Proxy
Must Restart Description
Yes Disable/Enable support for responding to health checks from
Layer 4 switches (always enabled if
WSA is in L4 transparent mode).
Layer 4 switches issue ‘HEAD /
HTTP/1.0’ requests directed at the proxy to ensure that it is responding.
Yes Disable/Enable dynamic adjustment of TCP receive window size.
Would you like proxy to perform dynamic adjustment of TCP receive window size?
Enable caching of
HTTPS responses?
Yes, No
(Boolean)
Yes, No
(Boolean)
No No
Enter minimum idle timeout for checking unresponsive upstream proxy (in seconds).
Enter maximum idle timeout for checking unresponsive upstream proxy (in seconds).
Time in seconds
Time in seconds
10
86400
No
No
Choose whether or not the Web
Security appliance should store
HTTPS responses in the web cache.
The minimum amount of time the
Web Proxy waits before checking if an upstream proxy is still unavailable.
The maximum amount of time the
Web Proxy waits before checking if an upstream proxy is still unavailable.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-35
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-12 advancedproxyconfig CLI Command—Miscellaneous Options (continued)
Option
Mode of the proxy:
Spoofing of the client IP by the proxy:
Valid
Values
1, 2, 3
1, 2, 3
Do you want to pass
HTTP X-Forwarded-For headers?
Yes, No
(Boolean)
Default
Value
Web Proxy
Must Restart Description
2 Yes Choose how to deploy the Web Proxy using one of the following options:
•
•
1. Explicit forward mode only
2. Transparent mode with L4
Switch or no device for redirection
1
Yes
No
No
• 3. Transparent mode with
WCCP v2 Router for redirection
For more information, see
Deployment Overview, page 3-1 .
Choose whether or not the Web
Proxy should spoof IP addresses when sending requests to upstream proxies and servers using one of the following options:
•
•
1. Disable
2. Enable for all requests
• 3. Enable for transparent requests only
When IP spoofing is enabled, requests originating from a client retain the client’s source address and appear to originate from the client rather than from the Web Security appliance.
Note When IP spoofing is enabled and the appliance is connected to a WCCP router, configure a WCCP service to redirect the return path.
Choose whether or not the Web
Proxy retains any
“X-Forwarded-For” header included in the requests it receives.
When set to No, the Web Proxy removes any “X-Forwarded-For” header from requests that enter the
Web Proxy from a downstream proxy server. You might want to do this if the downstream proxy server includes client IP address in the header and you do not want to expose those IP addresses to servers outside your network.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-36
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-12 advancedproxyconfig CLI Command—Miscellaneous Options (continued)
Option
Would you like to permit tunneling of non-http requests on http ports?
Valid
Values
Yes, No
(Boolean)
Would you like to block tunneling of non-SSL transactions on SSL
Ports?
Would you like proxy to log values from
X-Forwarded-For headers in place of incoming connection IP addresses?
Yes, No
(Boolean)
Yes, No
(Boolean)
Default
Value
Yes
Web Proxy
Must Restart Description
No Choose whether or not to allow non-HTTP traffic on ports the Web
Proxy is configured to monitor, such as port 80. This option applies when the Web Proxy is in transparent mode.
No
No
No
No
Enabling this option blocks applications that attempt to tunnel non-HTTP traffic on ports typically used for HTTP traffic.
Note When a transaction is blocked due to this setting, the ACL decision tag for the transaction is logged as
BLOCK_ADMIN_TUNNEL
ING.
Choose whether or not the Web
Proxy should block non-SSL traffic on SSL ports.
By default (when this feature is disabled), when a client seeks to connect to server on a configured
SSL port and the SSL handshake with the server fails, the Web Proxy tunnels the transaction.
Choose whether or not the access logs should include the
X-Forwarded-For header value instead of the IP address of the incoming connection.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
6-37
Chapter 6 Web Proxy Services
Advanced Proxy Configuration
Table 6-12 advancedproxyconfig CLI Command—Miscellaneous Options (continued)
Option
Do you want proxy to throttle content served from cache?
Valid
Values
Yes, No
(Boolean)
Would you like the proxy to use client IP addresses from X-Forwarded-For headers?
Yes, No
(Boolean)
Default
Value
Web Proxy
Must Restart Description
Yes No
No No
Choose whether or not the Web
Proxy should apply per user bandwidth controls to content served from the web cache in addition to the content served from web servers.
Applies to application types that have bandwidth limits applied.
Choose whether or not the Web
Proxy should accept a client IP address in the X-Forwarded-For header from a trusted downstream proxy or load balancer.
If you choose “Yes,” enter the IP addresses of the downstream proxies or load balancers that the Web Proxy will trust. The Web Proxy will not accept the IP address in a
X-Forwarded-For header from a machine that is not included in the list. Separate multiple IP addresses with commas. You cannot enter subnets or hostnames.
Note You can display the downstream IP address in the access logs using the %XV custom format specifier, and in the W3C access logs using the x-request-source-ip variable.
6-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
7
Cloud Web Security Connector
This chapter contains the following information:
•
Overview of the Cloud Connector, page 7-1
•
•
•
•
•
•
•
•
•
•
Configuring the Cloud Connector, page 7-5
Directory Group Policies in the Cloud, page 7-8
Bypassing the Cloud Proxy Server, page 7-9
Preventing Loss of Secure Data, page 7-10
Cloud Connector Logs, page 7-10
Identities and User Authentication, page 7-11
Configuration Modes, page 7-11
Overview of the Cloud Connector
In Cloud Web Security Connector mode, the appliance connects to and directs traffic to a Cisco Cloud
Web Security tower, where web security policies are enforced. The standard mode of the Web Security
Appliance includes on-site web proxy services and the Layer 4 Traffic Monitor; these services are not available in Cloud Web Security Connector mode.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-1
Chapter 7 Cloud Web Security Connector
Overview of the Cloud Connector
Cloud Connector versus Standard Mode
The Web Security Appliance in Cloud Web Security Connector mode includes a subset of the features available in standard mode. Use of the features included in the Cloud Connector subset is the same in both modes.
Menu
Reporting
Web Security Manager
Available in Cloud Connector Mode
System Status
Identities
Cloud Routing Policies
External Data Loss Prevention
Custom URL Categories
Available in Standard Mode
System Status
Overview
Users
Web Sites
URL Categories
Application Visibility
Anti-Malware
Client Malware Risk
Web Reputation Filters
L4 Traffic Monitor
Reports by User Location
Web Tracking
System Capacity
Scheduled Reports
Archived Reports
Identities
Cloud Routing Policies
External Data Loss Prevention
Custom URL Categories
SaaS Policies
Decryption Policies
Routing Policies
Access Policies
Overall Bandwidth Limits
Cisco IronPort Data Security
Outbound Malware Scanning
Defined Time Ranges
Bypass Settings
L4 Traffic Monitor
7-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 7 Cloud Web Security Connector
Menu
Security Services
Overview of the Cloud Connector
Available in Cloud Connector Mode Available in Standard Mode
Web Proxy Web Proxy
FTP Proxy
HTTPS Proxy
PAC File Hosting
Identity Provider for SaaS
Acceptable Use Controls
Web Reputation and Anti Malware
Data Transfer Filters
AnyConnect Secure Mobility
End-User Notification
L4 Traffic Monitor
SensorBase
Reporting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-3
Documentation
Chapter 7 Cloud Web Security Connector
Menu
Network
System Administration
Available in Cloud Connector Mode Available in Standard Mode
Interfaces
Transparent Redirection
Interfaces
Transparent Redirection
Routes
DNS
Internal SMTP Relay
Authentication
External DLP Servers
Cloud Connector
Users
Routes
DNS
Internal SMTP Relay
Authentication
External DLP Servers
Upstream Proxy
Users
Alerts
Log Subscriptions
Network Access
Time Zone
Time Settings
Configuration Summary
Configuration File
Feature Keys
Upgrade and Update Settings
System Upgrade
System Setup Wizard
Alerts
Log Subscriptions
Network Access
Time Zone
Time Settings
Configuration Summary
Configuration File
Feature Keys
Upgrade and Update Settings
System Upgrade
System Setup Wizard
Policy Trace
Return Addresses
Feature Keys Settings
Next Steps
Documentation
This chapter links to locations within this User Guide that provide information about some of the major features of the Web Security Appliance that are common to both standard mode and Cloud Web Security
Connector mode. With the exception of Cloud Connector configuration settings and information about sending directory groups to the cloud, relevant information is in other locations throughout this User
Guide.
This chapter includes information about configuring the Cloud Web Security Connector that is not applicable in standard mode.
This User Guide does not include information about the Cisco Cloud Web Security product. Cisco Cloud
Web Security documentation is available on Cisco.com.
Related topics
• http://www.cisco.com/en/US/products/ps11720/tsd_products_support_series_home.html
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-4
Chapter 7 Cloud Web Security Connector
Deployment
Deployment
Deployment of the appliance is the same in both standard and Cloud Security mode except that on-site web proxy services and Layer 4 Traffic Monitor services are not available in Cloud Web Security
Connector mode.
You can deploy the Cloud Web Security Connector in either explicit forward mode or in transparent mode.
Related topics
•
Configuring the Cloud Connector
Step 1. Access the Web Interface for the Web Security Appliance
Step 1 Enter the IP address of the Web Security appliance in an internet browser.
The first time you run the System Setup Wizard, use the default IP address: https://192.168.42.42:8443
-orhttp://192.168.42.42:8080 where
192.168.42.42 is the default IP address, and
8080 is the default admin port setting for HTTP, and
8443
is default admin port for HTTPS.
Step 2. Accept the License Agreement and Begin Setup.
Step 1
Step 2
Step 3
Navigate to System Administration>System Setup Wizard .
Accept the terms of the license agreement.
Click Begin Setup .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-5
Chapter 7 Cloud Web Security Connector
Configuring the Cloud Connector
Step 3. Configure System Settings:
Setting
Default System Hostname
DNS Server(s)
NTP Server
Time Zone
Description
The fully-qualified hostname for the Web Security appliance.
The Internet root DNS servers for domain name service lookups.
A server with which to synchronize the system clock. The default is time.ironport.com.
Sets the time zone on the appliance so that timestamps in message headers and log files are correct.
Related topics
•
Configuring DNS Server(s), page 26-18
Step 4. Set the Appliance Mode
Step 1 Select Cloud Web Security Connector.
Step 5. Configure Cloud Connector Settings
Setting
Cloud Web Security Proxy Servers
Description
The address of the Cloud Proxy Server
(CPS), for example, proxy1743.scansafe.net.
Failure Handling If AsyncOS fails to connect to a Cloud
Web Security tower, either Connect directly to the internet or Drop requests .
Cloud Web Security Authorization Scheme Method for authorizing transactions:
•
•
Web Security Appliance public facing IP address
Authorization key included with each transaction. You can generate an authorization key within the
Cisco Cloud Web Security Portal.
Note You can return to these settings later by navigating to Network > Cloud Connector .
Related topics
•
Preventing Loss of Secure Data, page 7-10
7-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 7 Cloud Web Security Connector
•
Sending Directory Groups to the Cloud, page 7-8
Configuring the Cloud Connector
Step 6. Configure Network Interfaces and Wiring
Setting
Ethernet Port
Description
If you configure the M1 interface for management traffic only, you must configure the P1 interface for data traffic. However, you can configure the P1 interface even when the M1 interface is used for both management and data traffic.
IP Address
Hostname
The IP address to use to manage the Web Security appliance.
Network Mask The network mask to use when managing the Web Security appliance on this network interface.
The hostname to use when managing the Web Security appliance on this network interface.
Related topics
•
Configuring Network Interfaces, page 26-2
Step 7. Configure Routes for Management and Data Traffic
Setting Description
Default Gateway The default gateway IP address to use for the traffic through the Management and/or Data interface.
Name A name used to identify the static route.
Internal Network The IP address for this route’s destination on the network.
Internal Gateway The gateway IP address for this route. A route gateway must reside on the same subnet as the Management or Data interface on which it is configured.
Related topics
•
Configuring TCP/IP Traffic Routes, page 26-5
Step 8. Configure Transparent Connection Settings
By default, the Cloud Connector is deployed in transparent mode. which requires a connection to a Layer
4 switch or a version 2 WCCP router.
Setting
Layer 4 Switch or
Description
• The Web Security appliance is connected to a layer 4 switch.
or
No Device • You will deploy the Cloud Connector in explicit forward mode.
WCCP v2 Router The Web Security appliance is connected to a version 2 WCCP capable router.
Note: A password can contain up to seven characters and is optional.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-7
Chapter 7 Cloud Web Security Connector
Directory Group Policies in the Cloud
Related topics
•
Configuring Transparent Redirection, page 26-11
Step 9. Configure Administrative Settings
Setting
Administrator Password
Description
A password to access the Web Security appliance. The password must be six characters or more.
An email address to which the appliance sends alerts.
Email system alerts to
Send Email via SMTP Relay Host (Optional) A hostname or address for an SMTP relay host that
AsyncOS uses for sending system generated email messages.
The default SMTP relay host is the mail servers listed in the MX record.
AutoSupport
The default port number is 25.
The appliance can send system alerts and weekly status report to
Cisco IronPort Customer Support.
Related topics
•
•
Configuring SMTP Relay Hosts, page 26-16
Step 10. Review and Install
Step 1
Step 2
Step 3
Review the installation.
Click Previous to go back and make changes.
Click Install This Configuration to continue with the information you provided.
Directory Group Policies in the Cloud
You can use Cisco Cloud Web Security to control web access based on directory groups. When traffic to
Cisco Cloud Web Security is being routed through a Web Security Appliance in Cloud Connector mode,
Cisco Cloud Web Security needs to receive the directory-group information with the transactions from the Cloud Connector so it can apply the group-based cloud policies. You can configure the Cloud
Connector to send specific directory groups to the cloud for this purpose.
Sending Directory Groups to the Cloud
Before you begin
• Add an authentication realm to the Web Security Appliance configuration.
7-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 7 Cloud Web Security Connector
Bypassing the Cloud Proxy Server
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to Network > Cloud Connector .
In the Cloud Policy Directory Groups area, click Edit Groups .
Select the groups for which you have created Cloud Policies within Cisco Cloud Web Security.
Click Add .
Click Done and Commit your changes.
Related information
•
Creating Authentication Realms, page 21-11
Bypassing the Cloud Proxy Server
Cloud routing policies allow you to route web traffic to either Cisco Cloud Web Security towers or directly to the internet based on these characteristics:
•
•
Identity
Proxy Port
•
•
Subnet
URL Category
• User Agent
The process of creating cloud routing policies in Cloud Connector mode is identical to the process of creating routing policies using the standard mode.
Related topics
•
Creating Routing Policies, page 11-5
FTP and HTTPS
The Web Security appliance in Cloud Connector mode does not fully support FTP or HTTPS.
FTP
FTP is not supported by the Cloud Connector. AsyncOS drops native FTP traffic when the appliance is configured for Cloud Connector.
FTP over HTTP is supported in Cloud Connector mode.
HTTPS
The Cloud Connector does not support decryption. It passes through HTTPS traffic without decrypting.
The ability of AsyncOS to route HTTPS transactions based on information stored in client headers is limited and is different for transparent and explicit HTTPS.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-9
Chapter 7 Cloud Web Security Connector
Preventing Loss of Secure Data
Transparent HTTPS
In the case of transparent HTTPS, AsyncOS does not have access to information in the client headers.
Therefore, AsyncOS cannot enforce routing policies that rely on information in client headers. For example, for transparent HTTPS transactions, AsyncOS does not have access to the username in the
HTTPS client header and therefore it cannot match a routing policy based on username. In this case,
AsyncOS uses the default routing policy.
Explicit HTTPS
In the case of explicit HTTPS, AsyncOS has access to the following information in client headers:
• URL
• Destination port number
Therefore, for explicit HTTPS transactions, it is possible to match a routing policy based on URL or port number.
Preventing Loss of Secure Data
You can integrate the Cloud Connector with external Data Loss Prevention servers through
Network > External DLP Servers .
Related topics
•
Chapter 14, “Data Security and External DLP Policies”
Cloud Connector Logs
The Cloud Connector Logs provides useful information for troubleshooting problems with the Cloud
Connector, for example, authenticated users and groups, the Cloud header, and the authorization key.
Subscribing to the Cloud Connector Logs
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to System Administration > Log Subscriptions .
Select Cloud Connector Logs from the Log Type menu.
Type a name in the Log Name field.
Set the log level.
Submit and Commit your changes.
Related topics
•
Tip Go to whoami.scansafe.net to view the configured group names, user names, and IP addresses.
7-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 7 Cloud Web Security Connector
Identities and User Authentication
Identities and User Authentication
The Cloud Web Security Connector supports basic authentication and NTLM. You can also bypass authentication for certain destinations. Authentication works the same throughout the Web Security
Appliance, whether in standard configuration or Cloud Connector configuration.
Note Identities based on User Agent or Destination URL are not supported for HTTPS traffic.
Related topics
•
•
Guest Access for Unauthenticated Users
If the Web Security appliance is configured to provide guest access for unauthenticated users, in Cloud
Connector mode, AsyncOS assigns guest users to the group, __GUEST_GROUP__, and sends that information to Cisco Cloud Web Security. Use Identities to provide guest access to unauthenticated users. Use Cisco Cloud Web Security policies to control these guest users.
Related topics
•
Allowing Guest Access to Users Who Fail Authentication, page 9-8
Configuration Modes
You can switch between Cloud Connector and Standard modes using the System Setup Wizard.
Switching to Cloud Connector Mode
Switching to Cloud Connector Mode
Step 1
Step 2
Step 3
Step 4
Select System Administration > System Setup Wizard .
Accept the license agreement.
Select Cloud Web Security Connector in the Appliance Mode section.
Continue configuring the Cloud Connector as described later in this chapter.
Related topics
•
Configuring the Cloud Connector, page 7-5
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
7-11
Configuration Modes
Chapter 7 Cloud Web Security Connector
7-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Working with Policies
C H A P T E R
8
This chapter contains the following information:
•
Working with Policies Overview, page 8-1
•
•
•
•
•
•
Working with Policy Groups, page 8-4
Policy Group Membership, page 8-7
Working with Time Based Policies, page 8-9
Working with User Agent Based Policies, page 8-11
Working with Policies Overview
The Web Security appliance includes an advanced policy framework to intelligently map data policies to business processes for protection on the network and at the endpoint. It allows you to define policies to enforce your organization’s acceptable use policies by controlling access to the Internet. You can create groups of users and apply different levels and types of access control to each group.
For example, you can configure the appliance to enforce the following types of policies:
• Users in the Marketing group can access a competitor’s website, but other users cannot.
•
•
Guest users on customer-facing machines, such as computers in a company store, cannot access banking sites, but employees can.
No users can access gambling sites. Instead, when they try to view a gambling site, they see a web page that explains the organization’s policies.
•
•
•
•
•
•
All users trying to access a particular site that no longer exists are redirected to a different site.
All users except those in IT are blocked from accessing potential malware sites, but users in IT can access them for testing purposes, and the downloaded content is scanned for harmful objects.
All requests for streaming media are blocked during business hours, but allowed outside of business hours.
All requests from a particular user agent, such as a software update program, are allowed without requiring authentication.
Block uploads of all Excel spreadsheet files greater than 2 MB.
Block uploads of data to sites with a bad web reputation.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-1
Policy Types
Chapter 8 Working with Policies
• Block uploads of data infected with malware.
To enforce organizational policies, you define different policies in the Web Security appliance. The appliance uses different types of policies for different functions. For more information about the types of policies, see
.
When you work with policies, you create policy groups. After you create policy groups, you can define
After you have created policies, you can figure out which policy groups apply to a particular client transaction for troubleshooting purposes. For example, you can find out if user jsmith tries to open a
Firefox browser to the URL http://www.google.com, then which policy groups apply to the transaction.
For more information about tracing policies, see
.
Note The Web Security appliance is permissive by default. That is, requests are allowed unless specifically blocked in a policy group.
Policy Types
The Web Security appliance uses multiple types of policies to enforce organizational policies and requirements.
•
•
•
•
Identities.
“Who are you?”
Decryption Policies.
“To decrypt or not to decrypt?”
Routing Policies.
“From where to fetch content?”
•
•
Access Policies.
“To allow or block the transaction?”
Cisco IronPort Data Security Policies.
“To block the upload of data?” Cisco IronPort Data
Security Policies actions are defined on the Web Security appliance.
External DLP (data loss prevention) Policies.
“To block the upload of data?” External DLP
Policies actions are defined on an external DLP appliance.
• Outbound Malware Scanning Policies.
“To block the upload of malicious data?”
• SaaS Application Authentication Policies.
“To allow this user access to the SaaS application?”
You use the policies together to create the behavior you need or expect when clients access the web.
To define policies, you create policy groups. After you create policy groups, you can define the control settings for each group. For more information about working with policy groups, see
All policy types have a global policy group that maintains default settings and rules that apply to web transactions not covered by another policy. For more information on global policies, see
Identities
An Identity is a policy that identifies the user making a request. This is the only policy where you can define whether or not authentication is required. An Identity addresses the question, “who are you?”
However, Identities do not specify a list of users who are authorized to access the web. You specify authorized users in the other policy types after you specify the Identity to use.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-2
Chapter 8 Working with Policies
Policy Types
All other policies you create must specify an Identity.
Configure Identities on the Web Security Manager > Identities page. For more information about
Identities, see
.
Decryption Policies
Decryption Policies determine whether or not an HTTPS connection should be decrypted, passed through, or dropped. They address the question, “to decrypt or not to decrypt?”
The appliance uses Decryption Policies to evaluate HTTPS requests. The Decryption Policy group that applies to an HTTPS request determines whether the appliance drops the connection, passes it through without decryption, or decrypts the connection and subsequently evaluate the decrypted request and response against the defined Access Policy groups.
Configure Decryption Policy groups on the Web Security Manager > Decryption Policies page. For more information about Decryption Policy groups, see
Decryption Policies, page 12-1 .
Routing Policies
Routing Policies determine to where to pass the client request, either to another proxy or to the destination server. They address the question, “from where to fetch content?”
You can use this policy type to select a group of upstream proxies configured for load balancing or failover.
Configure Routing Policies on the Web Security Manager > Routing Policies page. For more information
about Routing Policies, see Working with External Proxies, page 11-1
.
Access Policies
Access Policies determine whether to allow or block HTTP and decrypted HTTPS transactions. They address the question, “to allow or block the transaction?”
Access Policies determine how the appliance controls access to services, applications, and objects on the web for HTTP and decrypted HTTPS requests. The appliance uses Access Policies to evaluate and scan
HTTP requests and HTTPS requests designated for decryption.
Configure Access Policy groups on the Web Security Manager > Access Policies page. For more information about Access Policy groups, see
Cisco IronPort Data Security Policies
Cisco IronPort Data Security Policies determine whether or not to block a request to upload data using logic defined on the Web Security appliance. They address the question, “to block the upload of data?”
The Web Proxy uses Cisco IronPort Data Security Policies to evaluate and scan HTTP requests and decrypted HTTPS requests that have any data in the request body.
Configure Data Security Policy groups on the Web Security Manager > Cisco IronPort Data Security page. For more information about Data Security Policy groups, see
Data Security and External DLP
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-3
Chapter 8 Working with Policies
Working with Policy Groups
External DLP Policies
External DLP (data loss prevention) policies determine whether or not to block a request to upload data using logic stored on an external DLP server. They address the question, “to block the upload of data?”
The Web Proxy uses External DLP Policies to evaluate HTTP requests and decrypted HTTPS requests that have any data in the request body and send them to an external DLP server for scanning.
Configure External DLP Policy groups on the Web Security Manager > External Data Loss Prevention page. For more information about External DLP Policy groups, see
Data Security and External DLP
Outbound Malware Scanning Policies
Outbound Malware Scanning Policies determine whether or not to block a request to upload data that contains malicious data. They address the question, “To block the upload of malicious data?”
The Web Proxy uses Outbound Malware Scanning Policies to scan for malware HTTP requests and decrypted HTTPS requests that have any data in the request body.
Configure Outbound Malware Scanning Policy groups on the Web Security Manager > Outbound
Malware Scanning page. For more information about Outbound Malware Scanning Policy groups, see
Outbound Malware Scanning, page 13-1
.
SaaS Application Authentication Policies
SaaS Application Authentication Policies determine whether or not a user is allowed access to a
Software as a Service (SaaS) application. They address the question, “to allow this user access to a SaaS application?”
SaaS Application Authentication Policies determine how the appliance controls user access to configured SaaS applications, such as WebEx. When you enable Cisco SaaS Access Control, users log into the configured SaaS applications using their network authentication user credentials. That means they use the same user name and password for all SaaS applications as well as network access.
Configure SaaS Application Authentication Policy groups on the Web Security Manager > SaaS Policies page. For more information about SaaS Application Authentication Policy groups, see
Access to SaaS Applications, page 16-1 .
Working with Policy Groups
A policy group is an administrator defined configuration that allows you to apply acceptable use policies to specific categories of users. After you create policy groups, you can define the control settings for each group.
You can create as many user defined policy groups as required to enforce the proper access control. The
Web Security appliance displays policy groups together in a policies table.
All policies have a default, global policy group that applies to a transaction if none of the user defined policy groups apply. A global policy group maintains default settings and rules that apply to web transactions not covered by another policy. This group appears in the last row of a policies table, and the
Web Proxy applies its rules last if no other matching occurs.
8-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Working with Policy Groups
Creating Policy Groups
You can create policy groups based on combinations of several criteria, such as client subnet or the URL category of the destination site. You must define at least one criterion for policy group membership.
When you define multiple criteria, the client request must meet all criteria to match the policy group.
Options used to configure policy groups allow you to specify exceptions to global policy settings and control access to services for groups of users.
For more information about creating policy groups for the different policy types, see the following locations:
•
Creating Identities, page 9-17
•
•
•
•
Creating Access Policies, page 10-4
Creating Decryption Policies, page 12-20
Creating Routing Policies, page 11-5
Creating Data Security and External DLP Policies, page 14-6
Using the Policies Tables
The policies table is an ordered list of policy groups and the settings you configure for each filtering component. It displays policy groups by row and control settings by column. The control settings you can define vary by policy type.
shows the Access Policies table.
Figure 8-1 Access Policies Table
Click to edit user defined policy group membership.
Global policy group
(not editable).
Figure 8-2 shows the Decryption Policies table.
Click to customize policy control settings.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-5
Chapter 8 Working with Policies
Working with Policy Groups
Figure 8-2 Decryption Policies Table
Click to edit user defined policy group membership.
Global policy group
(not editable).
Click to customize policy control settings.
Any policy group that you create is added as a new row in the policies table. New policy groups inherit global policy settings for each control setting until you override them. To edit policy groups, click the links in each row.
When you create or configure a policy group, you define the following components:
• Policy group membership.
Define how to group users that belong to the policy group. For user defined policy groups, you can group by different properties, such as client IP address, authentication group or user name, or URL category. The properties you can define for a policy depends on the policy type.
Click the policy group name to edit the group membership requirements, such as client IP address and authentication requirements. A page is displayed where you can configure membership requirements.
Note For global policies, you can only define the membership requirements for the global Identity group and not for the global Access, Decryption, or Routing groups. Global Access, Decryption, and Routing groups always match all Identities.
•
For more information about policy group membership, see
Policy Group Membership, page 8-7
.
Policy group control settings.
Define how users in the group can use the Internet. The control settings you can define depend on the policy type. For example, for Routing Policies, you define from which proxy group to fetch the content, and for Access Policies, you can use the Web Security appliance features, such as Web Reputation, anti-malware scanning, and more to determine whether or not to allow the client request.
Click the link in the policy group row under the control setting you want to configure, such as URL
Categories or Routing Destination. When you click a link in the table, a page is displayed where you can configure settings for that policy group.
For more information on configuring control settings for each policy type, see the following sections:
–
Controlling HTTP and Native FTP Traffic, page 10-7
–
–
Controlling HTTPS Traffic, page 12-23
Creating Routing Policies, page 11-5
–
–
Controlling Upload Requests Using Cisco IronPort Data Security Policies, page 14-9
Controlling Upload Requests Using External DLP Policies, page 14-16
8-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Policy Group Membership
Policy Group Membership
All policy groups define which transactions apply to them. When a client sends a request to a server, the
Web Proxy receives the request, evaluates it, and determines to which policy group it belongs. The Web
Proxy applies the configured policy control settings to a client request based on the client request’s policy group membership.
Transactions belong to a policy group for each type of policy that is enabled. If a policy type has no user defined policy groups, then each transaction belongs to the global policy group for that policy type.
Policy group membership for a Routing, Decryption, Access, Data Security, and External DLP Policies is based on an Identity and optional additional criteria. That means that the Web Proxy evaluates Identity groups before the other policy types . The Web Security appliance allows you to define some membership criteria at either the Identity level or the non-Identity policy level. For more information, see
Group Membership Rules and Guidelines, page 8-8
.
Suppose you define an Identity by subnet 10.1.1.0/24 and then create an Access Policy using that
Identity. The Access Policy membership applies to all IP addresses specified in the Identity by default.
You can then choose to configure the Access Policy membership so that it applies to a subset of the addresses defined in the Identity, such as addresses 10.1.1.0-15.
For more information defining membership for each policy type, see the following sections:
•
Evaluating Identity Group Membership, page 9-2
•
•
•
•
Evaluating Access Policy Group Membership, page 10-3
Evaluating Decryption Policy Group Membership, page 12-19
Evaluating Routing Policy Group Membership, page 11-3
Evaluating Data Security and External DLP Policy Group Membership, page 14-4
Authenticating Users versus Authorizing Users
The Web Security appliance separates where it authenticates users from where it authorizes users.
Authentication is the mechanism by which the Web Proxy securely identifies a user. It answers the following questions:
•
•
Who is the user?
Is the user really whom he/she claims to be?
Authorization is the mechanism by which the Web Proxy determines the level of access the user has to the World Wide Web. It answers the following questions:
• Is this user allowed to view this website?
•
•
Is this user allowed to connect to this HTTPS server without the connection being decrypted?
Is this user allowed to directly connect to the web server, or must it connect to another proxy server first?
• Is this user allowed to upload this data?
The Web Proxy can only authorize a user to access an Internet resource after it authenticates who the user is. The Web Proxy authenticates users when it evaluates Identity groups, and it authorizes users when it evaluates all other policy group types. What that means is the Identity group indicates who is making the request, but does not indicate whether that client is allowed to make the request.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-7
Chapter 8 Working with Policies
Policy Group Membership
By separating authentication from authorization, you can create a single Identity group that identifies a group of users and then you can create multiple policy groups that allow different levels of access to subsets of users in the group in the Identity.
For example, you can create one Identity group that covers all users in an authentication sequence. Then you can create an Access Policy group for each authentication realm in the sequence. You can also use this Identity to create one Decryption Policy with the same level of access for all users in the Identity.
Working with Failed Authentication and Authorization
You can allow users another opportunity to access the web if they fail authentication or authorization.
How you configure the Web Security appliance depends on what fails:
• Authentication.
When authentication fails, you can grant guest access to the user. Authentication might fail under the following circumstances:
– A new hire has been provided credentials in an email but they are not yet populated in the authentication server.
•
– A visitor comes to the office and needs to be granted restrictive Internet access, but is not in the corporate user directory.
For more information on configuring guest access, see
Allowing Guest Access to Users Who Fail
.
Authorization.
A user might authenticate correctly, but not be granted access to the web due to the applicable Access Policy. In this case, you can allow the user to re-authenticate with more privileged credentials. To do this, enable the “Enable Re-Authentication Prompt If End User Blocked by URL
Category or User Session Restriction” global authentication setting. For more information, see
Allowing Users to Re-Authenticate, page 21-27
.
Working with All Identities
You can create a policy group that specifies “All Identities” as the configured Identity group. “All
Identities” applies to every valid client request because by definition, every request either succeeds and has a user defined or global Identity assigned to it or is terminated because it fails authentication (and no guest access was provided for users failing authentication).
When you create a policy group that uses All Identities, you must configure at least one advanced option to distinguish the policy group from the global policy group.
Typically, you use All Identities in a policy while also configuring an advanced option, such as a particular user agent or destination (using a custom URL category). This allows you to create a single rule that makes an exception for a specific case instead of creating multiple rules to make the exception for the specific case. For example, you can create an Access Policy group whose membership applies to
All Identities and a custom URL category for all intranet pages. Then you can configure the Access
Policy control settings to disable anti-malware filtering and Web Reputation scoring.
Policy Group Membership Rules and Guidelines
Consider the following rules and guidelines when defining policy group membership:
• The Web Proxy evaluates Identity groups before the other policy types.
• Subnet membership criteria defined in the Identity group can be further narrowed down in the policy group using the Identity group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-8
Chapter 8 Working with Policies
Working with Time Based Policies
•
•
•
•
Advanced membership criteria (proxy ports, URL categories, and user agents) defined in the
Identity group cannot be defined in the policy group using the Identity group.
Define Identity groups as broadly as possible. Then you can use the Identity groups in other policy types and further narrow down membership as necessary.
Define fewer, more generic Decryption and Routing Policies as much as possible.
If you need to define membership by URL category, only define it in the Identity group when you need to exempt from authentication requests to that category. For other purposes, define membership by URL category in the Access, Decryption, Routing, Data Security, or External DLP Policy group.
This can increase performance in most cases.
Working with Time Based Policies
The Web Security appliance provides the means to create time based policies by specifying time ranges, such as business hours, and using those time ranges to define access to the web. You can define policy group membership based on time ranges, and you can specify actions for URL filtering based on time ranges.
You might want to use time ranges to accomplish the following tasks:
•
•
You can block access to high bandwidth sites, such as streaming media, or distracting sites, such as games, during business hours.
You can route transactions to a particular external proxy after midnight when the other proxies are being serviced.
• You can allow larger files to be downloaded on the weekends.
Define time ranges on the Web Security Manager > Defined Time Ranges page. You can create time ranges to define concepts such as “business hours” or “weekend shift.” Then you can use the time ranges in the following locations:
•
•
Policy group membership for a Routing, Access, or Decryption Policy.
URL filtering settings for Access Policies.
When you define a time range, you can specify the day(s) of the week and the time of day. A transaction matches the time range when it occurs on one of the days specified and during the time specified. You can also define multiple combinations of day and time in a single time range. For example, you can define a time range that applies to transactions that occur on Monday through Friday from 08:00 to 17:00 or on Saturday from 09:00 to 13:00.
Policies and URL filtering actions can be defined inside or outside the defined time ranges.
Note Because you can define time based policy group membership only for Routing, Access, and Decryption
Policies, but not Identities, you cannot create time based policies that define when users must authenticate. Authentication requirements are defined in Identity groups, but time based policies are defined in other policy group types. (bug #41723)
Creating Time Ranges
To create a time range:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-9
Working with Time Based Policies
Step 1
Step 2
Go to Web Security Manager > Defined Time Ranges.
Click Add Time Range .
The Add Time Range page appears.
Chapter 8 Working with Policies
Step 3
Step 4
Step 5
In the Time Range Name field, enter a name to use for the time range. Each time range name must be unique.
In the Time Zone section, choose whether to use the time zone setting on the Web Security appliance or a different time zone setting you configure.
In the Time Values section, define at least one row that specifies the days of the week and time of day to include in this time range.
a.
b.
In the Day of the Week section, select at least one day.
In the Time of Day section, choose All Day or enter a time range in the day using the From and To fields.
Each time range includes the start time and excludes the end time. For example, entering 8:00 through 17:00 matches 8:00:00 through 16:59:59, but not 17:00:00.
Midnight must be specified as 00:00 for a start time, and as 24:00 for an end time.
Note A transaction must occur on the day and in the time specified to match a row in the Time Values section. That means the Day of Week and Time of Day values have an “AND” relationship with each other within a single row.
Step 6 Optionally, you can create additional time value rows by clicking Add Row .
Note When a time range includes multiple time value rows, a transaction can occur within any of the defined time values to match the time range. That means that multiple time value rows in a single time range have an “OR” relationship with each other.
Step 7 Submit and commit your changes.
8-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Working with User Agent Based Policies
Working with User Agent Based Policies
The Web Security appliance provides the means to create policies to define access to the web by the client application (user agent), such as a web browser, making the client request. You can define policy group membership based on user agents, and you can specify control settings based on user agents.
You might want to specify user agents to accomplish the following tasks:
• You can exempt certain user agents from authentication. You might want to do this for client applications that cannot handle prompting users for authentication credentials. For more
information about how to do this, see Exempting User Agents from Authentication, page 8-12 .
You can block access from particular user agents that you define.
•
You can configure user agents in the following locations:
• Policy group membership for all policy types, including Identities.
• Application control settings for Access Policies.
Note When the appliance is deployed in transparent mode, user agent information is not available for
Decryption Policies.
Configuring User Agents for Policy Group Membership
When you define policy group membership for any policy type, you can expand the Advanced section to define membership by additional criteria, such as user agent. When you click the User Agents link, the Membership by User Agent page appears allowing you to define membership by user agent.
Figure 8-3 on page 8-12 shows the Membership by User Agent page for an Identity policy group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-11
Working with User Agent Based Policies
Figure 8-3 Defining Policy Group Membership by User Agent
Chapter 8 Working with Policies
On this page, you can select as many user agents as desired. The web interface includes some of the more common user agents that you can select using a check box. You can also type a regular expression to define any user agent necessary.
For each user agent you select in the Common User Agents section, AsyncOS for Web creates a regular expression to define the user agent. However, if you select the Any Versions option for each browser type, AsyncOS for Web creates a single regular expression that represents all versions of that browser instead an expression for each version. Creating one regular expression instead of multiple increases performance.
For example, when you select “Version 2.X” and “Version 1.X or earlier” for Firefox, AsyncOS for Web uses the following regular expressions:
Firefox/2
Firefox/1
However, when you select “Firefox Any Versions,” AsyncOS uses the following regular expression:
Firefox
Also, you can configure the policy group membership to either match the user agents you define, or matching all other user agents than the ones defined.
Exempting User Agents from Authentication
To exempt a user agent from authentication:
Step 1 Create an Identity policy group with membership that is based on the user agent to exempt.
For more information about creating Identities, see
Creating Identities, page 9-17 .
8-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Tracing Policies
Step 2
Step 3
Step 4
Do not require authentication for the Identity policy group.
Place the Identity policy group above all other Identity policy groups that require authentication.
Submit and commit your changes.
Tracing Policies
The Web Security appliance web interface includes a tool that traces a particular client request and details how the Web Proxy processes the request. The Web Proxy evaluates the request against all committed Access, Decryption, Cisco IronPort Data Security, Outbound Malware Scanning, and
Routing Policies and calculates other attributes, such as the web reputation score.
The policy trace tool allows administrators to troubleshoot when end users ask questions about Web
Proxy behavior. It simulates client requests as if they were made by the end users and describes Web
Proxy behavior. It can be a powerful troubleshooting or debugging tool, especially if you have combined many of the advanced features available on the Web Security appliance.
When you use the policy trace tool, the Web Proxy does not record the requests in the access log or reporting database.
By default, the Web Proxy simulates an HTTP GET request. However, when you specify a file to upload in the Request Details section, the Web Proxy simulates an HTTP POST request.
Note The policy trace tool explicitly makes requests even if the Web Security appliance is deployed in transparent mode.
You can trace policies on the System Administration > Policy Trace page.
To trace policies:
Step 1 Navigate to the System Administration > Policy Trace page.
Step 2 In the URL field, enter the URL in the client request to simulate.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-13
Chapter 8 Working with Policies
Tracing Policies
Step 3 Optionally, in the Client IP Address field, enter the IP address of the machine to simulate.
Note If no IP address is specified, AsyncOS uses localhost.
Step 4 Optionally, you can simulate an authentication user by entering the following authentication requirements in the User area:
•
•
User Name.
Enter the user name of the authentication user.
Authentication Realm.
Choose an authentication realm.
Note For authentication to work for the user you enter here, the user must have already successfully authenticated through the Web Security appliance.
Step 5 Optionally, by expanding the Advanced section, you can configure additional settings to simulate a more specific user request that you want to trace.
shows the expanded Advanced section.
Figure 8-4 Policy Trace Feature Advanced Section
The Advanced settings are divided into details of the transaction request to simulate and transaction response details to override.
8-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Tracing Policies
Step 6
advanced settings you can configure.
Table 8-1 Policy Trace Advanced Settings for Requests
Setting
Proxy Port
User Agent
Time of Request
Upload File
Object Size
MIME Type
Anti-malware
Scanning Verdicts
Description
Select a specific proxy port to use for the trace request to test policy group membership based on proxy port.
Specify the user agent to simulate in the request.
Specify the day of week and time of day to simulate in the request.
Choose a local file to simulate uploading in the request.
When you specify a file to upload here, the Web Proxy simulates an HTTP
POST request instead of a GET request.
Enter the size of the request object in bytes. You can enter K, M, or G to represent Kilobytes, Megabytes, or Gigabytes.
Enter the MIME type.
Choose whether or not to override the Webroot, McAfee, or Sophos scanning verdicts.
Step 7 Configure the transaction response details to override as desired.
You might want to override a transaction response detail to simulate how a different response value, such
the response side advanced settings you can configure.
Table 8-2 Policy Trace Advanced Settings for Response Overrides
Setting
URL Category
Application
Object Size
MIME Type
Web Reputation
Score
Anti-malware
Scanning Verdicts
Description
Choose whether or not to override the URL category of the transaction response.
Choose an application that the Application Visibility and Control engine can detect.
Enter the size of the response object in bytes. You can enter K, M, or G to represent Kilobytes, Megabytes, or Gigabytes.
Enter the MIME type.
Enter the web reputation score from -10.0 to 10.0.
Choose whether or not to override the Webroot, McAfee, or Sophos scanning verdicts.
Step 8 Click Find Policy Match .
The policy trace tool displays the results in the Results area.
Note The Find Policy Match button turns into a Cancel button while the policy trace processes the parameters you enter. You can cancel the trace at any time.
Figure 8-5 on page 8-16 shows the Policy Trace page with some results from a policy trace.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-15
Tracing Policies
Figure 8-5 Policy Trace Results
Chapter 8 Working with Policies
8-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 8 Working with Policies
Tracing Policies
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
8-17
Tracing Policies
Chapter 8 Working with Policies
8-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
9
Identities
•
•
•
•
•
•
•
•
•
Evaluating Identity Group Membership, page 9-2
Matching Client Requests to Identity Groups, page 9-6
Allowing Guest Access to Users Who Fail Authentication, page 9-8
Identifying Users Transparently, page 9-10
Identities and Pass-through HTTPS Traffic, page 9-17
Creating Identities, page 9-17
Configuring Identities in Other Policy Groups, page 9-22
Example Identity Policies Tables, page 9-24
Identities Overview
To control web traffic on the network and protect your network from web based threats, the Web Proxy needs to identify who is trying to access the web. Users can be identified by different criteria, such as their machine address or authenticated user name. The Web Proxy can apply different actions to transactions based on who is submitting the request.
To identify who is accessing the web, you create Identities in the Web Security appliance. An Identity is a policy that identifies and groups users. An Identity addresses the question, “who are you?”
Identities are the only policy where you define whether or not authentication is required to access the web. However, Identities do not specify a list of users who are authorized (allowed) to access the web.
You specify authorized users in the other (non-Identity) policy types.
All other policy types use an Identity as the basis to determine which policy group applies to the transaction. That means you can create a single Identity and use it multiple times in the non-Identity policy groups.
You might want to group the following types of users or machines:
• A group of machine addresses in a test lab.
You can create a Routing Policy with this Identity so requests from these machines are fetched directly from the destination server.
• All authenticated users based on the All Realms authentication sequence.
You can create a single Access Policy using this Identity, or you can create a different Access Policy for each authentication realm and configure different control settings for users in each realm.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-1
Chapter 9 Identities
Evaluating Identity Group Membership
• Users accessing the Web Security appliance on a particular proxy port.
You can create a Routing
Policy using this Identity that fetches content from a particular external proxy for requests that explicitly connect to the appliance on a particular proxy port.
• All subnets trying to access a website in a user defined URL category do not require authentication.
You can create an Access Policy using this Identity to exempt requests to particular destinations from authentication. You might want to do this for Windows update servers.
Define Identities on the Web Security Manager > Identities page. For more information about creating
Identities, see Creating Identities, page 9-17 .
Evaluating Identity Group Membership
When a client sends a request to a server, the Web Proxy receives the request, evaluates it, and determines to which Identity group it belongs.
To determine the Identity group that a client request matches, the Web Proxy follows a very specific process for matching the Identity group membership criteria. During this process, it considers the following factors for group membership:
• Subnet.
The client subnet must match the list of subnets in a policy group.
•
•
Protocol.
The protocol used in the transaction, either HTTP/HTTPS or native FTP.
Port.
The proxy port of the request must be in the Identity group’s list of ports, if any are listed. For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port.
You might want to define Identity group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Note Cisco recommends only defining Identity group membership by the proxy port when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. When you define Identity group membership by the proxy port when clients requests get transparently redirected to the appliance, some requests might be erroneously denied.
•
•
User agent.
The user agent making the request must be in the Identity group’s list of user agents, if any are listed. You might want to group by user agent for user agents that cannot handle authentication and you want to create an Identity that does not require authentication.
URL category.
The URL category of the request URL must be in the Identity group’s list of URL categories, if any are listed. You might want to group by URL destination category if you create different authentication groups based on URL categories and want to apply them to users depending on the website categorization.
• Authentication requirements.
If the Identity group requires authentication, the client authentication credentials must match the Identity group’s authentication requirements. For more information about how authentication works with Identity groups, see
Authentication Affects Identity Groups, page 9-3
.
The information in this section gives an overview of how the appliance matches client requests to
Identity groups. For more details on exactly how the appliance matches client requests, see
Client Requests to Identity Groups, page 9-6
.
9-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Evaluating Identity Group Membership
The Web Proxy sequentially reads through each Identity group in the Identity policies table. It compares the client request status to the membership criteria of the first Identity group. If they match, the Web
Proxy assigns the Identity group to the transaction.
If they do not match, the Web Proxy compares the client request to the next Identity group. It continues this process until it matches the client request to a user defined Identity group, or if it does not match a user defined Identity group, it matches the global Identity policy. When the Web Proxy matches the client request to an Identity group or the global Identity policy, it assigns the Identity group to the transaction.
If at any time during the comparison process the user fails authentication, the Web Proxy terminates the
request. For more information about how authentication works with Identity groups, see Understanding
How Authentication Affects Identity Groups, page 9-3 .
After the Web Proxy assigns an Identity to a client request, it evaluates the request against the other policy group types. For more information, see the following locations:
•
Evaluating Access Policy Group Membership, page 10-3
•
•
•
Evaluating Decryption Policy Group Membership, page 12-19
Evaluating Routing Policy Group Membership, page 11-3
Evaluating Data Security and External DLP Policy Group Membership, page 14-4
Understanding How Authentication Affects Identity Groups
Requiring authentication for users can help your organization control access to the web for groups of users. AsyncOS allows you to create multiple Identity groups and define the membership criteria based on authentication requirements.
When authentication is required for an Identity group, a gold key icon appears next to the Identity group name in the Policies table, as shown in
Figure 9-1 Identity Groups that Require Authentication
To define authentication requirements for an Identity group, you can choose an authentication realm or sequence that applies to the Identity group.
Note You can specify the authorized users when you use the Identity in a non-Identity policy group.
Consider the following rules and guidelines when creating and ordering Identity groups:
• Identity group order.
All Identity groups that do not require authentication must be above Identity groups that require authentication.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-3
Chapter 9 Identities
Evaluating Identity Group Membership
•
•
•
Cookie-based authentication.
When the appliance is configured to use cookie-based authentication surrogates, it does not get cookie information from clients for HTTPS and FTP over HTTP requests.
Therefore, it cannot get the user name from the cookie. How HTTPS and FTP over HTTP requests are matched against the Identity groups varies based on other factors. For more information, see
Understanding How Authentication Affects HTTPS and FTP over HTTP Requests, page 9-4 .
Identity uniqueness.
Verify the Identity group membership requirements are unique for each
Identity group. If two Identity groups require the exact same membership, then client requests never match the lower Identity group. If any non-Identity policy uses the lower Identity group, client requests never match that policy.
Global Identity policy.
The global Identity policy does not require authentication by default when you create an authentication realm. If you want the global Identity policy to require authentication, you must assign an authentication realm, authentication sequence, or the All Realms sequence to the global Identity policy.
For some examples of how the Web Proxy matches client requests to an Identity group for different
Identity policies tables, see
Example Identity Policies Tables, page 9-24 .
Understanding How Authentication Affects HTTPS and FTP over HTTP Requests
How the Web Proxy matches HTTPS and FTP over HTTP requests with Identities depends on the type of request (either explicitly forwarded or transparently redirected to the Web Proxy) and the authentication surrogate type:
•
•
No authentication surrogates.
The Web Proxy matches HTTPS and FTP over HTTP requests with
Identity groups the same way it matches HTTP requests. For a diagram of how this occurs, see
.
IP-based authentication surrogates and explicit requests.
The Web Proxy matches HTTPS and
FTP over HTTP requests with Identity groups the same way it matches HTTP requests. For a diagram of how this occurs, see
.
•
•
IP-based authentication surrogates and transparent requests.
The Web Proxy matches FTP over
HTTP requests with Identity groups the same way it matches HTTP requests. But for HTTPS requests, the behavior is different, depending on whether or not the HTTPS request comes from a client that has authentication information available from an earlier HTTP request:
– Information available from a previous HTTP request.
The Web Proxy matches HTTPS requests with Identity groups the same way it matches HTTP requests. HTTPS requests are treated with the Identity associated with the IP address.
– No information available from a previous HTTP request.
When the Web Proxy has no credential information for the client, then it either fails the HTTPS request or decrypts the
HTTPS request in order to authenticate the user, depending on how you configure the HTTPS
Proxy. Use the HTTPS Transparent Request setting on the Security Services > HTTPS Proxy page to define this behavior.
For a diagram of how this occurs, see
Cookie-based authentication surrogates and transparent requests.
When the appliance uses cookie-based authentication, the Web Proxy does not get cookie information from clients for HTTPS and FTP over HTTP requests. Therefore, it cannot get the user name from the cookie. In this situation, HTTPS and FTP over HTTP requests still match the Identity group according to the other membership criteria, but the Web Proxy does not prompt clients for authentication even if the
Identity group requires authentication . Instead, the Web Proxy sets the user name to NULL and considers the user as unauthenticated . Then, when the unauthenticated request is evaluated against
9-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Evaluating Identity Group Membership
• the non-Identity policy groups, it matches only non-Identity groups that specify “All Identities” and apply to “All Users.” Typically, this is the global policy, such as the global Access Policy. For a diagram of how this occurs, see
Cookie-based authentication surrogates and explicit requests.
The behavior is different, depending on whether or not credential encryption is enabled:
– Credential encryption enabled.
The behavior is the same as cookie-based authentication with transparent requests, as described previously. See also
Accessing HTTPS and FTP Sites with
Credential Encryption Enabled, page 21-26 .
– Credential encryption disabled.
The Web Proxy uses no surrogates. HTTPS and FTP over
HTTP requests are authenticated and matched to Identity groups like HTTP requests. For a diagram of how this occurs, see
summarizes the previous information.
Table 9-1 Matching HTTPS and FTP over HTTP Requests to Identities
Surrogate
Types
IP-based
Explicit Requests
No Surrogate HTTPS and FTP over HTTP requests are matched like HTTP requests.
HTTPS and FTP over HTTP requests are matched like HTTP requests.
Transparent Requests
N/A
FTP over HTTP requests are matched like
HTTP requests.
HTTPS requests are matched like HTTP requests under any of the following conditions:
•
•
A previous HTTP request was authenticated using an identity with an
IP-based surrogate.
A previous HTTP request was not authenticated, but the HTTPS Proxy is configured to decrypt the first HTTPS request.
Cookie-based The client is not prompted for authentication.
Note: When credential encryption is disabled, no surrogates are used, and
HTTPS requests are matched like HTTP requests.
Otherwise, if a previous HTTP request was not authenticated and the HTTPS Proxy is configured to deny the request, the HTTPS request fails.
The client is not prompted for authentication.
Understanding How Authentication Scheme Affects Identity Groups
You define the authentication scheme for each Identity group, not at each realm or sequence. That means you can use the same NTLM realm or a sequence that contains an NTLM realm and use it in Identity groups that use either the NTLMSSP, Basic, or “Basic or NTLMSSP” authentication schemes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-5
Chapter 9 Identities
Matching Client Requests to Identity Groups
The Web Proxy communicates which scheme(s) it supports to the client application at the beginning of a transaction. The Identity group currently in use determines which scheme(s) it supports. When the Web
Proxy informs the client application that it supports both Basic and NTLMSSP, the client application chooses which scheme to use in the transaction.
Some client applications, such as Internet Explorer, always choose NTLMSSP when given a choice between NTLMSSP and Basic. This might cause a user to not pass authentication when all of the following conditions are true:
• The Identity group uses a sequence that contains both LDAP and NTLM realms.
•
•
The Identity group uses the “Basic or NTLMSSP” authentication scheme.
A user sends a request from an application that chooses NTLMSSP over Basic.
• The user only exists in the LDAP realm.
When this happens, the Web Proxy uses the NTLMSSP scheme to authenticate users in this Identity group because the client requests it. However, LDAP servers do not support NTLMSSP, so no user that exists only in the specified LDAP server(s) can pass authentication in this Identity group.
Therefore, when you need to use an authentication sequence that contains both LDAP and NTLM realms, consider the client applications that might try to access a URL when you configure the authentication scheme for an Identity group. For example, you might want to choose Basic as the only authentication scheme for an Identity group in some cases.
Matching Client Requests to Identity Groups
shows how the Web Proxy evaluates a client request against the Identity groups when the Identity is configured to use:
• No authentication surrogates
•
•
IP addresses as authentication surrogates
Cookies as authentication surrogates with transparent requests
• Cookies as authentication surrogates with explicit requests and credential encryption is enabled
shows how the Web Proxy evaluates a client request against the Identity groups when the Identity is configured to use cookies as the authentication surrogates, credential encryption is enabled, and the request is explicitly forwarded.
9-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Figure 9-2
Matching Client Requests to Identity Groups
Policy Group Flow Diagram for Identities - No Surrogates and IP-Based Surrogates
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-7
Chapter 9 Identities
Allowing Guest Access to Users Who Fail Authentication
Figure 9-3 Policy Group Flow Diagram for Identities - Cookie-Based Surrogates
Allowing Guest Access to Users Who Fail Authentication
You can grant limited access to users who fail authentication due to invalid credentials. By default, when a client passes invalid authentication credentials, the Web Proxy continually requests valid credentials, essentially blocking access to all Internet resources. However, when you allow guest access, the first time the client passes invalid authentication credentials, the user is treated as a guest and the Web Proxy does not request authentication again.
You might want to grant guest access to users in the following situations:
• A visitor comes to the office and needs to be granted restrictive Internet access, but is not in the corporate user directory.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-8
Chapter 9 Identities
Allowing Guest Access to Users Who Fail Authentication
•
•
•
An employee from another branch location (or from an acquired company) comes to the corporate headquarters, and needs Internet access. The user directories of the branch location (or acquired company) and corporate headquarters are separate, so the employee’s credentials do not work in the corporate headquarters.
A new hire has been provided credentials in an email but they are not yet populated in the authentication server.
A user logs into a Windows workstation using a local account instead of a Windows domain account and the user needs access to the Internet.
The authentication server administrator in your organization can create a guest user account in the user directory. However, allowing guest access through the Web Security appliance has the benefit that the administrator does not have to communicate the guest credentials to every visitor.
To grant guest access to users who fail authentication, you create an Identity that requires authentication, but also allows guest privileges. Then you create another policy using that Identity and apply that policy to the guest users. When users who fail authentication have guest access, they can access the resources defined in the policy group that specifies guest access for that Identity.
A user who fails authentication has all transactions blocked if either of the following conditions are true:
• Guest privileges are not provided in any Identity.
• The user does not match any Identity that provides guest privileges.
A user who fails authentication has transactions allowed when all of the following conditions are true:
•
•
The user matches an Identity with guest privileges.
A non-Identity policy group uses that Identity and applies to guest users.
For example, you can create an Access or Decryption Policy that is specific to guest users.
Note If an Identity allows guest access and there is no user defined policy group that uses that Identity, users who fail authentication match the global policy for that policy type. For example, if MyIdentity allows guest access and there is no user defined Access Policy that uses MyIdentity, users who fail authentication match the global Access Policy. If you do not want guest users to match a global policy, create a policy group above the global policy that applies to guest users and blocks all access.
When the Web Proxy grants a user guest access, it identifies and logs the user as a guest in the access logs. You can specify whether the Web Proxy identifies the user by IP address or user name. In the access logs, reports, and end-user acknowledgement page, entries for guest users have one of the following formats:
• (unauthenticated) IP_address
• (unauthenticated) username_entered
You can enable guest access for an Identity that uses any authentication protocol or scheme.
To grant guest access to a user:
Step 1 Define an Identity group and enable the Support Guest privileges option.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-9
Identifying Users Transparently
Chapter 9 Identities
Step 2
Step 3
This Identity allows guest access.
Create an Access, Decryption, Routing, Data Security, or External DLP Policy and select the Identity created in step
.
In the Access, Decryption, Routing, Data Security, or External DLP Policy group membership, select
“Guests (users failing authentication)” for the Identity in step
Step 4
Guests of this Identity are authorized to access the web.
Submit and commit your changes.
Note You can configure the Web Proxy to request authentication again if an authenticated user is blocked from a website due to restrictive URL filtering. To do this, enable the “Enable Re-Authentication Prompt If
End User Blocked by URL Category or User Session Restriction” global authentication setting. For more information, see
Allowing Users to Re-Authenticate, page 21-27
.
Identifying Users Transparently
Traditionally, users identified by an authentication user name are explicitly prompted to enter a user name and password. The credentials the user enters are then validated against an authentication server, and then the Web Proxy applies the appropriate policies to the transaction based on the authenticated user name.
9-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Identifying Users Transparently
However, you can configure the Web Security appliance so that it identifies users by an authenticated user name transparently—that is, without prompting the end user. Identification is a method of obtaining user credentials that have been obtained from another trusted source. AsyncOS for Web assumes that the username has already been authenticated by the trusted source providing the username.
You might want to identify users transparently to:
• Create a single sign-on environment so users are not aware of the presence of a proxy on the network.
• Use authentication based policies to apply to transactions coming from client applications that are incapable of displaying the authentication prompt to end users.
Identifying users transparently only affects how the Web Proxy obtains the user name and assigns an
Identity group. After it obtains the user name and assigns an Identity, it applies all other policies normally, regardless of how it assigned the Identity.
To identify users transparently, complete the following basic steps:
1.
Define at least one authentication realm that supports transparent user identification. For more information, see
Understanding Transparent User Identification, page 9-11
.
2.
Create an Identity group that identifies user transparently, and then specify the authentication realm created in the previous step.
Note You can also transparently identify remote users when using Secure Mobility Solution. For more information, see
Transparently Identifying Remote Users, page 15-4
.
Understanding Transparent User Identification
You can identify users transparently using one of the following authentication servers:
•
•
Active Directory.
Create an NTLM authentication realm and enable transparent user identification.
In addition, you must deploy a separate utility called the Cisco Active Directory Agent (AD Agent).
For more information, see
Transparent User Identification with Active Directory, page 9-12
.
Novell eDirectory.
Create an LDAP authentication realm that supports Novell eDirectory. For more information, see
Transparent User Identification with Novell eDirectory, page 9-14 .
AsyncOS for Web works with either Novell eDirectory or the Active Directory Agent to maintain a mapping that matches authenticated user names to their current IP addresses. AsyncOS for Web communicates with the Novell eDirectory server and the Active Directory Agent at regular intervals to maintain the current IP address to user name mapping.
The following steps are followed when transparent user identification is enabled:
1.
2.
3.
Client makes a request for a website.
Web Security appliance receives the client request and obtains the IP address from the request.
4.
AsyncOS for Web checks the IP address to user name mapping stored on the Web Security appliance to assign a user name to the client request. If no match is found for transparent user identification with Active Directory, AsyncOS for Web then contacts the Active Directory Agent to find a matched user name.
Assuming it matches a user name to the IP address, AsyncOS for Web fetches the user groups from the Novell eDirectory server or Active Directory Server.
5.
AsyncOS for Web applies policies to the transaction as appropriate.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-11
Chapter 9 Identities
Identifying Users Transparently
If the IP address does not match a user name, you can configure how to handle the transaction. You can grant the end user guest access, or you can force an authentication prompt to appear to the end user.
When an end user is shown an authentication prompt due to failed transparent user identification, and the user then fails authentication due to invalid credentials, you can choose whether to allow the user guest access.
Figure 9-4 shows where you grant user access when configuring an Identity for transparent
user identification.
Figure 9-4 Granting Guest Access—Transparent User Identification
The current IP address to user name mapping is updated, by default, every 600 seconds. You can change this time interval using the tuiconfig
CLI command. For more information, see
Configure Transparent User Identification, page 9-16 .
Note When you enable re-authentication and a transaction is blocked by URL filtering, an end-user notification page appears with the option to log in as a different user. Users who click the link are prompted for authentication. For more information, see
Allowing Users to Re-Authenticate, page 21-27
.
Transparent User Identification with Active Directory
Active Directory does not record user login event information in a method that is easily queried by other servers, such as the Web Security appliance. However, Cisco offers the Cisco Active Directory Agent
(AD Agent) that queries the Active Directory security event logs to maintain an IP address to user name mapping of users authenticated with Active Directory. The Active Directory Agent acts as a sort of identity repository.
AsyncOS for Web communicates with the Active Directory Agent to maintain a local copy of the IP address to user name mapping. When AsyncOS for Web needs to associate an IP address with a user name, it first checks its local copy of the mapping. If no match is found, it queries the Active Directory
Agent to find a match.
For more information on installing and configuring the Active Directory Agent, see
Active Directory Agent to Provide Information to the Web Security Appliance, page 9-13 .
Consider the following rules and guidelines when you identify users transparently using Active
Directory:
•
•
•
Transparent user identification with Active Directory works with an NTLM authentication realm only. You cannot use it with an LDAP authentication realm that corresponds to an Active Directory instance.
Transparent user identification works with the versions of Active Directory supported by the Active
Directory Agent.
Optionally, you can install a second instance of the Active Directory Agent on a different machine to achieve high availability. When you do this, each Active Directory Agent maintains an IP address to user name mapping independently of the other agent. AsyncOS for Web uses the backup Active
Directory Agent after three unsuccessful ping attempts to the primary agent.
9-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Identifying Users Transparently
•
•
•
•
•
The Active Directory Agent uses on-demand mode when it communicates with the Web Security appliance.
The Active Directory Agent pushes user logout information to the Web Security appliance.
However, some user logout information never gets recorded in the Active Directory server security logs. This might happen if the client machine crashes or if the user shuts down the machine without logging out. If there is no user logout information in the security logs, the Active Directory Agent cannot inform the appliance that the IP address no longer is assigned to that user. Because of this, you can define the timeout value for how long AsyncOS caches the IP address to user mapping when there are no updates from the Active Directory Agent. For more information, see
Configure Transparent User Identification, page 9-16
.
The Active Directory Agent records the sAMAccountName for each user logging in from a particular IP address to ensure the user name is unique.
The client IP addresses that the client machines present to the Active Directory server and the Web
Security appliance must be the same.
AsyncOS for Web only searches for direct parent groups that the user belongs to. It does not search nested groups.
Setting Up the Active Directory Agent to Provide Information to the Web Security Appliance
Because AsyncOS for Web cannot obtain client IP addresses directly from Active Directory, it must obtain IP address to user name mapping information from the Cisco Active Directory Agent.
Install the Active Directory Agent on a machine on the network that is accessible to the Web Security appliance and can communicate with all Windows domain controllers in the forest. For best performance, this machine should be as close as possible to the Web Security appliance on the network.
In smaller network environments, you may want to install the Active Directory Agent directly on the
Active Directory server.
Figure 9-5 shows where the Active Directory Agent is installed in the network.
Figure 9-5 Active Directory Agent Workflow
Active Directory
Agent Installation
Web Security Appliance
Active Directory
Server
Client
Note The Active Directory Agent instance used for communicating with the Web Security appliance can also support other products, such as the adaptive security appliance and other Web Security appliances.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-13
Chapter 9 Identities
Identifying Users Transparently
Obtaining, Installing, and Configuring the Active Directory Agent
1.
Before installing and configuring the Active Directory Agent, carefully read the documentation for the Active Directory Agent:
– Installation and any other release notes for Active Directory Agent: http://www.cisco.com/en/US/products/ps6120/prod_release_notes_list.html
2.
3.
4.
5.
6.
7.
8.
– Installation and Setup Guide for the Active Directory Agent : http://www.cisco.com/en/US/products/ps6120/prod_installation_guides_list.html
Verify that your environment meets all requirements for installation and use, including the supported
Active Directory versions and all preinstallation requirements in the Active Directory Agent documentation.
Download the Cisco Active Directory Agent: Go to http://www.cisco.com and search for
“AD_Agent”.
Install the Active Directory Agent on a machine on the network that is accessible to the Web
Security appliance and can communicate with all Windows domain controllers in the forest. For best performance, this machine should be as close as possible to the Web Security appliance on the network. Be sure to follow installation instructions in the Active Directory Agent documentation.
From the Active Directory Agent command line prompt, add your Active Directory server to the
Active Directory Agent as a Domain Controller using the adacfg dc create command.
From the Active Directory Agent command line prompt, add the Web Security appliance to the
Active Directory Agent as a client using the adacfg client create command.
Optionally, you can verify the server and client were successfully added using the adacfg dc list and adacfg client list
commands.
Record the shared secret configured during the Active Directory Agent installation. You must enter the shared secret on the Web Security appliance when you configure the NTLM authentication realm.
Note The Web Security appliance and the Active Directory Agent communicate with each other using the
RADIUS protocol. The appliance and the agent must be configured with the same shared secret to obfuscate user passwords. Other user attributes are not obfuscated.
Transparent User Identification with Novell eDirectory
AsyncOS for Web communicates with the Novell eDirectory Server to maintain an IP address to user name mapping. When a user logs into a client machine through the Novell Client, Novell Client authenticates the user against the Novell eDirectory Server. When authentication succeeds, the client machine IP address is recorded in the Novell eDirectory Server as an attribute (NetworkAddress field) of the user who logged into the workstation.
Consider the following rules and guidelines when you identify users transparently using Novell eDirectory:
• Novell Client must be installed on each client machine, and end users must use it to authenticate against a Novell eDirectory server.
•
•
The Novell LDAP tree used by the Novell client login must be the same LDAP tree configured in the authentication realm.
If the Novell clients use multiple Novell LDAP trees, create an authentication realm for each tree, and then create an authentication sequence that uses each Novell LDAP authentication realm.
9-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Identifying Users Transparently
•
•
When you configure the LDAP authentication realm for Novell eDirectory, you must specify a Bind
DN for the query credentials.
Novell eDirectory must be configured to update the NetworkAddress attribute of the user object when users login. For more information on how to do this, see the following Novell support article: http://www.novell.com/support/php/search.do?cmd=displayKC&docType=kc&externalId=700
4564&sliceId=1&docTypeID=DT_TID_1_1&dialogID=100407203&stateId=0%200%20100405493?
Note Novell eDirectory versions 8.6, 8.7, and 8.8 can be configured to update the NetworkAddress attribute.
•
•
When querying Novell eDirectory, AsyncOS for Web only searches for direct parent groups that the user belongs to. It does not search nested groups.
You can use the “network address” field of the user in Novell eDirectory to obtain the IP address of the workstation from where the user previously logged in.
Rules and Guidelines
Consider the following rules and guidelines when using transparent user identification with any authentication server:
• When using DHCP to assign IP addresses to client machines, ensure the IP address to user name mapping is updated on the Web Security appliance more frequently than the DHCP lease. Use the tuiconfig
CLI command to update the mapping update interval. For more information, see
Using the CLI to Configure Transparent User Identification, page 9-16 .
•
•
•
•
•
•
If an end user logs out of a machine and another user logs in to the same machine before the IP address to user name mapping is updated on the Web Security appliance, then the Web Proxy logs the client as the previous user.
You can configure how the Web Proxy handles transactions when transparent user identification fails. It can grant users guest access, or it can force an authentication prompt to appear to end users.
When a user is shown an authentication prompt due to failed transparent user identification, and the user then fails authentication due to invalid credentials, you can choose whether to allow the user guest access.
When the assigned Identity uses an authentication sequence with multiple realms in which the user exists, AsyncOS for Web fetches the user groups from the realms in the order in which they appear in the sequence.
When you configure an Identity to transparently identify users, the authentication surrogate must be
IP address. You cannot select a different surrogate type.
When you view detailed transactions for users, the Web Tracking page shows which users were identified transparently.
•
•
When you configure an Identity to identify users transparently, AsyncOS for Web only displays sequences in which all realms have transparent user identification enabled.
You can log which users were identified transparently in the access logs and WC3 logs using the
%m and x-auth-mechanism custom fields. A value of SSO_TUI indicates that the user name was obtained by matching the client IP address to an authenticated user name using transparent user identification. (Similarly, a value of SSO_ASA indicates that the user is a remote user and the user name was obtained from a Cisco ASA using the Secure Mobility Solution.)
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-15
Chapter 9 Identities
Identifying Users Transparently
Configuring Transparent User Identification
Step 1
Step 2
Step 3
Create an LDAP authentication realm for a Novell eDirectory server. Configure the realm to use Version
3 and to “Support Novell eDirectory.”
For more information on configuring LDAP options, see
LDAP Authentication, page 21-30
.
For more information on creating authentication realms, see
Creating Authentication Realms, page 21-11
.
Define an Identity group that identifies users transparently using Novell eDirectory: a.
In the “Define Members by Authentication” section, choose “Identify Users Transparently Using
Novell eDirectory.”
Select the LDAP authentication realm that supports Novell eDirectory.
b.
c.
Configure all other Identity options as desired.
For more information on creating Identities, see
Creating Identities, page 9-17 .
Create policies that use the Identity for transparent user identification.
Using the CLI to Configure Transparent User Identification
AsyncOS for Web includes the following CLI commands to use with transparent user identification:
• tuiconfig.
This command allows you to configure some settings associated with transparent user identification. You can use this command in batch mode.
– Configure mapping timeout for AD Agent.
Enter the timeout value for how long AsyncOS caches the IP address to user mapping for an IP address as retrieved from the Active Directory
Agent when there are no updates from the agent.
–
–
Configure mapping timeout for Novell eDirectory.
Enter the timeout value for how long
AsyncOS caches the IP address to user mapping for an IP address as retrieved from the Novell eDirectory server when there are no updates from the server.
Configure query wait time for AD Agent.
Enter the time to wait for a reply from the Active
Directory Agent in seconds. When the query takes more than the timeout value, transparent user identification is considered to have failed. This limits the authentication delay experienced by the end user.
•
– Configure query wait time for Novell eDirectory.
Enter the time to wait for a reply from the
Novell eDirectory server in seconds. When the query takes more than the timeout value, transparent user identification is considered to have failed. This limits the authentication delay experienced by the end user. tuistatus.
This command includes the following subcommands:
–
– adagentstatus.
This command displays the current status of all Active Directory Agents as well as information about their connections with the Windows domain controllers.
listlocalmappings.
This command lists all entries in the IP address to user name mapping stored on the Web Security appliance as retrieved from the Active Directory Agent. It does not list entries stored in the Active Directory Agent.
9-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Identities and Pass-through HTTPS Traffic
Identities and Pass-through HTTPS Traffic
When configured to pass through HTTPS traffic without decrypting, AsyncOS cannot assign an identity to HTTPS transactions based on User Agent or Destination URL.
Creating Identities
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Navigate to the Web Security Manager > Identities page.
Click Add Identity .
Enter a unique name for the Identity group using alphanumeric characters (space characters are allowed).
(Optional) Add a description.
In the Insert Above field, specify the desired location of the identity in the policies table .
When configuring multiple Identity groups, specify a logical order for each group. Carefully order your
Identity groups to ensure that correct matching occurs. Position groups that do not require authentication above the first policy group that requires authentication. For more information about how authentication affects Identity groups, see
Understanding How Authentication Affects Identity Groups, page 9-3
.
Define at least one criterion for Identity membership.
Note If you define multiple criteria, the client request must meet all criteria to match the Identity.
Option
Define Members by User Location
Define Members by Subnet
Description
• Local users, remote users, or both local and remote users.
• Affects the available authentication settings for this
Identity.
•
•
Option only appears when the Secure Mobility Solution is enabled.
IP addresses, CIDR blocks, and subnets to which this
Identity applies.
•
•
Separate multiple addresses with commas.
If you do not enter an address in this field, the Identity group applies to all IP addresses. For example, if you configure the Identity to require authentication, but do not define any other settings, then the Identity acts similarly to the Default Identity Policy with authentication required.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-17
Creating Identities
Chapter 9 Identities
Option
Define Members by Protocol
Define Members by Authentication
Description
• All protocols.
Applies to all protocols the Web Security appliance supports.
• HTTP/HTTPS Only.
Applies to all requests that use
HTTP or HTTPS as the underlying protocol, including
FTP over HTTP and any other protocol tunneled using
HTTP CONNECT.
•
•
•
Native FTP Only.
Applies to native FTP requests only.
No Authentication.
The user is identified primarily by IP address. Go to
.
Require Authentication.
The user is identified by the authentication credentials entered. This option appears when at least one authentication realm is defined. Go to
•
•
Identify Users Transparently.
The user is identified by the current IP address to user name mapping. This option appears when at least one authentication realm is defined that supports transparent user identification. Go to
(For deployments with a Security Management appliance) When configuring Identities on a Security
Management appliance, this option appears when a Web
Security appliance with an authentication realm that supports transparent user identification has been added as a managed appliance.
Identify Users Transparently through Cisco ASA
Integration.
The user is identified by the current IP address to user name mapping received from the Cisco adaptive security appliance (ASA). This option appears when Secure Mobility is enabled and integrates with a
Cisco adaptive security appliance, and when Remote
Users is selected. Go to
.
Note This Define Members by User Location section only appears For more information, see
Achieving Secure Mobility Overview, page 15-1
.
Step 7 To configure the Identity to require authentication: a.
In the Select a Realm or Sequence field, choose a defined authentication realm or sequence.
b.
If you choose an NTLM authentication realm or sequence that contains an NTLM authentication realm, then choose an authentication scheme in the Select a Scheme field.
9-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Creating Identities c.
To grant guest access to users who fail authentication due to invalid credentials, select the Support
Guest privileges check box.
For more information, see
Allowing Guest Access to Users Who Fail Authentication, page 9-8 .
Note You can specify individual authenticated users or groups of users when you use the Identity in a different type of policy group. For more information, see
Configuring Identities in Other
Step 8 d.
Go to
To configure the Identity to use transparent user identification: a.
In the Select a Realm or Sequence field, choose a defined authentication realm that supports transparent user identification, either an LDAP authentication realm that supports Novell eDirectory or an NTLM authentication realm that is enabled for transparent user identification. You can also choose a sequence that contains only realms that support transparent user identification.
Step 9 b.
c.
Choose how to handle transactions when transparent user identification fails: either grant users guest access, or force an authentication prompt to appear to end users.
Transparent user identification might fail if the Web Proxy cannot determine the user who is currently logged in from the specified IP address. That is, if the IP address is not in the IP address to user mapping.
Choose whether or not to allow the user guest access when a user is shown an authentication prompt due to failed transparent user identification and the user then fails authentication due to invalid credentials.
d.
For more information on transparent user identification, see
Identifying Users Transparently, page 9-10
.
Go to
To configure the Identity to use transparent user identification by integrating with a Cisco adaptive security appliance (ASA): a.
In the Select a Realm or Sequence field, choose a defined authentication realm or sequence.
b.
If you choose an NTLM authentication realm or sequence that contains an NTLM authentication realm, then choose the authentication scheme in the Select a Scheme field.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-19
Chapter 9 Identities
Creating Identities
Note You can specify individual authenticated users or groups of users when you use the Identity
in a different type of policy group. For more information, see Configuring Identities in Other
.
Step 10 c.
Go to
.
View the settings in the Authentication Surrogate section.
Step 11
The options vary depending on the Web Proxy deployment mode.
Choose how transactions used for authenticating the client are associated with a user (either by IP address or by using a cookie) after the user has authenticated successfully.
Surrogate Type
IP Address
Persistent Cookie The Web Proxy tracks an authenticated user on a particular application by generating a persistent cookie for each user per application. Closing the application does not remove the cookie.
Session Cookie The Web Proxy tracks an authenticated user on a particular application by generating a session cookie for each user per domain per application. (However, when a user provides different credentials for the same domain from the same application, the cookie is overwritten.) Closing the application removes the cookie.
No Surrogate
Description
The Web Proxy tracks an authenticated user at a particular IP address. To achieve transparent user identification, you must choose IP-based authentication.
The Web Proxy does not use a surrogate to cache the credentials, and it tracks an authenticated user for every new TCP connection. When you choose this option, the web interface disables other settings that no longer apply.
This option is available only in explicit forward mode and when you disable credential encryption on the Network > Authentication page.
You might want to use IP-based authentication when:
• There is only one user on a client machine and you want users to be able to achieve single sign-on behavior.
•
•
You want to use transparent user identification.
You want to create an Identity that works with applications that do not work with cookie-based surrogates, such as MSN Messenger.
You might want to choose cookie-based authentication when there are multiple users on one machine, such as a Citrix server or a kiosk shared by many users.
For more information about which authentication surrogates are supported with other configurations and
different types of requests, see Tracking Authenticated Users, page 21-29
.
9-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Creating Identities
Note You can define a timeout value for the authentication surrogate for all requests. For more information, see
Configuring Global Authentication Settings, page 21-17 .
Step 12
Step 13
In the Explicit Forward Request field, choose whether or not the surrogate used for transparent requests should also be used for explicit requests.
Enabling credential encryption automatically enables this field.
This option appears only when the Web Proxy is deployed in transparent mode.
Optionally, expand the Advanced section to define additional membership requirements.
Step 14 To define Identity group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
describes Identity group advanced options.
Table 9-2 Identity Group Advanced Options
Advanced Option Description
Proxy Ports To define policy group membership by the proxy port used to access the Web
Proxy, enter one or more port numbers in the Proxy Ports field. Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Note: Cisco recommends defining policy group membership by the proxy port only when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. If you define policy group membership by the proxy port when client requests are transparently redirected to the appliance, some requests might be denied.
URL Categories Choose the user defined or predefined URL categories.
User Agents
Membership for both user defined and predefined URL categories is excluded by default, meaning the Web Proxy ignores all categories unless they are selected in the Add column.
Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
For more information on creating user agent based policies, see
Agent Based Policies, page 8-11 .
Step 15 Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-21
Chapter 9 Identities
Configuring Identities in Other Policy Groups
Note When you commit a change to Identities, end-users must re-authenticate.
Configuring Identities in Other Policy Groups
Every non-Identity policy group specifies at least one Identity group as part of its policy group membership. You can configure a non-Identity policy group to use multiple Identity groups, and you can specify which users or groups of users are authorized to access the web using the policy group.
You might want to specify multiple Identity groups in a policy group under the following circumstances:
•
•
You have an Identity group defined for HTTP transactions and another Identity group defined for native FTP transactions. You can create a single non-Identity policy group that applies to both HTTP and native FTP transactions
Separate Identity groups are defined for each authentication realm. You want to create one Access
Policy group that defines the same access control settings for users in multiple authentication realms.
Note You can also specify All Identities and configure the authenticated users.
shows a policy group that uses multiple Identities.
Figure 9-6 Multiple Identities in a Policy Group
The specified user groups in this Identity are authorized for this policy group.
All authenticated users in this Identity are authorized for this policy group.
This Identity uses an authentication sequence and this policy group applies to one realm in the sequence.
9-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Configuring Identities in Other Policy Groups
Note If an Identity group becomes disabled, then that Identity group is removed (not disabled) from any non-Identity policy group that used it. If the Identity group becomes enabled again, the non-Identity policy groups that previously used the Identity do not automatically include the enabled Identity. Identity groups become disabled due to a deleted authentication realm or sequence.
To configure Identity group information in a policy group:
Step 1
Step 2
Create a new policy group or edit the membership of an existing policy group for Access, Decryption,
Routing, Data Security, or External DLP Policy.
Scroll down to the Identities and Users section.
Step 3
Step 4
Step 5
Step 6
Choose one of the following options from the dropdown menu:
• Select One or More Identities.
This option allows you to configure specific Identity groups. Go to
.
• All Identities.
This option specifies all configured Identity groups. Go to step
.
Under the Identity column, choose the Identity group to apply to this policy group.
If you choose an Identity that requires authentication, you can specify which users are authorized for this policy group. These users must authenticate. In the Authorized Users and Groups column, choose one of the following options:
•
•
All authenticated users.
You can configure the Identity in this policy group to apply to all authenticated users in the Identity group by default. If the Identity group specifies an authentication sequence, you can configure this policy group to apply to one authentication realm or all realms in the sequence.
Selected Groups and Users.
You can configure the Identity in this policy group to apply to specific users. You can define users by group object or user object. Click the link for either Groups or Users, and enter the group or user information on the page that opens.
When you add groups of users for an Identity using an NTLM authentication realm, the Edit Groups page displays the first 500 matching entries, omitting built-in groups.
•
•
Guests (users failing authentication).
If the Identity group allows guest access, you can configure this policy group to apply to all users who fail to authenticate in this Identity. For more information, see
Allowing Guest Access to Users Who Fail Authentication, page 9-8 .
All users (authenticated and unauthenticated users).
You can configure this policy group to apply to every user in every Identity group. This option only appears when you choose All Identities.
When you apply the policy group to all users, you must specify at least one advanced option to distinguish this policy group from the global policy.
Optionally, if you configured specific Identity groups, you can add another Identity group to this policy group by clicking Add Identity .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-23
Chapter 9 Identities
Example Identity Policies Tables
Step 7
Step 8
If you add another Identity group, repeat steps
.
Submit and commit your changes.
Example Identity Policies Tables
This section shows some sample Identity groups defined in an Identity policies table and describes how the Web Proxy evaluates different client requests using each Identity policies table.
Example 1
group applies to a particular subnet and does not require authentication. The second Identity group applies to all subnets and requests for URLs in the “Proxies & Translators” category, and requires authentication on RealmA. The third Identity group applies to all subnets, has no advanced options defined, and requires authentication on RealmA. The global Identity policy applies to all subnets (by definition) and does not require authentication.
Table 9-3 Policies Table Example 1
Order
1
2
3
Global Identity policy
Subnet(s)
10.1.1.1
All
All
All
(by default)
Authentication
Required?
No
Yes
Realm or
Sequence
N/A
RealmA
Yes
No
RealmA
N/A
Advanced Options none
URL Category is “Proxies &
Translators” none
N/A (none by default)
The Web Proxy matches client requests to Identity groups in this scenario differently, depending on the client’s subnet and the URL category of the request:
•
•
Any client on subnet 10.1.1.1 for any URL.
When a client on subnet 10.1.1.1 sends a request for any URL, the Web Proxy evaluates the first Identity group and determines that the client subnet matches the first Identity group subnet. Then it determines that no authentication is required and no advanced options are configured, so it assigns the first Identity group to the transaction.
Any client on a subnet other than 10.1.1.1 for URLs in the “Proxies & Translators” URL category.
When a client on a subnet other than 10.1.1.1 sends a request for a URL in the “Proxies
& Translators” category, the Web Proxy evaluates the first Identity group and determines that the client subnet is not listed in the first Identity group’s list of subnets. Therefore, it evaluates the second Identity group, and then determines that the client subnet is listed in the second Identity group’s list of subnets. Then it determines that the URL in the request matches the URL category in the second Identity group’s advanced section. Then it determines that the second Identity group requires authentication, so it tries to authenticate the user against the authentication server(s) defined in RealmA. If the user exists in RealmA, the Web Proxy assigns the second Identity group to the transaction. If the user does not exist in RealmA, AsyncOS terminates the client request because the client failed authentication.
9-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Example Identity Policies Tables
• Any client on a subnet other than 10.1.1.1 for any URL not in the “Proxies & Translators” URL category.
When a client on a subnet other than 10.1.1.1 sends a request for a URL, the Web Proxy evaluates the first Identity group and determines that the client subnet is not listed in the first Identity group’s list of subnets. Therefore, it evaluates the second Identity group, and then determines that the client subnet is listed in the second Identity group’s list of subnets. Then it determines that the
URL in the request does not match the URL category in the second Identity group’s advanced section. Therefore, it evaluates the third Identity group, and then determines that the client subnet is listed in the third Identity group’s list of subnets. The third Identity group does not have any advanced options configured, so continues to compare against authentication requirements. Then it determines that the third Identity group requires authentication, so it tries to authenticate the user against the authentication server(s) defined in RealmA. If the user exists in RealmA, the Web Proxy assigns the third Identity group to the transaction. If the user does not exist in RealmA, the Web
Proxy terminates the client request because the client failed authentication.
Note that in this scenario, most client requests will never match the global Identity group because of the user defined Identity group (the third group) that applies to all subnets, has no advanced options, and requires authentication. Any client on the network that does not match the first or second Identity group will match the third Identity group. The exception to this is for HTTPS requests when the appliance is in transparent mode with cookie-based authentication. Any client on a subnet other than 10.1.1.1 will match the global Identity group even though it requires authentication.
Example 2
shows a policies table with two user defined Identity groups. The first Identity group applies to all subnets, requires authentication, and specifies RealmA for authentication. The second Identity group applies to all subnets, requires authentication, and specifies RealmB for authentication. Neither
Identity group has any advanced option configured. The global Identity group applies to all subnets, requires authentication, and specifies the All Realms sequence for authentication.
Table 9-4 Policies Table Example 2
Order
1
2
Global Identity policy
Subnet(s)
All
All
All
Authentication
Required?
Yes
Yes
Yes
Realm or
Sequence
RealmA
RealmB
All Realms
Advanced Options none none
N/A (none by default)
In this scenario, when a client sends a request for a URL, the Web Proxy evaluates the first Identity group and determines that the Identity group applies to all subnets and has no advanced options configured. It determines that the Identity group requires authentication and that the only realm specified in the
Identity group is RealmA. Therefore, in order for a client on any subnet to pass authentication, it must exist in RealmA .
When a client that exists in RealmA sends a request for a URL, the client passes authentication and the
Web Proxy assigns the first Identity group to the transaction. When a client that does not exist in RealmA sends a request for a URL, the client fails authentication and the Web Proxy terminates the request.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-25
Chapter 9 Identities
Example Identity Policies Tables
Note that when a client in RealmB sends a request for a URL, the Web Proxy does not match the client request with the second Identity group. This is because a previous Identity group already applies to the same subnets (and the exact same advanced options, which in this example is none) in the second Identity group and it requires authentication, but from RealmA instead. Clients in RealmB do not “fall through” to the second Identity group.
If you want users in RealmB to have different Access, Decryption, and Routing Policy settings applied to them than users in RealmA, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Create an authentication sequence that contains both RealmA and RealmB. You can choose the order of the realms in the sequence depending on your business needs.
Create one Identity group and configure it for whichever subnets on which users in RealmA and RealmB might exist. In this example, you would configure the Identity group for all subnets.
Configure the Identity group to use the sequence you defined in step 1
.
Create two user defined policy groups of the same type, such as Access Policies, and configure them both to use the Identity group with the authentication sequence you defined in step
Configure the first policy group to only apply to users in one realm, such as RealmA. You can do this by specifying a particular realm in the sequence, or by using authentication groups, or entering specific usernames.
Configure the second policy group to only apply to users in the other realm, such as RealmB. You can do this by specifying a particular realm in the sequence, or by using authentication groups, or entering specific usernames.
When you configure the appliance in this way, any client that sends a request for a URL must exist in either realm in the sequence (RealmA or RealmB) in order to pass authentication at the Identity level.
Once an Identity has been assigned to the client request, the Web Proxy can compare the client request against the other policy types and determine which policy group, such as an Access Policy group, to match and then apply those control settings. In this example, the Web Proxy matches users in RealmA with the policy group configured in step
, and matches users in RealmB with the policy group configured in step
9-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Example Identity Policies Tables
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-27
Example Identity Policies Tables
Chapter 9 Identities
9-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Example Identity Policies Tables
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-29
Example Identity Policies Tables
Chapter 9 Identities
9-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 9 Identities
Example Identity Policies Tables
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
9-31
Example Identity Policies Tables
Chapter 9 Identities
9-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
10
Access Policies
This chapter contains the following information:
•
Access Policies Overview, page 10-1
•
•
•
•
Evaluating Access Policy Group Membership, page 10-3
Creating Access Policies, page 10-4
Controlling HTTP and Native FTP Traffic, page 10-7
Blocking Specific Applications and Protocols, page 10-12
Access Policies Overview
AsyncOS for Web uses multiple web security features in conjunction with its Web Proxy and DVS engine to control web traffic, protect networks from web-based threats, and enforce organization acceptable use policies. You can define policies that determine which HTTP connections are allowed and blocked.
To configure the appliance to handle HTTP requests, perform the following tasks:
Step 1
Step 2
Enable the Web Proxy.
To allow or block HTTP traffic, you must first enable the Web Proxy. Usually, the Web Proxy is enabled during the initial setup using the System Setup Wizard. For more information, see
Configuring the Web Proxy, page 6-2 .
Create and configure Access Policy groups.
After the Web Proxy is enabled, you create and configure
Access Policy groups to determine how to handle each request from each user. For more information, see
Access Policy Groups, page 10-1 .
Access Policy Groups
Access Policies define how the Web Proxy handles HTTP and FTP requests and decrypted HTTPS connections for network users. You can apply different actions to specified groups of users. You can also specify which ports the Web Proxy monitors for HTTP transactions.
Note HTTP PUT and POST requests are handled by Outbound Malware Scanning, Cisco IronPort Data
Security, and External DLP Policies. For more information, see
Data Security and External DLP Policies
and
Outbound Malware Scanning, page 13-1 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-1
Chapter 10 Access Policies
Access Policies Overview
When the Web Proxy receives an HTTP request on a monitored port or a decrypted HTTPS connection, it compares the request to the Access Policy groups to determine which Access Policy group to apply.
After it assigns the request to an Access Policy group, it can determine what to do with the request. For more information about evaluating policy group membership, see
Policy Group Membership, page 8-7
.
The Web Proxy can perform any of the following actions on an HTTP request or decrypted HTTPS connection:
• Allow.
The Web Proxy permits the connection without interruption. Allowed connections may not have been scanned by the DVS engine.
•
•
Block.
The Web Proxy does not permit the connection and instead displays an end user notification page explaining the reason for the block.
Redirect.
The Web Proxy does not allow the connection to the originally requested destination server and instead connects to a different specified URL. You might want to redirect traffic at the appliance if your organization published the links to an internal site, but the location of the site changed since publication, or if you do not have control over the web server. For more information about redirecting traffic, see
Redirecting Traffic, page 18-21 .
Note The preceding actions are final actions that the Web Proxy takes on a client request. The Monitor action that you can configure for Access Policies is not a final action. For more information, see
Understanding the Monitor Action, page 10-2 .
After the Web Proxy assigns an Access Policy to an HTTP or decrypted HTTPS request, it compares the request to the policy group’s configured control settings to determine which action to apply. You can configure multiple security components to determine how to handle HTTP and decrypted HTTPS requests for a particular policy group. For more information about the security components that you can configure and how the Web Proxy uses Access Policy groups to control HTTP traffic, see
HTTP and Native FTP Traffic, page 10-7 .
Understanding the Monitor Action
When the Web Proxy compares a transaction to the control settings, it evaluates the settings in order.
Each control setting can be configured to perform one of the following actions for Access Policies:
• Monitor
•
•
Allow
Block
• Redirect
All actions except Monitor are final actions that the Web Proxy applies to a transaction. A final action is an action that causes the Web Proxy to stop comparing the transaction to the rest of the control settings.
The Monitor action is an intermediary action. The Web Proxy continues comparing the transaction to the other control settings to determine which final action to apply.
For example, if an Access Policy is configured to monitor a suspect user agent, the Web Proxy does not make a final determination about a request from the user agent. If an Access Policy is configured to block a particular URL category, then any request to that URL category is blocked before fetching the content from the server regardless of the server’s reputation score.
10-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Evaluating Access Policy Group Membership
Note When a control setting matches Monitor and the transaction is ultimately allowed, the Web Proxy logs the monitored setting in the access logs. For example, when a URL matches a monitored URL category, the Web Proxy logs the URL category in the access logs.
shows the order that the Web Proxy uses when evaluating control settings for
Access Policies. The flow diagram shows that the only actions applied to a transaction are the final actions: Allow, Block, and Redirect.
Note
shows the order the Web Proxy uses when evaluating control settings for
Decryption Policies and
shows the order when evaluating control settings for
Cisco IronPort Data Security Policies.
Evaluating Access Policy Group Membership
After the Web Proxy assigns an Identity to a client request, the Web Proxy evaluates the request against the other policy types to determine which policy group it belongs for each type. When the HTTPS Proxy is enabled, it applies HTTP and decrypted HTTPS requests against the Access Policies. When HTTPS
Proxy is not enabled, by default, it evaluates HTTP and all HTTPS requests against the Access Policies.
The Web Proxy applies the configured policy control settings to a client request based on the client request’s policy group membership.
To determine the policy group that a client request matches, the Web Proxy follows a specific process for matching the group membership criteria. During this process, it considers the following factors for group membership:
•
•
Identity.
Each client request either matches an Identity, fails authentication and is granted guest access, or fails authentication and gets terminated. For more information about evaluating Identity group membership, see
Evaluating Identity Group Membership, page 9-2 .
Authorized users.
If the assigned Identity requires authentication, the user must be in the list of authorized users in the Access Policy group to match the policy group. The list of authorized users can be any of the specified groups or users or can be guest users if the Identity allows guest access.
• Advanced options.
You can configure several advanced options for Access Policy group membership. Some options (such as proxy port and URL category) can also be defined within the
Identity. When an advanced option is configured in the Identity, it is not configurable in the Access
Policy group level.
The information in this section gives an overview of how the Web Proxy matches client requests to
Access Policy groups. For more details about exactly how the Web Proxy matches client requests, see
Matching Client Requests to Access Policy Groups, page 10-4 .
The Web Proxy sequentially reads through each policy group in the policies table. It compares the client request status to the membership criteria of the first policy group. If they match, the Web Proxy applies the policy settings of that policy group.
If they do not match, the Web Proxy compares the client request to the next policy group. It continues this process until it matches the client request to a user defined policy group. If it does not match a user defined policy group, it matches the global policy group. When the Web Proxy matches the client request to a policy group or the global policy group, it applies the policy settings of that policy group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-3
Chapter 10 Access Policies
Creating Access Policies
Matching Client Requests to Access Policy Groups
groups.
Figure 10-1 Policy Group Flow Diagram for Access Policies
Creating Access Policies
You can create Access Policy groups based on combinations of several criteria, such as one or more
Identities or the URL category of the destination site. You must define at least one criterion for policy group membership. When you define multiple criteria, the client request must meet all criteria to match the policy group. However, the client request needs to match only one of the configured Identities.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-4
Chapter 10 Access Policies
Creating Access Policies
For more information about how the Web Proxy matches a client request with a policy group, see
Evaluating Access Policy Group Membership, page 10-3
and Matching Client Requests to Access Policy
.
You define policy group membership on the Web Security Manager > Access Policies page.
To create an Access Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a name for the policy group, and in the Description field, optionally add a description.
Note Each policy group name must be unique and only contain alphanumeric characters or the space character.
Step 4
Step 5
Step 6
In the Insert Above Policy field, choose where in the policies table to place the policy group.
When configuring multiple policy groups you must specify a logical order for each group. Carefully order your policy groups to ensure that correct matching occurs.
In the Identities and Users section, choose one or more Identity groups to apply to this policy group.
For more information on how to do this, see
Configuring Identities in Other Policy Groups, page 9-22
.
Optionally, expand the Advanced section to define additional membership requirements.
Step 7 To define policy group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-5
Chapter 10 Access Policies
Creating Access Policies
Table 10-1 describes the advanced options you can configure for Access Policy groups.
Table 10-1 Access Policy Group Advanced Options
Advanced Option Description
Protocols Choose whether or not to define policy group membership by the protocol used in the client request. Select the protocols to include.
“All others” means any protocol not listed above this option.
Proxy Ports
Note: When the HTTPS Proxy is enabled, only Decryption Policies apply to
HTTPS transactions. You cannot define policy membership by the HTTPS protocol for Access, Routing, Outbound Malware Scanning, Data Security, or External DLP
Policies.
Choose whether or not to define policy group membership by the proxy port used to access the Web Proxy. Enter one or more port numbers in the Proxy Ports field.
Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Subnets
Time Range
Cisco recommends only defining policy group membership by the proxy port when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. If you define policy group membership by the proxy port when client requests are transparently redirected to the appliance, some requests might be denied.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by subnet or other addresses.
You can choose to use the addresses that may be defined with the associated
Identity, or you can enter specific addresses here.
Note: If the Identity associated with this policy group defines its membership by addresses, then in this policy group you must enter addresses that are a subset of the Identity’s addresses. Adding addresses in the policy group further narrows down the list of transactions that match this policy group.
Choose whether or not to define policy group membership by a defined time range.
Choose the time range from the Time Range field and then choose whether this policy group should apply to the times inside or outside the selected time range.
For more information on creating time based policies, see
For more information on creating time ranges, see
Creating Time Ranges, page 8-9
.
URL Categories Choose whether or not to define policy group membership by URL categories.
Select the user defined or predefined URL categories.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
10-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Controlling HTTP and Native FTP Traffic
Table 10-1 Access Policy Group Advanced Options (continued)
Advanced Option Description
User Agents Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
User Location
For more information on creating user agent based policies, see
Agent Based Policies, page 8-11
.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by user location, either remote or local.
This option only appears when the Secure Mobility Solution is enabled. For more information, see
Achieving Secure Mobility Overview, page 15-1 .
Step 8
Step 9
Step 10
Submit your changes.
Configure Access Policy group control settings to define how the Web Proxy handles transactions.
The new Access Policy group automatically inherits global policy group settings until you configure options for each control setting. For more information,
Controlling HTTP and Native FTP Traffic, page 10-7
.
Submit and commit your changes.
Controlling HTTP and Native FTP Traffic
After the Web Proxy assigns an HTTP, native FTP, or decrypted HTTPS request to an Access Policy group, the request inherits the control settings of that policy group. The control settings of the Access
Policy group determine whether the appliance allows, blocks, or redirects the connection.
Configure control settings for Access Policy groups on the Web Security Manager > Access Policies page.
Figure 10-2 shows where you can configure control settings for the Access Policy groups.
Figure 10-2 Creating Secure Access Policies
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-7
Chapter 10 Access Policies
Controlling HTTP and Native FTP Traffic
You can configure the following settings to determine what action to take on the request:
•
•
•
•
Protocols and User Agents.
URL Categories.
For more information, see
.
Applications.
For more information, see
Protocols and User Agents, page 10-9
Objects.
For more information, see
.
• Web Reputation and Anti-Malware Filtering.
For more information, see
After an Access Policy group is assigned to a request, the control settings for the policy group are evaluated to determine whether to allow, block, or redirect the request. For more information about assigning an Access Policy group to a request, see
Policy Group Membership, page 8-7
.
Figure 10-3 on page 10-9 shows how the Web Proxy determines which action to take on a request after
it has assigned a particular Access Policy to the request.
10-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Figure 10-3 Applying Access Policy Actions
Controlling HTTP and Native FTP Traffic
the destination server. The web reputation score of the server is evaluated only once, but the result is applied at two different points in the decision flow.
Protocols and User Agents
You can use the Protocols and User Agents settings on the Access Policies > Protocols and User Agents page to control policy group access to protocols and configure blocking for particular client applications
(also known as user agents), such as instant messaging clients, web browsers, and Internet phone services. You can also configure the appliance to tunnel HTTP CONNECT requests on specific ports.
With tunneling enabled, the appliance passes HTTP traffic through specified ports without evaluating it.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-9
Chapter 10 Access Policies
Controlling HTTP and Native FTP Traffic
.
Figure 10-4 Settings for Controlling Protocols and User Agents
Note When the HTTPS Proxy is enabled, you can only use Decryption Policies to control access to HTTPS transactions. You cannot configure Access Policies on this page to block HTTPS connections.
URL Categories
AsyncOS for Web allows you to configure how the appliance handles a transaction based on the URL category of a particular HTTP or HTTPS request. Using a predefined category list, you can choose to monitor or block content by category. You can also create custom URL categories and choose to allow, monitor, block, warn, or redirect traffic for a website in the custom category. You can use custom URL categories to create block and allow lists based on destination.
For information about enabling a URL filtering engine, see
Filters for Access Policy Groups, page 18-10 .
You can also use the Access Policies > URL Categories page to filter adult content by enforcing safe
searches and site content ratings. For more information, see Filtering Adult Content, page 18-18
.
Applications
You can use the Access Policies > Applications Visibility and Control page to configure the Web Proxy block or allow applications by application type or a particular application. You can also apply controls to particular application behaviors within a particular application, such as file transfers.
Cisco IronPort Web Usage Controls includes the Application Visibility and Control engine (AVC engine) which allows you to apply deeper controls to particular application types. The AVC engine is an acceptable use policy component that inspects web traffic to gain deeper understanding and control of web traffic used for applications.
10-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Controlling HTTP and Native FTP Traffic
For more information on enabling the AVC engine, see
Enabling the AVC Engine, page 19-2
. For more information on configuring application settings in Access Policies, see
Object Blocking
You can use the settings on the Access Policies > Objects page to configure the Web Proxy to block file downloads based on file characteristics, such as file size and file type. For more information about blocking a specific object or MIME-type, see
Blocking Specific Applications and Protocols, page 10-12 .
Note When you block Microsoft Office files in the Block Object Type section, it is possible that some
Microsoft Office files will not be blocked. If you need to be sure to block all Microsoft Office files, add application/x-ole
in the Block Custom MIME Types field. However, blocking this custom MIME type also blocks all Microsoft Compound Object format types, such as Visio files and some third party applications.
Figure 10-5 Blocking Object Types
Web Reputation and Anti-Malware
The Web Reputation and Anti-Malware Filtering policy inherits global settings respective to each component. To customize filtering and scanning for a particular policy group, you can use the Web
Reputation and Anti-Malware Settings pull-down menu to customize monitoring or blocking for malware categories based on malware scanning verdicts and to customize web reputation score thresholds.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-11
Chapter 10 Access Policies
Blocking Specific Applications and Protocols
For more information, see
Configuring Web Reputation and Anti-Malware in Access Policies, page 20-11
.
Blocking Specific Applications and Protocols
You can configure how the appliance manages some kinds of applications based on the port being used:
•
•
Port 80.
You can control how the Web Security appliance manages these applications using Access
Policies, but only as they are accessed via HTTP tunneling on port 80.
Ports other than 80.
You can block these applications on other ports by using the L4 Traffic
Monitor.
Use the Web Security Manager > Access Policies page to manage access and monitoring for these types of applications on a more granular (per policy) level. Use the L4 Traffic Monitor to manage access and monitoring on a more global basis.
Blocking on Port 80
To block access to these types of applications where port 80 is used, you can use the Web Security
Manager > Access Policies page. The Access Policies page provides several methods for blocking access. You can block access by clicking on any of the following columns for a particular policy group:
•
•
Protocols and User Agents
URL Categories
• Objects
You can block access to predefined URL categories such as "Chat and Instant Messaging" and "Peer File
Transfer", or create your own custom URL categories. You can block specific applications based on their
“agent patterns” or signatures.
You can apply some or all of these methods on various Access Policies by creating additional Access
Policy groups. For details on how to create additional Access Policy groups, see
Policy: Protocols and User Agents
You can create a rule that blocks a particular user agent based on its pattern using Regular Expressions.
You block access to applications based on their agent pattern similarly for the different Access Policies:
• User defined policies — On the Web Security Manager > Access Policies page, click the value in the Protocols and User Agents column for the desired policy. Choose Define Applications Custom
Settings.
• Global Policy — On the Web Security Manager > Access Policies page, click the value in the
Protocols and User Agents column for the Global Policy.
Once you view the Access Policies: Protocols and User Agents: Policy_Name page, add user agent patterns (also called signatures) to the Block Custom User Agents section of the page.
10-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Figure 10-6 Entering Agent Patterns to Block
Blocking Specific Applications and Protocols
Note You can click the Example User Agent Patterns link for a list of some example user agent patterns.
provides a list of common patterns.
Table 10-2 Common Application Agent Patterns
Application
AOL Messenger
BearShare
Search in Setting
Request headers
Response header
HTTP Header
User-Agent
Server
Signature
Gecko/
Bearshare eDonkey Request e2dk
Gnutella
Gnucleus
Kazaa Request headers User-Agent
Kazaa
Kazaaclient:
KazaClient
Kazaaclient:
Kazaa
Morpheus
MSN Messenger
Trillian
Request headers
Response header
Request headers
Request headers
Windows Messenger Request headers
Yahoo Messenger Request headers
Yahoo Messenger Request headers
X-Kazaa-Network
Server
User-Agent
User-Agent
User-Agent
Host
User-Agent
KaZaA
Morpheus
MSN Messenger
Trillian/
MSMSGS msg.yahoo.com
ymsgr
This is not a comprehensive list, as signatures change occasionally, and new applications are developed.
You can find additional signatures at various websites, including the following websites:
• http://www.user-agents.org/
•
• http://www.useragentstring.com/pages/useragentstring.php
http://www.infosyssec.com/infosyssec/security/useragentstrings.shtml
Note Cisco IronPort does not maintain, verify, or support the user agent listings at any of these websites.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-13
Chapter 10 Access Policies
Blocking Specific Applications and Protocols
Policy: URL Categories
You can specify categories of URLs to block, including the predefined “Chat and Instant Messaging” and “Peer File Transfer” categories. You can also add specific custom URL categories should you want to add a URL that is not already included in the predefined categories. You may then add the custom category to the list of blocked URLs.
For more information about using URL Categories, see
.
Policy: Objects
You can block some Peer-to-Peer files directly, via the Access Policies: Objects: Global Policy page.
On the Web Security Manager > Access Policies page, click on the value in the Objects column for the desired policy.
In the Block Object Type section, check any boxes in the P2P Metafiles group. You can add custom
MIME (Multipurpose Internet Mail Extensions) types by entering them in the Custom MIME Types field. For example, entering the application/x-zip
signature blocks ZIP archive files.
Blocking on Ports Other Than 80
If these applications are using ports other than 80, you may want to block access to a specific server or block of IP addresses to which the client must connect. To manage these applications on other ports, use the L4 Traffic Monitor. The L4 Traffic monitor allows you to restrict access on specific ports. However, the restriction is global, so it will apply to all traffic on that port.
10-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Blocking Specific Applications and Protocols
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-15
Blocking Specific Applications and Protocols
Chapter 10 Access Policies
10-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 10 Access Policies
Blocking Specific Applications and Protocols
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
10-17
Blocking Specific Applications and Protocols
Chapter 10 Access Policies
10-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
11
Working with External Proxies
This chapter contains the following topics:
•
Working with External Proxies Overview, page 11-1
•
•
•
•
Routing Traffic to Upstream Proxies, page 11-1
Adding External Proxy Information, page 11-2
Evaluating Routing Policy Group Membership, page 11-3
Creating Routing Policies, page 11-5
Working with External Proxies Overview
The Web Security appliance is a proxy-compatible device, and is easily deployed within an existing proxy environment. However, it is recommended that you place the appliance downstream from existing proxy servers, meaning closer to the clients.
You can configure the appliance to work with multiple existing, upstream proxies. Use the Network >
Upstream Proxies page to define upstream proxies or to modify existing settings. You define groups of proxies, and you can configure the appliance to use load balancing and failover features when connecting to multiple proxies.
After defining proxy groups, you can create Routing Policies to determine whether the Web Proxy connects to the server identified by the client or to a member of one the proxy groups.
For more information about using Routing Policies to route transactions, see
. For more information about defining external proxies, see
External Proxy Information, page 11-2 .
Routing Traffic to Upstream Proxies
When the Web Proxy does not deliver a response from the cache, it can direct client requests directly to the destination server or to an external proxy on the network. You use Routing Policies to create rules that indicate when and to where to direct transactions. A Routing Policy determines to where to pass the client request, either to another proxy (as defined by the proxy group) or to the destination server. It addresses the question, “from where to fetch content?” You might want to create Routing Policies if you have a highly distributed network.
Figure 11-1 shows Routing Policies on the Web Security Manager > Routing Policies page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
11-1
Adding External Proxy Information
Figure 11-1 Routing Policies
Chapter 11 Working with External Proxies
When you define multiple external proxies in a proxy group, the Web Proxy can use load balancing techniques to distribute requests to different proxies defined in the group. You can choose the following load balancing techniques:
•
•
None (failover).
The Web Proxy directs transactions to one external proxy in the group. It tries to connect to the proxies in the order they are listed. If one proxy cannot be reached, the Web Proxy attempts to connect to the next one in the list.
Fewest connections.
The Web Proxy keeps track of how many active requests are with the different proxies in the group and it directs a transaction to the proxy currently servicing the fewest number of connections.
•
•
Hash based.
The Web Proxy uses a hash function to distribute requests to the proxies in the group.
The hash function uses the proxy ID and URL as inputs so that requests for the same URL are always directed to the same external proxy.
Least recently used.
The Web Proxy directs a transaction to the proxy that least recently received a transaction if all proxies are currently active. This setting is similar to round robin except the Web
Proxy also takes into account transactions a proxy has received by being a member in a different proxy group. That is, if a proxy is listed in multiple proxy groups, the “least recently used” option is less likely to overburden that proxy.
• Round robin.
The Web Proxy cycles transactions equally among all proxies in the group in the listed order.
For information about creating Routing Policies, see
Creating Routing Policies, page 11-5 .
Note If your network contains an upstream proxy that does not support FTP connections, then you must create a Routing Policy that applies to all Identities and to just FTP requests. Configure that Routing Policy to directly connect to FTP servers or to connect to a proxy group whose proxies all support FTP connections.
Adding External Proxy Information
To define external proxy information, you create a proxy group. A proxy group is an object that defines a list of proxies and their connection information and the load balancing technique to use when distributing requests to proxies in the group. You can create multiple proxy groups and can define multiple proxies within a group.
AsyncOS for Web allows you to enter the same proxy server information multiple times into the same proxy group. You might want to include the same proxy server multiple times to allow unequal load distribution among the proxies in the proxy group.
11-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 11 Working with External Proxies
Evaluating Routing Policy Group Membership
Note You can only specify one existing proxy during the System Setup Wizard. AsyncOS creates a proxy group with one proxy using the information you enter in the System Setup Wizard. You can specify additional proxies in the web interface after initial setup.
To create a proxy group:
Step 1 Navigate to Network > Upstream Proxies, and click Add Group .
The Add Upstream Proxy Group page appears.
Step 2
Step 3
Step 4
Step 5
Step 6
Enter a name for the proxy group in the Name field.
In the Proxy Servers section, define at least one external proxy.
a.
b.
In the Proxy Address field, enter the hostname or IP address of the proxy server.
In the Port field, enter the port number used to access the proxy.
c.
d.
In the Reconnection Attempts field, enter the number of times the Web Proxy should try to connect to the proxy server before ignoring it.
Optionally, you can define another proxy server by clicking Add Row.
In the Load Balancing field, choose the method the Web Proxy should use to distribute transactions to the proxies when the group contains multiple proxies.
.
In the Failure Handling field, choose how the Web Proxy should handle transactions when all proxies in the group fail.
Submit and commit your changes.
Evaluating Routing Policy Group Membership
After the Web Proxy assigns an Identity to a client request, it evaluates the request against the other policy types to determine which policy group it belongs for each type. Any request that does not get terminated due to failed authentication gets evaluated against the Routing Policies to determine from where to fetch the data.
Once the Web Proxy assigns a Routing Policy group to a request, it fetches the content from the location configured for the policy group, either from a configured proxy group or directly from the server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
11-3
Chapter 11 Working with External Proxies
Evaluating Routing Policy Group Membership
To determine the policy group that a client request matches, the Web Proxy follows a specific process for matching the group membership criteria. During this process, it considers the following factors for group membership:
•
•
Identity.
Each client request either matches an Identity, fails authentication and is granted guest access, or fails authentication and gets terminated. For more information about evaluating Identity group membership, see
Evaluating Identity Group Membership, page 9-2
.
Authorized users.
If the assigned Identity requires authentication, the user must be in the list of authorized users in the Routing Policy group to match the policy group.
• Advanced options.
You can configure several advanced options for Routing Policy group membership. Some options (such as proxy port and URL category) can also be defined within the
Identity. When an advanced option is configured in the Identity, it is not configurable in the Routing
Policy group level.
The information in this section gives an overview of how the appliance matches client requests to
Routing Policy groups. For more details about exactly how the appliance matches client requests, see
Matching Client Requests to Routing Policy Groups, page 11-4
.
The Web Proxy sequentially reads through each policy group in the policies table. It compares the client request status to the membership criteria of the first policy group. If they match, the Web Proxy applies the policy settings of that policy group.
If they do not match, the Web Proxy compares the client request to the next policy group. It continues this process until it matches the client request to a user defined policy group. If it does not match a user defined policy group, it matches the global policy group. When the Web Proxy matches the client request to a policy group or the global policy group, it applies the policy settings of that policy group.
Matching Client Requests to Routing Policy Groups
groups.
11-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 11 Working with External Proxies
Figure 11-2 Policy Group Flow Diagram for Routing Policies
Creating Routing Policies
Creating Routing Policies
You can create Routing Policy groups based on combinations of several criteria, such as Identity or the port used to access the Web Proxy. You must define at least one criterion for policy group membership.
When you define multiple criteria, the client request must meet all criteria to match the policy group.
For more information about how the appliance matches a client request with a policy group, see
Evaluating Routing Policy Group Membership, page 11-3 and
Matching Client Requests to Routing
.
You define policy group membership on the Web Security Manager > Routing Policies page.
To create a Routing Policy group:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
11-5
Chapter 11 Working with External Proxies
Creating Routing Policies
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Routing Policies page.
Click Add Group .
In the Policy Name field, enter a name for the policy group, and in the Description field, optionally add a description.
Note Each policy group name must be unique and only contain alphanumeric characters or the space character.
Step 4
Step 5
Step 6
In the Insert Above Policy field, choose where in the policies table to place the policy group.
When configuring multiple policy groups you must specify a logical order for each group. Carefully order your policy groups to ensure that correct matching occurs.
In the Identities and Users section, choose one or more Identity groups to apply to this policy group.
For more information on how to do this, see
Configuring Identities in Other Policy Groups, page 9-22 .
Optionally, expand the Advanced section to define additional membership requirements.
Step 7 To define policy group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
11-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 11 Working with External Proxies
Creating Routing Policies
describes the advanced options you can configure for policy groups.
Table 11-1 Policy Group Advanced Options
Advanced Option Description
Protocols Choose whether or not to define policy group membership by the protocol used in the client request. Select the protocols to include.
“All others” means any protocol not listed above this option.
Proxy Ports
Note: When the HTTPS Proxy is enabled, only Decryption Policies apply to
HTTPS transactions. You cannot define policy membership by the HTTPS protocol for Access, Routing, Outbound Malware Scanning, Data Security, or External DLP
Policies.
Choose whether or not to define policy group membership by the proxy port used to access the Web Proxy. Enter one or more port numbers in the Proxy Ports field.
Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Subnets
Time Range
Cisco recommends only defining policy group membership by the proxy port when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. If you define policy group membership by the proxy port when client requests are transparently redirected to the appliance, some requests might be denied.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by subnet or other addresses.
You can choose to use the addresses that may be defined with the associated
Identity, or you can enter specific addresses here.
Note: If the Identity associated with this policy group defines its membership by addresses, then in this policy group you must enter addresses that are a subset of the Identity’s addresses. Adding addresses in the policy group further narrows down the list of transactions that match this policy group.
Choose whether or not to define policy group membership by a defined time range.
Choose the time range from the Time Range field and then choose whether this policy group should apply to the times inside or outside the selected time range.
For more information on creating time based policies, see
For more information on creating time ranges, see
Creating Time Ranges, page 8-9
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
11-7
Chapter 11 Working with External Proxies
Creating Routing Policies
Table 11-1 Policy Group Advanced Options (continued)
Advanced Option Description
URL Categories Choose whether or not to define policy group membership by URL categories.
Select the user defined or predefined URL categories.
User Agents
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
For more information on creating user agent based policies, see
Agent Based Policies, page 8-11 .
User Location
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by user location, either remote or local.
This option only appears when the Secure Mobility Solution is enabled. For more information, see
Achieving Secure Mobility Overview, page 15-1
.
Step 8
Step 9
Step 10
Submit your changes.
Configure Routing Policy group control settings to define how the Web Proxy handles transactions.
The new policy group automatically inherits global policy group settings until you configure options for each control setting. For more information, see
Routing Traffic to Upstream Proxies, page 11-1
.
Submit and commit your changes.
11-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 11 Working with External Proxies
Creating Routing Policies
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
11-9
Creating Routing Policies
Chapter 11 Working with External Proxies
11-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
12
Decryption Policies
This chapter contains the following information:
•
Decryption Policies Overview, page 12-1
•
•
•
•
•
•
•
•
•
•
•
Digital Cryptography Terms, page 12-4
Digital Certificates, page 12-7
Decrypting HTTPS Traffic, page 12-9
Enabling the HTTPS Proxy, page 12-15
Evaluating Decryption Policy Group Membership, page 12-19
Creating Decryption Policies, page 12-20
Controlling HTTPS Traffic, page 12-23
Bypassing Decryption, page 12-26
Importing a Trusted Root Certificate, page 12-26
Decryption Policies Overview
HTTPS is a web protocol that acts as a secure form of HTTP. HTTPS encrypts HTTP requests and responses before they are sent across the network. Common thinking is that any connection to a site using HTTPS is “safe.” HTTPS connections are secure, not safe, and they do not discriminate against malicious or compromised servers. HTTPS is a secure way to complete legitimate transactions, but more dangerously, it is a secure way to download malware which can infect your network.
Not being able to inspect HTTPS traffic makes the network vulnerable to the following risks:
•
•
Secure site hosting malware.
Spammers and phishers can create legitimate looking websites that are only reachable through an HTTPS connection. Some users may mistakenly trust the web server because it requires an HTTPS connection, resulting in intentional and unintentional downloaded malware.
Malware from HTTPS web applications.
Some malware can infect the network from legitimate web applications, such as secure email clients, by downloading attachments.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-1
Chapter 12 Decryption Policies
Decryption Policies Overview
• Secure anonymizing proxy.
Some web servers offer a proxy service over an HTTPS connection that allows users to circumvent acceptable use policies. When users on the network use a secure proxy server outside the network, they can access any website, regardless of its web reputation or malware content.
The appliance uses both a URL filtering engine and Web Reputation Filters to make intelligent decisions about when to decrypt HTTPS connections. With this combination, administrators and end users are not forced to make a trade-off between privacy and security.
You can define HTTPS policies that determine if an HTTPS connection can proceed without examination or whether the appliance should act as an intermediary, decrypting the data passing each way and applying Access Policies to the data as if it were a plaintext HTTP transaction.
To configure the appliance to handle HTTPS requests, you must perform the following tasks:
1.
Enable the HTTPS Proxy.
To monitor and decrypt HTTPS traffic, you must first enable the HTTPS
Proxy. For more information, see
Enabling the HTTPS Proxy, page 12-15
.
2.
3.
Create and configure Decryption Policy groups.
Once the HTTPS Proxy is enabled, you can create and configure Decryption Policy groups to determine how to handle each request from each user. For more information, see
Decryption Policy Groups, page 12-2
.
Import custom root certificates (optional).
Optionally, you can import one or more custom root certificates so the Web Proxy can recognize additional trusted root certificate authorities used by
HTTPS servers. For more information, see
Importing a Trusted Root Certificate, page 12-26 .
Note When the HTTPS Proxy is disabled, the Web Proxy passes through explicit HTTPS connections and it drops transparently redirected HTTPS requests. The access logs contain the CONNECT requests for explicit HTTPS connections, but no entries exist for dropped transparently redirected HTTPS requests.
This book uses many terms from digital cryptography. This book also includes sections with background information about HTTPS and digital cryptography for reference only. For a list of the terms and definitions used in this book, see
Digital Cryptography Terms, page 12-4 . For an overview of HTTPS
the protocol, see
Note Sections in this chapter that refer to a “certificate and key” imply a certificate and private key.
Decryption Policy Groups
Decryption Policies define how the appliance should handle HTTPS connection requests for users on the network. You can apply different actions to specified groups of users. You can also specify which ports the appliance should monitor for HTTPS transactions.
When a client makes an HTTPS request on a monitored secure port, the appliance compares the request to the Decryption Policy groups to determine in which Decryption Policy group the request belongs.
Once it assigns the request to a Decryption Policy group, it can determine what to do with the connection request. For more information about evaluating policy group membership, see
The appliance can perform any of the following actions on an HTTPS connection request:
• Drop.
The appliance drops the connection and does not pass the connection request to the server.
The appliance does not notify the user that it dropped the connection. You might want to drop connections to third party proxies that allow users on the network bypass the organization’s acceptable use policies.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-2
Chapter 12 Decryption Policies
Decryption Policies Overview
•
•
Pass through.
The appliance passes through the connection between the client and the server without inspecting the traffic content. You might want to pass through connections to trusted secure sites, such as well known banking and financial institutions.
Decrypt.
The appliance allows the connection, but inspects the traffic content. It decrypts the traffic and applies Access Policies to the decrypted traffic as if it were a plaintext HTTP connection. By decrypting the connection and applying Access Policies, you can scan the traffic for malware. You might want to decrypt connections to third party email providers, such as gmail or hotmail. For more information about how the appliance decrypts HTTPS traffic, see
Decrypting HTTPS Traffic, page 12-9
.
Note The actions above are final actions the Web Proxy takes on an HTTPS request. The “Monitor” action you can configure for Decryption Policies is not a final action. For more information, see
Understanding the Monitor Action, page 12-3 .
Once the appliance assigns a Decryption Policy to an HTTPS connection request, it evaluates the request against the policy group’s configured control settings to determine which action to take. You can configure URL filter and web reputation settings to determine how to handle HTTPS requests for a particular policy group. For more information about how the appliance uses Decryption Policy groups to control HTTPS traffic, see
Controlling HTTPS Traffic, page 12-23
.
Note Cisco recommends creating fewer, more general Decryption Policy groups that apply to all users or fewer, larger groups of users on the network. Then, if you need to apply more granular control to decrypted HTTPS traffic, use more specific Access Policy groups. For more information about Access
Policy groups, see
.
For information about creating and using policy groups, see
Working with Policies, page 8-1
.
Note The next two sections contain information about digital cryptography and HTTPS for reference only.
Personally Identifiable Information Disclosure
If you choose to decrypt an end-user’s HTTPS session, then the Web Security appliance access logs and reports may contain personally identifiable information. Cisco recommends that Web Security appliance administrators take care when handling this sensitive information.
You also have the option to configure how much URI text is stored in the logs using the advancedproxyconfig
CLI command and the
HTTPS
subcommand. You can log the entire URI, or a partial form of the URI with the query portion removed. However, even when you choose to strip the query from the URI, personally identifiable information may still remain.
Understanding the Monitor Action
When the Web Proxy evaluates the control settings against a transaction, it evaluates the settings in a particular order. Each control setting can be configured to one of the following actions for Decryption
Policies:
• Monitor
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-3
Chapter 12 Decryption Policies
Digital Cryptography Terms
•
•
Drop
Pass through
Decrypt •
All actions except Monitor are final actions the Web Proxy applies to a transaction. A final action is an action that causes the Web Proxy to stop evaluating the transaction against other control settings.
Monitor is an intermediary action that indicates the Web Proxy should continue evaluating the transaction against the other control settings to determine which final action to ultimately apply.
For example, if a Decryption Policy is configured to monitor invalid server certificates, the Web Proxy makes no final decision on how to handle the HTTPS transaction if the server has an invalid certificate.
If a Decryption Policy is configured to block servers with a low web reputation score, then any request to a server with a low reputation score is dropped without considering the URL category actions.
Figure 12-9 on page 12-25 shows the order the Web Proxy uses when evaluating control settings for
Decryption Policies. Looking at the flow diagram, you can see that the only actions applied to a transaction are the final actions listed above: Drop, Pass Through, and Decrypt.
Note
Figure 10-3 on page 10-9 shows the order the Web Proxy uses when evaluating control settings for
Access Policies.
Digital Cryptography Terms
To understand how encryption and decryption works, you need to understand a little bit about cryptographic encoding techniques.
Figure 12-1 describes some terms used in cryptography that are
discussed in this chapter.
Table 12-1 Cryptography Terms and Definitions
Term
Certificate authority
Cipher
Ciphertext
Digital certificate
Definition
An entity which issues digital certificates for use by other parties.
Certificate authorities are sometimes referred to as trusted third parties.
Certificate authorities are typically commercial companies that charge for their services. However, some institutions and governments have their own certificate authorities, and some offer their services for free.
An algorithm used for encoding and decoding text to make it unreadable to any system without the appropriate key.
Ciphers work with keys to encode or decode text.
Encoded text after a cipher has been applied to it.
An electronic document that identifies and describes an organization that has been verified and signed by a trusted organization called a certificate authority.
A digital certificate is similar in concept to an “identification card.” SSL uses certificates to authenticate servers.
For more information about digital certificates, see
Digital Certificates, page 12-7
.
12-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
HTTPS Basics
Table 12-1 Cryptography Terms and Definitions (continued)
Term
Digital signature
Definition
A checksum that verifies that a message was created by the stated author and was not altered since its creation.
Key A numeric parameter used by a cipher to encode or decode text.
Plaintext or cleartext Message text in its original form, before it gets encoded by a cipher.
Public key cryptography
A system that uses two different keys for encoding and decoding text where one key is publicly known and available and the other key is private.
With public key cryptography, anyone can send an encoded message to a server that has publicized its public key, but only the recipient server can decode the message with its private key.
Public key infrastructure (PKI)
Private key cryptography
This is also known as asymmetric key cryptography.
An arrangement that binds public keys with respective user identities by means of a certificate authority.
X.509 is a standard that is an example PKI. X.509 specifies standards for public key certificates and an algorithm for validating certification paths.
A system that uses the same key for encoding and decoding text.
Because both sides of the transaction need the same key, they need a secure way to communicate which key to use in a particular communication session.
Usually, they set up secure communication using public key cryptography and then generate a temporary symmetric key to use for the rest of the session.
This is also known as symmetric key cryptography.
A certificate that is the topmost certificate in a certificate tree structure. Root certificate
All certificates below the root certificate inherit the trustworthiness of the root certificate.
Root certificates can be unsigned public key certificates or self-signed certificates.
Self-signed certificate A digital certificate where the certificate authority is the same as the certificate creator.
HTTPS Basics
HTTPS is a web protocol that acts as a secure form of HTTP. HTTPS is secure because the HTTP request and response data is encrypted before it is sent across the network. HTTPS works similarly to HTTP, except that the HTTP layer is sent on top of a security layer using either Secure Sockets Layer (SSL) or
Transport Layer Security (TLS). SSL and TLS are very similar, so this User Guide uses “SSL” to refer to both SSL and TLS, unless otherwise specified.
Figure 12-1 shows the different OSI network layers for HTTPS and HTTP. It shows that HTTPS is the
HTTP protocol at the application layer over SSL or TLS at the security layer.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-5
HTTPS Basics
Chapter 12 Decryption Policies
Figure 12-1 HTTPS and HTTP OSI Layers
HTTP
TCP
IP
Application layer
Transport layer
Network layer
Network interfaces
HTTP
Data link layer
HTTP
SSL or TLS
TCP
IP
Application layer
Security layer
Transport layer
Network layer
Network interfaces
HTTPS
Data link layer
The URL typically determines whether the client application should use HTTP or HTTPS to contact a server:
•
• http:// servername .
The client application opens a connection to the server on port 80 by default and sends HTTP commands in plaintext.
https:// servername .
The client application opens a connection to the server on port 443 by default and starts to engage in the SSL “handshake” to establish a secure connection between the client and server. Once the secure connection is established, the client application sends encrypted HTTP
commands. For more information about the SSL handshake, see SSL Handshake, page 12-6 .
SSL Handshake
The SSL “handshake” is a set of steps a client and server engage in using the SSL protocol to establish a secure connection between them. The client and server must complete the following steps before they can send and receive encrypted HTTP messages:
Step 1
Step 2
Step 3
Step 4
Exchange protocol version numbers.
Both sides must verify they can communicate with compatible versions of SSL or TLS.
Choose a cipher that each side knows.
First, the client advertises which ciphers it supports and requests the server to send its certificate. Then, the server chooses the strongest cipher from the list and sends the client the chosen cipher and its digital certificate.
Authenticate the identity of each side.
Typically, only the server gets authenticated while the client remains unauthenticated. The client validates the server certificate. For more information about certificates and using them to authenticate servers, see
Digital Certificates, page 12-7 .
Generate temporary symmetric keys to encrypt the channel for this session.
The client generates a session key (usually a random number), encrypts it with the server’s public key, and sends it to the server.
The server decrypts the session key with its private key. Both sides compute a common master secret key that will be used for all future encryption and decryption until the connection closes.
12-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Digital Certificates
Digital Certificates
A digital certificate is an electronic document that identifies and describes an organization, and that has been verified and signed by a trusted organization. A digital certificate is similar in concept to an identification card, such as a driver’s license or a passport. The trusted organization that signs the certificate is also known as a certificate authority.
Certificates allow a client to know that it is talking to the organization it thinks it is talking to. When a server certificate is signed by a well-known or trusted authority, the client can better assess how much it trusts the server.
X.509 is a standard example of a public key infrastructure (PKI). X.509 specifies standards for certificates and an algorithm for validating certification paths. The Web Security appliance uses the
X.509 standard.
X.509 certificates contain the following information:
•
•
•
Subject’s identity, such as the name of a person, server, or organization
Certificate validity period
Certificate authority who is vouching for the certificate
Digital signature of the certificate created by the certificate authority using its private key •
• Public key of the subject
For an example digital certificate you can view from a web browser, see
Working with Root Certificates, page 12-11
.
Although anyone can create a digital certificate, not everyone can get a well-respected certificate authority to vouch for the certificate’s information and sign the certificate with its private key. For more information about validating the certificate authority in a digital certificate, see
.
Validating Certificate Authorities
The X.509 standard allows certificate authorities to issue digital certificates that are signed by other certificate authorities. Due to this system, there is a hierarchy of certificate authorities in a tree structure.
The top-most certificate authorities in the tree structure are called root certificates. Root certificates are not signed by a separate certificate authority because they are at the top of the tree structure. Therefore, by definition, all root certificates are self-signed certificates. The certificate authority listed in the root certificate is the certificate creator.
All certificates below the root certificate inherit the trustworthiness of the root certificate. For example, if CertificateAuthorityABC is a trusted certificate authority and it signs the certificate for certificate authority CertificateAuthorityXYZ, then CertificateAuthorityXYZ is automatically a trusted certificate authority.
Figure 12-2 shows the certification path for a certificate viewed in a web browser.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-7
Digital Certificates
Figure 12-2 Certification Path Example
Chapter 12 Decryption Policies
In
, the certificate for the URL investing.schwab.com was signed by certificate authority
“VeriSign Class 3 Extended Validation SSL CA,” which in turn was signed by certificate authority
VeriSign.
By definition, root certificates are always trusted by applications that follow the X.509 standard. The
Web Security appliance uses the X.509 standard.
Standard web browsers ship with a set of trusted root certificates. The list of root certificates is updated regularly. You can view the root certificates installed on the web browser.
For example, to view the root certificates installed with Mozilla Firefox 2.0, go to Tools > Options >
Advanced > Encryption > View Certificates. To view the root certificates installed with Internet Explorer
7, go to Tools > Internet Options > Content > Certificates > Trusted Root Certification Authorities.
In
, the VeriSign certificate is a root certificate that shipped with the web browser.
The Web Security appliance also installs with a set of trusted root certificates. However, you can upload additional root certificates that the Web Proxy deems to be trusted. For more information about this, see
Importing a Trusted Root Certificate, page 12-26
.
Validating Digital Certificates
Certificates can be valid or invalid. A certificate may be in invalid for different reasons. For example, the current time may be before or after the certificate validity period, the root authority in the certificate may not be recognized, or the Common Name of the certificate does not match the hostname specified in the HTTP “Host” header.
The Web Security appliance verifies that a server certificate is valid before it inspects and decrypts an
HTTPS connection from a server. You can configure how the appliance handles connections to servers with invalid certificates. The appliance can perform one of the following actions for invalid server certificates:
12-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Decrypting HTTPS Traffic
•
•
•
Drop.
The appliance drops the connection and does not notify the client. This is the most restrictive option.
Decrypt.
The appliance allows the connection, but inspects the traffic content. It decrypts the traffic and applies Access Policies to the decrypted traffic as if it were a plaintext HTTP connection. For more information about how the appliance decrypts HTTPS traffic, see
Decrypting HTTPS Traffic, page 12-9
.
Monitor.
The appliance does not drop the connection, and instead it continues comparing the server request with the Decryption Policy groups. This is the least restrictive option.
Note When an invalid server certificate is monitored, the errors in the certificate are maintained and passed along to the end-user.
Some server certificates might be invalid for multiple reasons. If a server certificate is invalid for multiple reasons, the HTTPS Proxy performs the most restrictive action configured for each reason using the following order, with the most restrictive action listed first:
•
•
•
Drop
Decrypt
Monitor
For more information about configuring the appliance to handle invalid server certificates, see
Enabling the HTTPS Proxy, page 12-15
.
Decrypting HTTPS Traffic
The request and response data is encrypted for HTTPS connections before it is sent across the network.
Because the data is encrypted, third parties can view the data, but cannot decrypt it to read its contents without the private key of the HTTPS server.
Figure 12-3 shows an HTTPS connection between a client and a HTTPS server.
Figure 12-3 HTTPS Connection
Client
Server
The Web Security appliance does not have access to the server’s private key, so in order to inspect the traffic between the client and the server, it must intercept the connection and break the connection into two separate connections. The appliance acts as an intermediary between the client and the server pretending to be the server to the client, and the client to the server. This is sometimes referred to as being the “man in the middle.”
Figure 12-4 shows an HTTPS connection between a client and a HTTPS server that goes through the
Web Security appliance.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-9
Decrypting HTTPS Traffic
Figure 12-4
Chapter 12 Decryption Policies
HTTPS Connection Decrypted by the Web Security Appliance
Client Web Security Appliance
Server
Notice that in
Figure 12-4 , there are two different HTTPS connections, one between the client and the
appliance, and one between the appliance and the server. The appliance performs the SSL handshake twice, once with the client and again with the server:
• SSL handshake with the server.
When the appliance performs the SSL handshake with the server, it acts as if it were the client sending a request to the server. After it establishes a secure connection with the server, it can begin receiving the encrypted data. Because it acts as the client and participates in the SSL handshake, it has agreed upon a temporary symmetric key with the server so it can decrypt and read the data the server sends. Also, the appliance receives the server’s digital certificate.
• SSL handshake with the client.
When the appliance performs the SSL handshake with the client, it acts as if it were the requested server providing data the client requests. In order to perform the
SSL handshake with the client, it must send the client its own digital certificate. However, the client expects the certificate of the requested server, so the appliance mimics the requested server’s certificate by specifying a root certificate authority uploaded or configured by an appliance administrator.
For more information about how the server mimics the server’s certificate, see
Digital Certificate, page 12-10 .
Note Because the appliance signs the server certificate with a different root certificate authority and sends that to the client, you must verify the client applications on the network recognize the root
certificate authority. For more information, see Working with Root Certificates, page 12-11 .
After the two separate HTTPS connections are established, the following actions occur:
1.
2.
3.
Encrypted data is received from the server.
The temporary, symmetric key negotiated with the server is used to decrypt the data.
4.
Access Policies are applied to the decrypted traffic as if it were a plaintext HTTP connection. For more information about Access Policies, see
.
Assuming the Access Policy group allows the client to receive the data, the data is encrypted using the temporary, symmetric key negotiated with the client.
5.
Encrypted data is sent to the client.
Note No decrypted data is cached. However, access logs for decrypted HTTP transactions are saved to disk.
Mimicking the Server Digital Certificate
When the appliance performs the SSL handshake with the client, it mimics the server digital certificate and sends the new certificate to the client. To mimic the server digital certificate, it reuses most field values and changes some field values.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-10
Chapter 12 Decryption Policies
Decrypting HTTPS Traffic
The mimicked certificate is the same as the server certificate except for the following fields:
•
•
Issuer.
The issuer comes from the generated or uploaded root certificate configured in the appliance.
Signature Algorithm.
This field is always “sha1WithRSAEncryption” or “dsaWithSHA1” depending upon on whether the root certificate the appliance uses contains an RSA or DSA key.
•
•
Public Key.
The appliance replaces the public key in the original certificate with a public key it generates that matches bit strength from the original certificate and for which it has a matching private key generated as well. For example, if the server certificate uses a 2048 bit RSA key, the appliance generates a new 2048 bit RSA key.
X509v3 Extensions.
All X509v3 extensions are removed except for the following:
–
–
Basic Constraints
Subject Alternative Name
–
–
Key Usage
Subject Key Identifier
– Extended Key Usage
For example, the appliance removes the Authority Key Identifier and the Authority Information
Access X509v3 extensions.
Working with Root Certificates
The Web Security appliance mimics the HTTPS server to which a client originally sent a connection request. In order to establish a secure connection with the client pretending to be the requested server, the appliance must send a server certificate to the client signed by a root certificate authority configured in the appliance.
When you enable the HTTPS Proxy on the appliance, you can configure the root certificate information that the appliance uses to sign its server certificates. You can enter root certificate information in the following ways:
•
•
Generate.
You can enter some basic organization information and then click a button so the appliance generates the rest of the certificate and a private key. You might want to generate a certificate and key when your organization does not have a certificate and key in use, or when it wants to create a new and unique certificate and key.
Upload.
You can upload a certificate file and its matching private key file created outside of the appliance. You might want to upload a certificate and key file if the clients on the network already have the root certificates on their machines.
The certificate and key files you upload must be in PEM format. DER format is not supported. For more information about convert a DER formatted certificate or key to PEM format, see
Certificate and Key Formats, page 12-14
.
Note The certificate you upload must contain “basicConstraints=CA:TRUE” to work with Mozilla
Firefox browsers. This constraint allows Firefox to recognize the root certificate as a trusted root authority.
For more information about how to generate or upload a certificate and key, see
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-11
Chapter 12 Decryption Policies
Decrypting HTTPS Traffic
However, typically, the root certificate information you generate or upload in the appliance is not listed as a trusted root certificate authority in client applications. By default in most web browsers, when users send HTTPS requests, they will see a warning message from the client application informing them that there is a problem with the website’s security certificate. Usually, the error message says that the website’s security certificate was not issued by a trusted certificate authority or the website was certified by an unknown authority. Some other client applications do not show this warning message to users nor allow users to accept the unrecognized certificate.
Note You can also upload an intermediate certificate that has been signed by a root certificate authority. When the Web Proxy mimics the server certificate, it sends the uploaded certificate along with the mimicked certificate to the client application. That way, as long as the intermediate certificate is signed by a root certificate authority that the client application trusts, the application will trust the mimicked server certificate, too. You might want to upload an intermediate certificate if your organization uses its own root certificate authority, but does not want to upload the root certificate to the Web Security appliance for security reasons.
Figure 12-5 on page 12-12 shows an example error message when a users sends an HTTPS request
through Netscape Navigator.
Figure 12-5 Unknown Certificate Authority Error Message
Typically, users can view the certificate and use the information in the certificate to choose whether or not to allow the secure connection with this website. In
, you can view the certificate contents by clicking Examine Certificate .
Figure 12-6 on page 12-13 shows an example root certificate issued by the appliance.
12-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Figure 12-6 Certificate Issued by Web Security Appliance
Decrypting HTTPS Traffic
Requested HTTPS server.
Root certificate information either generated or uploaded in the Web
Security appliance.
Validity period specified in either the generated or uploaded root certificate.
You can choose how to handle the root certificates issued by the Web Security appliance:
•
•
Inform users to accept the root certificate.
You can inform the users in your organization what the new policies are at the company and tell them to accept the root certificate supplied by the organization as a trusted source.
Add the root certificate to client machines.
You can add the root certificate to all client machines on the network as a trusted root certificate authority. This way, the client applications automatically accept transactions with the root certificate. To verify you distribute the root certificate the appliance is using, you can download the root certificate from the Security Services > HTTPS Proxy page.
Click Edit Settings , and then click the Download Certificate link for either the generated or uploaded certificate.
You might want to download the root certificate from the appliance if a different person uploaded the root certificate to the appliance and you want to verify you distribute the same root certificate to the client machines.
Note To reduce the possibility of client machines getting a certificate error, submit the changes after you generate or upload the root certificate to the Web Security appliance, then distribute the certificate to client machines, and then commit the changes to the appliance.
Using Decryption with the AVC Engine
Depending on how the HTTPS Proxy is configured and the configured Decryption Policies, the HTTPS
Proxy may decrypt HTTPS connections to web applications. This allows the AVC engine to more accurately detect and block web applications that use HTTPS. These web applications may use web browsers or other client applications, such as instant messaging applications.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-13
Chapter 12 Decryption Policies
Decrypting HTTPS Traffic
However, to ensure that all applications work properly when HTTPS connections are decrypted, you must add the root certificate for signing to all client machines on the network as a trusted root certificate authority. For example, on Windows machines, you must install the root certificate into Internet Explorer for many instant messaging client applications to work, such as Yahoo Instant Messenger, MSN
Messenger, and Google Talk.
Using Decryption with AOL Instant Messenger
Most AOL Instant Messenger (AIM) client applications do not allow you to add root certificates to their list of trusted certificates. Because you cannot add the appliance root certificate for signing to AIM client applications, AIM users are unable to log into AIM when the HTTPS connection to the AIM server is decrypted. Decryption to AIM servers might occur if the web reputation filters are configured to decrypt traffic to servers with the reputation score equal to the AIM server, or if a Decryption Policy is configured to decrypt all traffic.
To allow users to log into AIM, you must ensure that HTTPS traffic to the AIM servers are never decrypted and instead are passed through.
Note Once users are logged into AIM, all instant messenger traffic uses HTTP and is subject to the configured
Access Policies.
To pass through HTTPS traffic to AIM servers:
Step 1
Step 2
Step 3
Step 4
Step 5
Create a custom URL category in the first position of custom URL categories and enter the following addresses:
•
•
•
•
•
•
•
• aimpro.premiumservices.aol.com
bos.oscar.aol.com
kdc.uas.aol.com
buddyart-d03c-sr1.blue.aol.com
205.188.8.207
205.188.248.133
205.188.13.36
64.12.29.131
Create a Decryption Policy and use the custom URL category created in
as part of the policy group membership. Depending on the other Decryption Policies configured, you might want to place this
Decryption Policy at the top of the list.
Configure the Decryption Policy to pass through all traffic to the custom URL category.
Choose pass through as the default action for the Decryption Policy.
Submit and commit your changes.
Converting Certificate and Key Formats
The root certificate and private key files you upload to the appliance must be in PEM format. DER format is not supported. However, you can convert certificates and keys in DER format into the PEM format before uploading them. For example, you can use OpenSSL to convert the format.
12-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Enabling the HTTPS Proxy
Use the following OpenSSL command to convert a DER formatted certificate file to a PEM formatted certificate file: openssl x509 -inform DER -in cert_in_DER -outform PEM -out out_file_name
You can also convert key files in DER format into the PEM format by running a similar OpenSSL command.
For RSA keys, use the following command: openssl rsa -inform DER -in key_in_DER -outform PEM -out out_file_name
For DSA keys, use the following command: openssl dsa -inform DER -in key_in_DER -outform PEM -out out_file_name
For more information about using OpenSSL, see the OpenSSL documentation, or visit http://openssl.org.
Enabling the HTTPS Proxy
To monitor and decrypt HTTPS traffic, you must enable the HTTPS Proxy on the Security Services >
HTTPS Proxy page. When you enable the HTTPS Proxy, you must configure what the appliance uses for a root certificate when it sends self-signed server certificates to the client applications on the network. You can upload a root certificate and key that your organization already has, or you can configure the appliance to generate a certificate and key with information you enter.
Note When AsyncOS for Web runs on a FIPS-compliant Web Security appliance, you must use the FIPS management console to generate or upload the root certificate and key pair. When you generate or upload certificates and keys using the FIPS management console, the keys are protected by the HSM card. For more information on using the FIPS management console, see
.
Once the HTTPS Proxy is enabled, all HTTPS policy decisions are handled by Decryption Policies. You can no longer define Access and Routing Policy group membership by HTTPS, nor can you configure
Access Policies to block HTTPS transactions. If some Access and Routing Policy group memberships are defined by HTTPS and if some Access Policies block HTTPS, then when you enable the HTTPS
Proxy those Access and Routing Policy groups become disabled. You can choose to enable the policies at any time, but all HTTPS related configurations are removed.
Note When you upload a certificate to the Web Security appliance, verify it is a signing certificate and not a server certificate. A server certificate cannot be used as a signing certificate, so decryption does not work when you upload a server certificate.
For more information about root certificates, see
Working with Root Certificates, page 12-11
.
Also on this page, you can configure what the appliance does with HTTPS traffic when the server certificate is invalid.
Note For information on importing a custom root authority certificate, see
.
To enable the HTTPS Proxy:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-15
Chapter 12 Decryption Policies
Enabling the HTTPS Proxy
Step 1
Step 2
Navigate to the Security Services > HTTPS Proxy page, and click Enable and Edit Settings .
The HTTPS Proxy License Agreement appears.
Read the terms of the HTTPS Proxy License Agreement, and click Accept .
The Edit HTTPS Proxy Settings page appears.
Step 3
Step 4
Verify the Enable HTTPS Proxy field is enabled.
In the HTTPS Ports to Proxy field, enter the ports the appliance should check for HTTPS traffic. Port
443 is the default port.
Note The total number of ports in the HTTP Ports to Proxy and HTTPS Ports to Proxy fields must be
30 or less.
Step 5 In the HTTPS Transparent Request section, choose how the Web Proxy handles transparently redirected
HTTPS transactions it receives before an HTTP request that was authenticated using an identity with an
IP-based surrogate. Select one of the following options:
• Decrypt the HTTPS request and redirect for authentication
• Deny the HTTPS request
This setting only applies to transactions that use IP address as the authentication surrogate and when the user has not yet been authenticated.
For more information, see
Understanding How Authentication Affects HTTPS and FTP over HTTP
.
12-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Enabling the HTTPS Proxy
Step 6
Note This field only appears when the appliance is deployed in transparent mode.
In the Applications that Use HTTPS section, choose whether or not to enable decryption for enhanced application visibility and control.
Enabling this setting allows the Web Proxy to detect applications that use HTTPS with better accuracy.
This setting supersedes the “Pass Through” decision made by the Web Reputation Filters as configured in the Decryption Policies. However, the URL category decision still applies.
Note Decryption may cause some applications to fail unless the root certificate for signing is installed on the client. For more information, see
Using Decryption with the AVC Engine, page 12-13
.
For more information on the appliance root certificate, see
Working with Root Certificates, page 12-11
.
Step 7 Choose which root certificate to use for signing self-signed certificates the appliance sends to clients:
• Uploaded certificate and key.
Go to step
• Generated certificate and key.
Go to step
For more information about how the appliance uses these root certificates, see
Note If the appliance has both an uploaded certificate and key pair and a generated certificate and key pair, it only uses the certificate and key pair currently selected in the Root Certificate for Signing section.
Step 8 To upload a root certificate and key: a.
b.
Click Use Uploaded Certificate and Key.
Click Browse for the Certificate field to navigate to the certificate file stored on the local machine.
If the file you upload contains multiple certificates or keys, the Web Proxy uses the first certificate or key in the file.
Note The certificate file must be in PEM format. DER format is not supported.
c.
Click Browse for the Key field to navigate to the private key file. The private key must be unencrypted.
Note The key length must be 512, 1024, or 2048 bits. Also, the private key file must be in PEM format. DER format is not supported.
d.
Click Upload Files to transfer the certificate and key files to the Web Security appliance.
The uploaded certificate information is displayed on the Edit HTTPS Proxy Settings page.
Note After you upload the certificate and key, you can download the certificate to transfer it to the client applications on the network. Do this using the Download Certificate link in the uploaded key area.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-17
Enabling the HTTPS Proxy
Step 9 e.
Go to step
To generate a certificate and key: a.
Click the Use Generated Certificate and Key option.
b.
Click Generate New Certificate and Key .
Chapter 12 Decryption Policies c.
In the Generate Certificate and Key dialog box, enter the information to display in the root certificate.
Note You can enter any ASCII character except the forward slash ( / ) in the Common Name field.
d.
Click Generate . The Web Security appliance generates the certificate with the data you entered and generates a key.
The generated certificate information is displayed on the Edit HTTPS Proxy Settings page.
Note After you generate the certificate and key, you can download the generated certificate to transfer it to the client applications on the network. Do this using the Download Certificate link in the generated key area.
Step 10 e.
Optionally, you can download the Certificate Signing Request (CSR) using the Download
Certificate Signing Request link so you can submit it to a certificate authority (CA). After you receive a signed certificate from the CA, click Browse and navigate to the signed certificate location. Click Upload File . You can do this anytime after generating the certificate on the appliance.
In the Invalid Certificate Handling section, choose how the appliance handle HTTPS traffic when it encounters invalid server certificates. You can drop, decrypt, or monitor HTTPS traffic for the following types of invalid server certificates:
•
•
Expired.
The certificate is either not yet valid, or it is currently past its valid to date.
Mismatched hostname.
The hostname in the certificate does not match the hostname the client was trying to access. This might happen during a “man in the middle attack,” or when a server redirects a request to a different URL. For example, http://mail.google.com gets redirected to http://www.gmail.com.
•
Note — The Web Proxy can only perform hostname match when it is deployed in explicit forward mode. When it is deployed in transparent mode, it does not know the hostname of the destination server (it only knows the IP address), so it cannot compare it to the hostname in the server certificate.
Unrecognized root authority.
The root certificate authority for the certificate is not in the set of trusted root authorities on the appliance.
12-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Evaluating Decryption Policy Group Membership
• All other error types.
Most other error types are due to the appliance not being able to complete the SSL handshake with the HTTPS server. For more information about additional error scenarios for server certificates, see http://www.openssl.org/docs/apps/verify.html.
Note When a certificate is both expired and has an unrecognized root authority, the Web Security appliance performs the action specified for an unrecognized root authority.
Step 11
For more information about handling invalid server certificates, see
Validating Digital Certificates, page 12-8
.
Submit and commit your changes.
Evaluating Decryption Policy Group Membership
After the Web Proxy assigns an Identity to a client request, it evaluates the request against the other policy types to determine which policy group it belongs for each type. When the HTTPS Proxy is enabled, it applies HTTPS requests against the Decryption Policies. When the HTTPS Proxy is not enabled, it evaluates HTTP requests against the Access Policies.
When an HTTPS request gets decrypted, the Web Proxy evaluates the decrypted request against the
Access Policies. For more information about how the Web Proxy evaluates Access Policies, see
Evaluating Access Policy Group Membership, page 10-3 .
The Web Proxy applies the configured policy control settings to a client request based on the client request’s policy group membership.
To determine the policy group that a client request matches, the Web Proxy follows a specific process for matching the group membership criteria. During this process, it considers the following factors for group membership:
•
•
•
Identity.
Each client request either matches an Identity, fails authentication and is granted guest access, or fails authentication and gets terminated. For more information about evaluating Identity group membership, see
Evaluating Identity Group Membership, page 9-2 .
Authorized users.
If the assigned Identity requires authentication, the user must be in the list of authorized users in the Decryption Policy group to match the policy group.
Advanced options.
You can configure several advanced options for Decryption Policy group membership. Some of the options (such as proxy port, and URL category) can also be defined within the Identity. When an advanced option is configured in the Identity, it is not configurable in the
Decryption Policy group level.
The information in this section gives an overview of how the appliance matches client requests to
Decryption Policy groups. For more details about exactly how the appliance matches client requests, see
Matching Client Requests to Decryption Policy Groups, page 12-20 .
The Web Proxy sequentially reads through each policy group in the policies table. It compares the client request status to the membership criteria of the first policy group. If they match, the Web Proxy applies the policy settings of that policy group.
If they do not match, the Web Proxy compares the client request to the next policy group. It continues this process until it matches the client request to a user defined policy group. If it does not match a user defined policy group, it matches the global policy group. When the Web Proxy matches the client request to a policy group or the global policy group, it applies the policy settings of that policy group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-19
Chapter 12 Decryption Policies
Creating Decryption Policies
Matching Client Requests to Decryption Policy Groups
Figure 12-7 on page 12-20 shows how the Web Proxy evaluates a client request against the Decryption
Policy groups.
Figure 12-7 Policy Group Flow Diagram for Decryption Policies
Creating Decryption Policies
You can create Decryption Policy groups based on combinations of several criteria, such as Identity or the URL category of the destination site. You must define at least one criterion for policy group membership. When you define multiple criteria, the client request must meet all criteria to match the policy group.
For more information about how the appliance matches a client request with a policy group, see
Evaluating Decryption Policy Group Membership, page 12-19
and
Decryption Policy Groups, page 12-20 .
12-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Creating Decryption Policies
You define policy group membership on the Web Security Manager > Decryption Policies page.
To create a Decryption Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Decryption Policies page.
Click Add Policy.
In the Policy Name field, enter a name for the policy group, and in the Description field, optionally add a description.
Note Each policy group name must be unique and only contain alphanumeric characters or the space character.
Step 4
Step 5
In the Insert Above Policy field, choose where in the policies table to place the policy group.
When configuring multiple policy groups you must specify a logical order for each group. Carefully order your policy groups to ensure that correct matching occurs.
In the Identities and Users section, choose one or more Identity groups to apply to this policy group.
Note If the Identity requires authentication, then authentication information may not be available when a user tries to connect to an HTTPS server. For more information on how HTTPS and
.
Step 6
For more information on how to do this, see
Configuring Identities in Other Policy Groups, page 9-22
.
Optionally, expand the Advanced section to define additional membership requirements.
Step 7 To define policy group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-21
Chapter 12 Decryption Policies
Creating Decryption Policies
Table 12-2 describes the advanced options you can configure for Decryption Policy groups.
Table 12-2 Decryption Policy Group Advanced Options
Advanced Option Description
Proxy Ports Choose whether or not to define policy group membership by the proxy port used to access the Web Proxy. Enter one or more port numbers in the Proxy Ports field.
Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Subnets
Cisco recommends only defining policy group membership by the proxy port when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. When you define policy group membership by the proxy port when clients requests get transparently redirected to the appliance, some requests might be denied.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by subnet or other addresses.
Time Range
You can choose to use the addresses that may be defined with the associated
Identity, or you can enter specific addresses here.
Note: If the Identity associated with this policy group defines its membership by addresses, then in this policy group you must enter addresses that are a subset of the Identity’s addresses. Adding addresses in the policy group further narrows down the list of transactions that match this policy group.
Choose whether or not to define policy group membership by a defined time range.
Choose the time range from the Time Range field and then choose whether this policy group should apply to the times inside or outside the selected time range.
For more information on creating time based policies, see
For more information on creating time ranges, see
Creating Time Ranges, page 8-9
.
URL Categories Choose whether or not to define policy group membership by URL categories.
Select the user defined or predefined URL categories.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
12-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Controlling HTTPS Traffic
Table 12-2 Decryption Policy Group Advanced Options (continued)
Advanced Option Description
User Agents Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
User Location
For more information on creating user agent based policies, see
Agent Based Policies, page 8-11
.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by user location, either remote or local.
This option only appears when the Secure Mobility Solution is enabled. For more information, see
Achieving Secure Mobility Overview, page 15-1 .
Step 8
Step 9
Step 10
Submit your changes.
Configure Decryption Policy group control settings to define how the Web Proxy handles transactions.
The new policy group automatically inherits global policy group settings until you configure options for
each control setting. For more information, see Controlling HTTPS Traffic, page 12-23 .
Submit and commit your changes.
Controlling HTTPS Traffic
After the Web Security appliance assigns an HTTPS connection request to a Decryption Policy group, the connection request inherits the control settings of that policy group. The control settings of the
Decryption Policy group determine whether the appliance decrypts, drops, or passes through the connection. For more information about the actions the appliance can take on an HTTPS request, see
Decryption Policy Groups, page 12-2 .
Configure control settings for Decryption Policy groups on the Web Security Manager > Decryption
Policies page.
Figure 12-8 shows where you can configure control settings for the Decryption Policy groups.
Figure 12-8 Decryption Policies Table
You can configure the following settings to determine what action to take on the HTTPS connection:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-23
Chapter 12 Decryption Policies
Controlling HTTPS Traffic
• URL categories.
You can configure the action to take on HTTPS requests for each predefined and custom URL category. Click the link under the URL Categories column for the policy group you want to configure. For more information about working with URL filters, see
URL Filters, page 18-1 . For more information about configuring URL categories, see
Configuring URL Filters for Decryption Policy Groups, page 18-12
.
Note If you want to block (with end-user notification) a particular URL category for HTTPS requests instead of drop (with no end-user notification), choose to decrypt that URL category in the
Decryption Policy group and then choose to block the same URL category in the Access Policy group.
•
•
Web reputation.
You can configure the action to take on HTTPS requests based on the web reputation score of the requested server. Click the link under the Web Reputation column for the policy group you want to configure. For more information about working with web reputation scores, see
Web Reputation in Decryption Policies, page 20-4 .
Default action.
You can configure the action the appliance should take when none of the other settings apply. Click the link under the Default Action column for the policy group you want to configure.
Note The configured default action only affects the transaction when no decision is made based on
URL category or Web Reputation score. If Web Reputation filtering is disabled, the default action applies to all transactions that match a Monitor action in a URL category. If Web
Reputation filtering is enabled, the default action is used only if the Monitor action is selected for sites with no score.
After a Decryption Policy group is assigned to an HTTPS request, the control settings for the policy group are evaluated to determine whether to drop, pass through, or decrypt the HTTPS connection request. For more information about assigning a Decryption Policy group to an HTTPS request, see
Policy Group Membership, page 8-7 .
Figure 12-9 on page 12-25 shows how the appliance determines which action to take on an HTTPS
request after it has assigned a particular Decryption Policy to the request.
12-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Figure 12-9 Applying Decryption Policy Actions
Controlling HTTPS Traffic
server. The web reputation score of the server is evaluated only once, but the result is applied at two different points in the decision flow.
For example, note that a web reputation score drop action overrides any action defined for predefined
URL categories.
Note The configured default action only affects the action on the HTTPS request when web reputation filtering is not enabled, or when it is enabled and the server has no score assigned and the action for servers with no scores is to Monitor.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-25
Chapter 12 Decryption Policies
Bypassing Decryption
Bypassing Decryption
Some HTTPS servers do not work as expected when traffic to them is decrypted by a proxy server, such as the Web Proxy. For example, some websites and their associated web applications and applets, such as high security banking sites, maintain a hard-coded list of trusted certificates instead of relying on the operating system certificate store.
You can bypass decryption for HTTPS traffic to these servers to ensure all users can access these types of sites.
To bypass decryption for some websites:
Step 1
Step 2
Create a custom URL category that contains the affected HTTPS servers by configuring the Advanced properties.
Create a Decryption Policy that uses the custom URL category created in
as part of its membership, and set the action for the custom URL category to Pass Through.
Importing a Trusted Root Certificate
When the Web Proxy receives a connection request for an HTTPS server, it validates the trustworthiness of the destination server by verifying the root certificate authority that signed the server certificate. If the Web Proxy does not recognize the root certificate that signed the server certificate, then it does not trust the server certificate. This happens when the HTTPS server uses a certificate authority that is not listed in the set of trusted certificate authorities that ship with the Web Security appliance. This might happen if your organization uses an internal certificate authority to sign certificates for servers on the internal network.
To prevent the Web Proxy from potentially blocking access to servers with unrecognized root certificate authorities, you can upload to the appliance root certificates that your organization trusts. For example, you might want to upload a root certificate used by the servers on your network.
You can upload multiple root certificate files to the appliance, and each file you upload can contain multiple root certificates. However, each certificate you upload must be a root certificate.
To import a trusted root certificate:
Step 1 Navigate to the Security Services > HTTPS Proxy page.
Step 2 In the Custom Root Authority Certificates section, click Import .
Step 3
Step 4
Step 5
In the Import Custom Root Authority Certificate File, click Browse .
Navigate to the location where the custom root authority certificate file is located and click Open .
Click Submit .
12-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Logging
Step 6
Step 7
The uploaded root certificate is displayed in the “Custom Root Authority Certificates” section.
Optionally, repeat steps
through
5 to upload additional trusted root certificates.
Commit your changes.
Logging
HTTPS transactions in the access logs appear similar to HTTP transactions, but with slightly different characteristics. What gets logged depends on whether the transaction was explicitly sent or transparently redirected to the HTTPS Proxy:
•
•
TUNNEL.
This gets written to the access log when the HTTPS request was transparently redirected to the HTTPS Proxy.
CONNECT.
This gets written to the access log when the HTTPS request was explicitly sent to the
HTTPS Proxy.
When HTTPS traffic is decrypted, the access logs contain two entries for a transaction:
• TUNNEL or CONNECT depending on the type of request processed.
• The HTTP Method and the decrypted URL. For example, “GET https://ftp.example.com”.
The full URL is only visible when the HTTPS Proxy decrypts the traffic.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-27
Logging
Chapter 12 Decryption Policies
12-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 12 Decryption Policies
Logging
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
12-29
Logging
Chapter 12 Decryption Policies
12-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
13
Outbound Malware Scanning
This chapter contains the following information:
•
Outbound Malware Scanning Overview, page 13-1
•
•
•
•
Evaluating Outbound Malware Scanning Policy Group Membership, page 13-2
Creating Outbound Malware Scanning Policies, page 13-4
Controlling Upload Requests Using Outbound Malware Scanning Policies, page 13-6
Outbound Malware Scanning Overview
Malware is pervasive and persistent, and unfortunately, usually finds access to the computers inside your network. Users increasingly work with customers and partners to collaborate on projects and increase productivity. This increased collaboration poses challenges for information security professionals to determine how to prevent malware infections on internal systems from accidentally infecting key partners, and therefore adversely affecting their reputation.
The Web Security appliance provides the outbound malware scanning feature which allows you to stop malware that is already active on computers inside the network from escaping the network and affecting customers and partners.
The Cisco IronPort Dynamic Vectoring and Streaming (DVS) engine scans transaction requests as they leave the network in real time. By working with the Cisco IronPort DVS engine, the Web Security appliance enables you to prevent users from unintentionally uploading malicious data.
To prevent malicious data from leaving the network, the Web Security appliance provides the Outbound
Malware Scanning policy groups. You define which uploads are scanned for malware, which anti-malware scanning engines to use for scanning, and which malware types to block.
For more information on anti-malware scanning, see
Anti-Malware Scanning Overview, page 20-4
.
User Experience with Blocked Requests
When the Cisco IronPort DVS engine blocks an upload request, the Web Proxy sends a block page to the end user. However, not all websites display the block page to the end user. For example, some Web 2.0 websites display dynamic content using javascript instead of a static webpage and are not likely to display the block page. Users are still properly blocked from uploading malicious data, but they may not always be informed of this by the website.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-1
Chapter 13 Outbound Malware Scanning
Evaluating Outbound Malware Scanning Policy Group Membership
Outbound Malware Scanning Policy Groups
Outbound Malware Scanning Policies define whether or not the Web Proxy blocks HTTP requests and decrypted HTTPS connections for transactions that upload data to a server (upload requests). An upload request is an HTTP or decrypted HTTPS request that has content in the request body.
When the Web Proxy receives an upload request, it compares the request to the Outbound Malware
Scanning policy groups to determine which policy group to apply. After it assigns the request to a policy group, it compares the request to the policy group’s configured control settings to determine whether to block the request or monitor the request. When an Outbound Malware Scanning Policy determines to monitor a request, it is evaluated against the Access Policies, and the final action the Web Proxy takes on the request is determined by the applicable Access Policy.
For more information on configuring Outbound Malware Scanning Policies to block requests based on outbound malware, see
Controlling Upload Requests Using Outbound Malware Scanning Policies, page 13-6 .
Note Upload requests that try to upload files with a size of zero (0) bytes are not evaluated against Outbound
Malware Scanning Policies.
Evaluating Outbound Malware Scanning Policy Group
Membership
Each client request is assigned to an Identity and is then evaluated against the other policy types to determine to which policy group it belongs for each type. The Web Proxy evaluates upload requests against the Outbound Malware Scanning Policies.
The Web Proxy applies the configured policy control settings to a client request based on the client request’s policy group membership.
To determine the policy group that a client request matches, the Web Proxy follows a specific process for matching the group membership criteria. During this process, it considers the following factors for group membership:
•
•
Identity.
Each client request either matches an Identity, fails authentication and is granted guest access, or fails authentication and is terminated. For more information about evaluating Identity group membership, see
Evaluating Identity Group Membership, page 9-2
.
Authorized users.
If the assigned Identity requires authentication, the user must be in the list of authorized users in the Outbound Malware Scanning Policy group to match the policy group. The list of authorized users can be any of the specified groups or users or can be guest users if the Identity allows guest access.
• Advanced options.
You can configure several advanced options for Outbound Malware Scanning
Policy group membership. Some options, such as proxy port and URL category, can also be defined within the Identity. When an advanced option is configured in the Identity, it is not configurable in the Outbound Malware Scanning Policy group level.
The information in this section gives an overview of how the Web Proxy matches upload requests to
Outbound Malware Scanning Policy groups. For more details about exactly how the Web Proxy matches client requests, see
Matching Client Requests to Outbound Malware Scanning Policy Groups, page 13-3
.
13-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 13 Outbound Malware Scanning
Evaluating Outbound Malware Scanning Policy Group Membership
The Web Proxy reads sequentially through each policy group in the policies table. It compares the upload request status to the membership criteria of the first policy group. If they match, the Web Proxy applies the policy settings of that policy group.
If they do not match, the Web Proxy compares the upload request to the next policy group. It continues this process until it matches the upload request to a user defined policy group. If it does not match a user defined policy group, it matches the global policy group. When the Web Proxy matches the upload request to a policy group or the global policy group, it applies the policy settings of that policy group.
Matching Client Requests to Outbound Malware Scanning Policy Groups
Figure 13-1 on page 13-3 shows how the Web Proxy evaluates an upload request against the Outbound
Malware Scanning groups.
Figure 13-1 Policy Group Flow Diagram for Outbound Malware Scanning Policies
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-3
Chapter 13 Outbound Malware Scanning
Creating Outbound Malware Scanning Policies
Creating Outbound Malware Scanning Policies
You can create Outbound Malware Scanning Policy groups based on combinations of several criteria, such as one or more Identities or the URL category of the destination site. You must define at least one criterion for policy group membership. When you define multiple criteria, the upload request must meet all criteria to match the policy group. However, the upload request needs to match only one of the configured Identities.
For more information about how the Web Proxy matches an upload request with a policy group, see
Evaluating Outbound Malware Scanning Policy Group Membership, page 13-2 and
Requests to Outbound Malware Scanning Policy Groups, page 13-3
.
To create an Outbound Malware Scanning Policy group:
Step 1
Step 2
Navigate to the Web Security Manager > Outbound Malware Scanning page, and click Add Policy .
Enter a name and an optional description for the policy group.
Note Each policy group name must be unique and only contain alphanumeric characters or the space character.
Step 3
Step 4
Step 5
In the Insert Above Policy field, select where in the policies table to place the policy group.
When configuring multiple policy groups, you must specify a logical order for each group. Carefully order your policy groups to ensure that correct matching occurs.
In the Identities and Users section, select one or more Identity groups to apply to this policy group.
For more information, see
Configuring Identities in Other Policy Groups, page 9-22 .
Optionally, expand the Advanced section to define additional membership requirements.
Step 6 To define policy group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
13-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 13 Outbound Malware Scanning
Creating Outbound Malware Scanning Policies
describes the advanced options you can configure for Outbound Malware Scanning Policy groups.
Table 13-1 Outbound Malware Scanning Policy Group Advanced Options
Advanced Option Description
Protocols Choose whether or not to define policy group membership by the protocol used in the client request. Select the protocols to include.
“All others” means any protocol not listed above this option.
Proxy Ports
Note: When the HTTPS Proxy is enabled, only Decryption Policies apply to
HTTPS transactions. You cannot define policy membership by the HTTPS protocol for Access, Routing, Outbound Malware Scanning, Data Security, or External DLP
Policies.
Choose whether or not to define policy group membership by the proxy port used to access the Web Proxy. Enter one or more port numbers in the Proxy Ports field.
Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Subnets
Cisco recommends defining policy group membership by the proxy port only when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. If you define policy group membership by the proxy port when client requests are transparently redirected to the appliance, some requests might be denied.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by subnet or other addresses.
You can select to use the addresses that may be defined with the associated Identity, or you can enter specific addresses here.
Note: If the Identity associated with this policy group defines its membership by addresses, then in this policy group you must enter addresses that are a subset of the addresses defined in the Identity. Adding addresses in the policy group further narrows down the list of transactions that match this policy group.
URL Categories Choose whether or not to define policy group membership by URL categories.
Select the user defined or predefined URL categories.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-5
Chapter 13 Outbound Malware Scanning
Controlling Upload Requests Using Outbound Malware Scanning Policies
Table 13-1 Outbound Malware Scanning Policy Group Advanced Options (continued)
Advanced Option Description
User Agents Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
User Location
For more information on creating user agent based policies, see Working with User
Agent Based Policies, page 8-11
.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by user location, either remote or local.
This option only appears when the Secure Mobility Solution is enabled. For more information, see
Achieving Secure Mobility Overview, page 15-1 .
Step 7
Step 8
Step 9
Submit your changes.
Configure Outbound Malware Scanning Policy group control settings to define how the Web Proxy handles transactions.
The new Outbound Malware Scanning Policy group automatically inherits global policy group settings until you configure options for each control setting. For more information, see
Requests Using Outbound Malware Scanning Policies, page 13-6
.
Submit and commit your changes.
Controlling Upload Requests Using Outbound Malware
Scanning Policies
Each upload request is assigned to an Outbound Malware Scanning Policy group and inherits the control settings of that policy group. The control settings of the Outbound Malware Scanning Policy group determine whether or not to scan the upload request for malware and, if scanned, which malware types to block.
After the Web Proxy receives the upload request headers, it has all the information necessary to decide if it should scan the request body. The DVS engine scans the request and returns a verdict to the Web
Proxy: either block or monitor (evaluate the request against the Access Policies). The block page appears to the end user, if applicable.
shows where you can configure control settings for the Outbound Malware Scanning Policy groups.
13-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 13 Outbound Malware Scanning
Figure 13-2
Controlling Upload Requests Using Outbound Malware Scanning Policies
Creating Outbound Malware Scanning Policies
To configure control settings for an Outbound Malware Scanning Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Outbound Malware Scanning page.
In the Destinations column, click the link for the policy group you want to configure.
In the Edit Destination Settings section, select “Define Destinations Scanning Custom Settings” from the drop-down menu.
Figure 13-3 Scanning Destinations Settings for Outbound Malware Scanning Policies
Step 4
Step 5
Step 6
Step 7
In the Destinations to Scan section, select one of the following options:
• Do not scan any uploads.
The DVS engine scans no upload requests. All upload requests are evaluated against the Access Policies.
•
•
Scan all uploads.
The DVS engine scans all upload requests. The upload request is blocked or evaluated against the Access Policies, depending on the DVS engine scanning verdict.
Scan uploads to specified custom URL categories.
The DVS engine scans upload requests that belong in specific custom URL categories. The upload request is blocked or evaluated against the
Access Policies, depending on the DVS engine scanning verdict. Click Edit custom categories list to select the URL categories to scan.
Submit your changes.
In the Anti-Malware Filtering column, click the link for the policy group.
In the Anti-Malware Settings section, select “Define Anti-Malware Custom Settings” from the drop-down menu.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-7
Logging
Figure 13-4
Chapter 13 Outbound Malware Scanning
Anti-Malware Settings for Outbound Malware Scanning Policies
Step 8
Step 9
In the Cisco IronPort DVS Anti-Malware Settings section, select which anti-malware scanning engines to enable for this policy group.
When you enable Sophos or McAfee scanning, you can select to monitor or block some additional categories in the Malware Categories on this page.
In the Malware Categories section, select whether to monitor or block the various malware categories based on a malware scanning verdict.
The categories listed in this section depend on which scanning engines you enable.
Note URL transactions are categorized as unscannable when the configured maximum time setting is reached or when the system experiences a transient error condition. For example, transactions might be categorized as unscannable during scanning engine updates or AsyncOS upgrades. The malware scanning verdicts SV_TIMEOUT and SV_ERROR are considered unscannable transactions.
Step 10 Submit and commit your changes.
Logging
The access logs indicate whether or not the DVS engine scanned an upload request for malware. The scanning verdict information section of each access log entry includes values for the DVS engine activity
easily find this DVS engine activity:
Table 13-2 Log Fields in W3C Logs and Format Specifiers in Access Logs
W3C Log Field x-req-dvs-scanverdict x-req-dvs-threat-name x-req-dvs-verdictname
Format Specifier in Access Logs
%X2
%X4
%X3
When the DVS engine marks an upload request as being malware and it is configured to block malware uploads, the ACL decision tag in the access logs is BLOCK_AMW_REQ.
13-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 13 Outbound Malware Scanning
Logging
However, when the DVS engine marks an upload request as being malware and it is configured to monitor malware uploads, the ACL decision tag in the access logs is actually determined by the Access
Policy applied to the transaction.
To determine whether or not the DVS engine scanned an upload request for malware view the results of the DVS engine activity in the scanning verdict information section of each access log entry, or view the results of the fields from
added to the W3C or access logs.
For more information, see
Understanding Scanning Verdict Information, page 25-21 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-9
Logging
Chapter 13 Outbound Malware Scanning
13-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 13 Outbound Malware Scanning
Logging
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
13-11
Logging
Chapter 13 Outbound Malware Scanning
13-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
14
Data Security and External DLP Policies
This chapter contains the following information:
•
Data Security and External DLP Policies Overview, page 14-1
•
•
•
•
•
•
•
Working with Data Security and External DLP Policies, page 14-3
Evaluating Data Security and External DLP Policy Group Membership, page 14-4
Creating Data Security and External DLP Policies, page 14-6
Controlling Upload Requests Using Cisco IronPort Data Security Policies, page 14-9
Defining External DLP Systems, page 14-13
Controlling Upload Requests Using External DLP Policies, page 14-16
Data Security and External DLP Policies Overview
In the Information Age, your organization’s data is one of its most prized possessions. Your organization spends a lot of money making data available to your employees, customers, and partners. Data is always on the move by traveling over the web and email. This increased access poses challenges for information security professionals to figure out how to prevent the malicious, accidental, or unintentional loss of sensitive and proprietary information.
The Web Security appliance secures your data by providing the following capabilities:
•
•
Cisco IronPort Data Security Filters.
The Cisco IronPort Data Security Filters on the Web
Security appliance evaluate data leaving the network over HTTP, HTTPS, and FTP to control what data goes where and how and by whom.
Third party data loss prevention (DLP) integration.
The Web Security appliance integrates with leading third party content-aware DLP systems that identify and protect sensitive data. The Web
Proxy uses the Internet Content Adaptation Protocol (ICAP) which is a lightweight HTTP based protocol that allows proxy servers to offload content scanning to external systems. By offloading the content scanning to dedicated external systems, the Web Proxy can take advantage of the deep content scanning in other products while being free to perform other Web Proxy functions with minimal performance impact.
By working with the Cisco IronPort Data Security Filters and external DLP systems, the Web Security appliance allows you to protect information and intellectual property and enforce regulatory and organization compliance by preventing users from unintentionally uploading sensitive data. You define what kind of data is allowed to leave the network.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-1
Chapter 14 Data Security and External DLP Policies
Data Security and External DLP Policies Overview
To restrict data that is leaving the network, the Web Security appliance provides the following types of policy groups:
•
•
Cisco IronPort Data Security Policies.
When you enable the Cisco IronPort Data Security Filters, you can create Cisco IronPort Data Security Policies to enforce business policies. For example, you can create a Data Security Policy that prevents users from sending out Excel or zip files. For more information, see
Data Security Policy Groups, page 14-3 .
External DLP Policies.
When you configure the appliance to work with an external DLP system, you can create External DLP Policies to pass data leaving the network to the external DLP system which scans the content and determines whether or not to block the request. For more information, see
External DLP Policy Groups, page 14-4
.
Depending on your organization’s needs, you might want to use both Data Security and External DLP
Policies. For example, you might use the Cisco IronPort Data Security Policies to block data uploads to websites with a low reputation score. This way, the data is never sent to the external DLP system for a deep content scan, which improves overall performance.
Bypassing Upload Requests Below a Minimum Size
Many websites are interactive, meaning users send data as well as receive data. Users might send data when logging into a website or sending simple form data. A lot of web traffic can consist of relatively small POST requests that are harmless, but can take up many lines in the log files. This creates a lot of
“noise” in the logs that can make it difficult to find and troubleshoot the true data security violations, such as users uploading company files using their personal email account.
To help reduce the number of upload requests recorded in the log files, you can define a minimum request body size, below which upload requests are not scanned by the Cisco IronPort Data Security Filters or the external DLP server.
To do this, use the following CLI commands:
• datasecurityconfig.
Applies to the Cisco IronPort Data Security Filters.
• externaldlpconfig.
Applies to the configured external DLP servers.
The default minimum request body size is 4 KB (4096 bytes) for both CLI commands. Valid values are
1 to 64 KB. The size you specify applies to the entire size of the upload request body.
Note All chunk encoded uploads and all native FTP transactions are scanned by the Cisco IronPort Data
Security Filters or external DLP servers when enabled. However, they can still be bypassed based on a custom URL category. For more information, see
User Experience with Blocked Requests
When the Cisco IronPort Data Security Filters or an external DLP server blocks an upload request, it provides a block page that the Web Proxy sends to the end user. However, not all websites display the block page to the end user. For example, some Web 2.0 websites display dynamic content using javascript instead of a static webpage and are not likely to display the block page. Users are still properly blocked from performing data security violations, but they may not always be informed of this by the website.
14-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Working with Data Security and External DLP Policies
Working with Data Security and External DLP Policies
Cisco IronPort Data Security Policies and External DLP Policies define how the Web Proxy handles
HTTP requests and decrypted HTTPS connections for transactions that upload data to a server (upload requests). However, Cisco IronPort Data Security Policies use logic defined on the Web Security appliance and External DLP Policies use logic defined on the DLP system. An upload request is an
HTTP or decrypted HTTPS request that has content in the request body.
When the Web Proxy receives an upload request, it compares the request to the Data Security and
External DLP Policy groups to determine which policy group to apply. If both types of policies are configured, it compares the request to Cisco IronPort Data Security Policies before external DLP
Policies. After it assigns the request to a policy group, it compares the request to the policy group’s configured control settings to determine what to do with the request.
How you configure the appliance to handle upload requests depends on the policy group type. For more information, see
Data Security Policy Groups, page 14-3
and
External DLP Policy Groups, page 14-4 .
Note Upload requests that try to upload files with a size of zero (0) bytes are not evaluated against Cisco
IronPort Data Security or External DLP Policies.
Data Security Policy Groups
To configure the Web Security appliance to handle upload requests on the appliance itself, perform the following tasks:
Step 1
Step 2
Enable the Cisco IronPort Data Security Filters.
To scan upload requests on the appliance, you must first enable the Cisco IronPort Data Security Filters. Usually, the Cisco IronPort Data Security Filters feature is enabled during the initial setup using the System Setup Wizard. Otherwise, go to the Security
Services > Data Security Filters page to enable it.
Create and configure Data Security Policy groups.
After the Cisco IronPort Data Security Filters feature is enabled, you create and configure Data Security Policy groups to determine how to handle upload requests from each user.
Cisco IronPort Data Security Policies use URL filtering, web reputation, and upload content information when evaluating the upload request. You configure each of these security components to determine whether or not to block the upload request. For more information about the security components that you can configure and how the Web Proxy uses Data Security Policy groups to control upload requests, see
Controlling Upload Requests Using Cisco IronPort Data Security Policies, page 14-9 .
When the Web Proxy compares an upload request to the control settings, it evaluates the settings in order.
Each control setting can be configured to perform one of the following actions for Cisco IronPort Data
Security Policies:
• Block.
The Web Proxy does not permit the connection and instead displays an end user notification page explaining the reason for the block.
• Allow.
The Web Proxy bypasses the rest of the Data Security Policy security service scanning and then evaluates the request against the Access Policies before taking a final action.
For Cisco IronPort Data Security Policies, Allow bypasses the rest of data security scanning, but does not bypass External DLP or Access Policy scanning. The final action the Web Proxy takes on the request is determined by the applicable Access Policy (or an applicable external DLP Policy that may block the request).
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-3
Chapter 14 Data Security and External DLP Policies
Evaluating Data Security and External DLP Policy Group Membership
• Monitor.
The Web Proxy continues comparing the transaction to the other Data Security Policy group control settings to determine whether to block the transaction or evaluate it against the Access
Policies.
For Cisco IronPort Data Security Policies, only the Block action is a final action that the Web Proxy takes on a client request. A final action is an action that causes the Web Proxy to stop comparing the transaction to all other control settings. The Monitor and Allow actions are intermediary actions. In both cases, the Web Proxy evaluates the transaction against the External DLP Policies (if configured) and
Access Policies. The Web Proxy determines which final action to apply based on the Access Policy group control settings (or an applicable external DLP Policy that may block the request).
shows the order that the Web Proxy uses when evaluating control settings for
Cisco IronPort Data Security Policies. The flow diagram shows that the only actions applied to a transaction are the final actions: Block and evaluate against the Access Policies.
For more information on the possible Access Policy actions, see
Access Policy Groups, page 10-1 . For
more information on the Monitor action for Access Policies, see
Understanding the Monitor Action, page 10-2 .
External DLP Policy Groups
To configure the Web Security appliance to handle upload requests on an external DLP system, perform the following tasks:
Step 1
Step 2
Define an external DLP system.
To pass an upload request to an external DLP system for scanning, you must define at least one ICAP-compliant DLP system on the Web Security appliance. Do this on the
Network > External DLP Servers page. For more information, see
Defining External DLP Systems, page 14-13
.
Create and configure External DLP Policy groups.
After an external DLP system is defined, you create and configure External DLP Policy groups to determine which upload requests to send to the DLP system for scanning.
When an upload request matches an External DLP Policy, the Web Proxy sends the upload request to the
DLP system using the Internet Content Adaptation Protocol (ICAP) for scanning. The DLP system scans the request body content and returns a block or allow verdict to the Web Proxy. The allow verdict is similar to the Allow action for Cisco IronPort Data Security Policies in that the upload request will be compared to the Access Policies. The final action the Web Proxy takes on the request is determined by the applicable Access Policy.
For more information about configuring External DLP Policy groups, see
Using External DLP Policies, page 14-16
.
Evaluating Data Security and External DLP Policy Group
Membership
Each client request is assigned to an Identity and then is evaluated against the other policy types to determine which policy group it belongs for each type. The Web Proxy evaluates upload requests against the Data Security and External DLP Policies.
The Web Proxy applies the configured policy control settings to a client request based on the client request’s policy group membership.
14-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Evaluating Data Security and External DLP Policy Group Membership
To determine the policy group that a client request matches, the Web Proxy follows a specific process for matching the group membership criteria. During this process, it considers the following factors for group membership:
•
•
Identity.
Each client request either matches an Identity, fails authentication and is granted guest access, or fails authentication and gets terminated. For more information about evaluating Identity group membership, see
Evaluating Identity Group Membership, page 9-2 .
Authorized users.
If the assigned Identity requires authentication, the user must be in the list of authorized users in the Data Security or External DLP Policy group to match the policy group. The list of authorized users can be any of the specified groups or users or can be guest users if the Identity allows guest access.
• Advanced options.
You can configure several advanced options for Data Security and External DLP
Policy group membership. Some options (such as proxy port and URL category) can also be defined within the Identity. When an advanced option is configured in the Identity, it is not configurable in the Data Security or External DLP Policy group level.
The information in this section gives an overview of how the Web Proxy matches upload requests to both
Data Security and External DLP Policy groups. For more details about exactly how the Web Proxy matches client requests, see
Matching Client Requests to Data Security and External DLP Policy
.
The Web Proxy sequentially reads through each policy group in the policies table. It compares the upload request status to the membership criteria of the first policy group. If they match, the Web Proxy applies the policy settings of that policy group.
If they do not match, the Web Proxy compares the upload request to the next policy group. It continues this process until it matches the upload request to a user defined policy group. If it does not match a user defined policy group, it matches the global policy group. When the Web Proxy matches the upload request to a policy group or the global policy group, it applies the policy settings of that policy group.
Matching Client Requests to Data Security and External DLP Policy Groups
Figure 14-1 on page 14-6 shows how the Web Proxy evaluates an upload request against the Data
Security and External DLP Policy groups.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-5
Chapter 14 Data Security and External DLP Policies
Creating Data Security and External DLP Policies
Figure 14-1 Policy Group Flow Diagram for Data Security and External DLP Policies
Creating Data Security and External DLP Policies
You can create Data Security and External DLP Policy groups based on combinations of several criteria, such as one or more Identities or the URL category of the destination site. You must define at least one criterion for policy group membership. When you define multiple criteria, the upload request must meet all criteria to match the policy group. However, the upload request needs to match only one of the configured Identities.
For more information about how the Web Proxy matches an upload request with a policy group, see
Evaluating Data Security and External DLP Policy Group Membership, page 14-4 and
Requests to Data Security and External DLP Policy Groups, page 14-5 .
Define Data Security Policy group membership on the Web Security Manager > Cisco IronPort Data
Security page. Define External DLP Policy group membership on the Web Security Manager > External
Data Loss Prevention page.
14-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Creating Data Security and External DLP Policies
To create a Data Security or External DLP Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Cisco IronPort Data Security page or the Web Security
Manager > External Data Loss Prevention page.
Click Add Policy .
In the Policy Name field, enter a name for the policy group, and in the Description field, optionally add a description.
Note Each policy group name must be unique and only contain alphanumeric characters or the space character.
Step 4
Step 5
Step 6
In the Insert Above Policy field, choose where in the policies table to place the policy group.
When configuring multiple policy groups you must specify a logical order for each group. Carefully order your policy groups to ensure that correct matching occurs.
In the Identities and Users section, choose one or more Identity groups to apply to this policy group.
For more information on how to do this, see
Configuring Identities in Other Policy Groups, page 9-22
.
Optionally, expand the Advanced section to define additional membership requirements.
Step 7 To define policy group membership by any of the advanced options, click the link for the advanced option and configure the option on the page that appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-7
Chapter 14 Data Security and External DLP Policies
Creating Data Security and External DLP Policies
groups.
Table 14-1 Data Security and External DLP Policy Group Advanced Options
Advanced Option
Protocols
Proxy Ports
Subnets
URL Categories
Description
Choose whether or not to define policy group membership by the protocol used in the client request. Select the protocols to include.
“All others” means any protocol not listed above this option.
Note: When the HTTPS Proxy is enabled, only Decryption Policies apply to
HTTPS transactions. You cannot define policy membership by the HTTPS protocol for Access, Routing, Outbound Malware Scanning, Data Security, or
External DLP Policies.
Choose whether or not to define policy group membership by the proxy port used to access the Web Proxy. Enter one or more port numbers in the Proxy Ports field.
Separate multiple ports with commas.
For explicit forward connections, this is the port configured in the browser. For transparent connections, this is the same as the destination port. You might want to define policy group membership on the proxy port if you have one set of clients configured to explicitly forward requests on one port, and another set of clients configured to explicitly forward requests on a different port.
Cisco recommends only defining policy group membership by the proxy port when the appliance is deployed in explicit forward mode, or when clients explicitly forward requests to the appliance. If you define policy group membership by the proxy port when client requests are transparently redirected to the appliance, some requests might be denied.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by subnet or other addresses.
You can choose to use the addresses that may be defined with the associated
Identity, or you can enter specific addresses here.
Note: If the Identity associated with this policy group defines its membership by addresses, then in this policy group you must enter addresses that are a subset of the addresses defined in the Identity. Adding addresses in the policy group further narrows down the list of transactions that match this policy group.
Choose whether or not to define policy group membership by URL categories.
Select the user defined or predefined URL categories.
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
14-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Controlling Upload Requests Using Cisco IronPort Data Security Policies
Table 14-1
User Location
Data Security and External DLP Policy Group Advanced Options (continued)
Advanced Option
User Agents
Description
Choose whether or not to define policy group membership by the user agent used in the client request. You can select some commonly defined browsers, or define your own using regular expressions. Choose whether this policy group should apply to the selected user agents or to any user agent that is not in the list of selected user agents.
For more information on creating user agent based policies, see
User Agent Based Policies, page 8-11 .
Note: If the Identity associated with this policy group defines Identity membership by this advanced setting, the setting is not configurable at the non-Identity policy group level.
Choose whether or not to define policy group membership by user location, either remote or local.
This option only appears when the Secure Mobility Solution is enabled. For more information, see
Achieving Secure Mobility Overview, page 15-1
.
Step 8
Step 9
Step 10
Step 11
Submit your changes.
If you are creating a Data Security Policy group, configure its control settings to define how the Web
Proxy handles upload requests.
The new Data Security Policy group automatically inherits global policy group settings until you configure options for each control setting. For more information, see
Controlling Upload Requests Using
Cisco IronPort Data Security Policies, page 14-9
.
If you are creating an External DLP Policy group, configure its control settings to define how the Web
Proxy handles upload requests.
The new External DLP Policy group automatically inherits global policy group settings until you configure custom settings. For more information, see
Controlling Upload Requests Using External DLP
Submit and commit your changes.
Controlling Upload Requests Using Cisco IronPort Data Security
Policies
Each upload request is assigned to a Data Security Policy group and inherits the control settings of that policy group. The control settings of the Data Security Policy group determine whether the appliance blocks the connection or evaluates it against the Access Polices.
Configure control settings for Data Security Policy groups on the Web Security Manager > Cisco
IronPort Data Security page.
Figure 14-2 shows where you can configure control settings for the Data Security Policy groups.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-9
Chapter 14 Data Security and External DLP Policies
Controlling Upload Requests Using Cisco IronPort Data Security Policies
Figure 14-2 Creating Secure Cisco IronPort Data Security Policies
You can configure the following settings to determine what action to take on upload requests:
• URL Categories.
For more information, see
.
•
•
Web Reputation.
For more information, see
Content.
For more information, see
.
After a Data Security Policy group is assigned to an upload request, the control settings for the policy group are evaluated to determine whether to block the request or evaluate it against the Access Policies.
For more information about assigning a Data Security Policy group to an upload request, see
Figure 14-3 on page 14-11 shows how the appliance determines which action to take on an upload
request after it has assigned a particular Data Security Policy to the request.
14-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Figure 14-3
Controlling Upload Requests Using Cisco IronPort Data Security Policies
Applying Data Security Policy Actions
URL Categories
AsyncOS for Web allows you to configure how the appliance handles a transaction based on the URL category of a particular request. Using a predefined category list, you can choose to monitor or block content by category. You can also create custom URL categories and choose to allow, monitor, or block traffic for a website in the custom category.
For more information about working with URL categories, see
Configuring URL Filters for Data
Security Policy Groups, page 18-14
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-11
Chapter 14 Data Security and External DLP Policies
Controlling Upload Requests Using Cisco IronPort Data Security Policies
Web Reputation
The Web Reputation setting inherits the global setting. To customize web reputation filtering for a particular policy group, you can use the Web Reputation Settings pull-down menu to customize web reputation score thresholds.
Only negative and zero values can be configured for web reputation threshold settings for Cisco IronPort
Data Security Policies. By definition, all positive scores are monitored.
For more information about configuring web reputation scores, see
Web Reputation in Cisco IronPort
Data Security Policies, page 20-4 .
Content Blocking
You can use the settings on the Cisco IronPort Data Security Policies > Content page to configure the
Web Proxy to block data uploads based on the following file characteristics:
• File size.
You can specify the maximum upload size allowed. All uploads with sizes equal to or greater than the specified maximum are blocked. You can specify different maximum file sizes for
HTTP/HTTPS and native FTP requests.
When the upload request size is greater than both the maximum upload size and the maximum scan size (configured in the “Object Scanning Limits” field on Security Services > Anti-Malware page), the upload request is still blocked, but the entry in the data security logs does not record the file name and content type. The entry in the access logs is unchanged.
• File type.
You can block predefined file types or custom MIME types you enter. When you block a predefined file type, you can block all files of that type or files greater than a specified size. When you block a file type by size, the maximum file size you can specify is the same as the value for the
“Object Scanning Limits” field on Security Services > Anti-Malware page. By default, that value is
32 MB.
Cisco IronPort Data Security Filters do not inspect the contents of archived files when blocking by file type. Archived files can be blocked by its file type or file name, not according to its contents.
Note For some groups of MIME types, blocking one type blocks all MIME types in the group. For example, blocking application/x-java-applet blocks all java MIME types, such as application/java and application/javascript.
• File name.
You can block files with specified names. You can use text as a literal string or a regular expression for specifying file names to block. For more information on using regular expressions, see
Regular Expressions, page 18-24 .
Note Only enter file names with 8-bit ASCII characters. The Web Proxy only matches file names with
8-bit ASCII characters.
Figure 14-4 on page 14-13 shows the Cisco IronPort Data Security Policies > Content page where you
configure the content control settings.
14-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Figure 14-4 Cisco IronPort Data Security Policies Content Settings
Defining External DLP Systems
Defining External DLP Systems
The Web Security appliance can integrate with multiple external DLP servers from the same vendor by defining multiple DLP servers in the appliance. Define DLP systems and global settings that affect integration with all DLP systems on the Network > External DLP Servers page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-13
Defining External DLP Systems
Figure 14-5 Network > External DLP Servers Page
Chapter 14 Data Security and External DLP Policies
You can define the load balancing technique the Web Proxy uses when contacting the DLP systems. This is useful when you define multiple DLP systems. For example, the Web Proxy can contact each DLP system using round-robin or a hash function.
Note Verify the external DLP server does not send the Web Proxy modified content. AsyncOS for Web only supports the ability to block or allow upload requests. It does not support uploading content modified by an external DLP server.
Configuring External DLP Servers
To configure an external DLP server:
Step 1
Step 2
Navigate to the Network > External DLP Servers page.
Click Edit Settings .
Figure 14-6 Configuring External DLP Servers
14-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Defining External DLP Systems
Step 3 Enter the information in
Table 14-2 External DLP Server Settings
Setting Description
External DLP Servers Enter the following information to access an ICAP compliant DLP system:
• Server address and port.
The hostname or IP address and TCP port for accessing the DLP system.
Load Balancing
•
•
Reconnection attempts.
The number of times the Web Proxy tries to connect to the DLP system before failing.
DLP Service URL.
The ICAP query URL specific to the particular DLP server. The Web Proxy includes what you enter here in the ICAP request it sends to the external DLP server. The URL must start with the ICAP protocol: icap://
If multiple DLP servers are defined, select which load balancing technique the
Web Proxy uses to distribute upload requests to different DLP servers. You can choose the following load balancing techniques:
•
•
None (failover).
The Web Proxy directs upload requests to one DLP server. It tries to connect to the DLP servers in the order they are listed. If one DLP server cannot be reached, the Web Proxy attempts to connect to the next one in the list.
Fewest connections.
The Web Proxy keeps track of how many active requests are with the different DLP servers and it directs the upload request to the DLP server currently servicing the fewest number of connections.
Service Request
Timeout
Maximum
Simultaneous
Connections
Failure Handling
•
•
Hash based.
The Web Proxy uses a hash function to distribute requests to the DLP servers. The hash function uses the proxy ID and URL as inputs so that requests for the same URL are always directed to the same DLP server.
Round robin.
The Web Proxy cycles upload requests equally among all
DLP servers in the listed order.
Enter how long the Web Proxy waits for a response from the DLP server. When this time is exceeded, the ICAP request has failed and the upload request is either blocked or allowed, depending on the Failure Handling setting.
Default is 60 seconds.
Specifies the maximum number of simultaneous ICAP request connections from the Web Security appliance to each configured external DLP server. The
Failure Handling setting on this page applies to any request which exceeds this limit.
Default is 25.
Choose whether upload requests are blocked or allowed (passed to Access
Policies for evaluation) when the DLP server fails to provide a timely response.
Default is allow (“Permit all data transfers to proceed without scanning”).
Step 4 Optionally, you can add another DLP server by clicking Add Row and entering the DLP Server information in the new fields provided.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-15
Chapter 14 Data Security and External DLP Policies
Controlling Upload Requests Using External DLP Policies
Step 5
Step 6
You can test the connection between the Web Security appliance and the defined external DLP server(s) by clicking Start Test .
Submit and commit your changes.
Controlling Upload Requests Using External DLP Policies
Each upload request is assigned to an External DLP Policy group and inherits the control settings of that policy group. The control settings of the External DLP Policy group determine whether or not to send the upload request to the external DLP system for scanning.
Once the Web Proxy receives the upload request headers, it has all the information necessary to decide if the request should go to the external DLP system for scanning. The DLP system scans the request and returns a verdict to the Web Proxy, either block or monitor (evaluate the request against the Access
Policies). The block page provided by the DLP system appears to the end user, if applicable.
Note If any Data Security Policy group applies to the upload request, the Web Proxy evaluates the policy group’s control settings against the upload request at the same time the external DLP system scans the request. If a Data Security Policy setting blocks the request before the DLP system is done scanning, the
Web Proxy blocks the request and terminates the ICAP session with the DLP system.
Configure control settings for External DLP Policy groups on the Web Security Manager > External Data
Loss Prevention page.
shows where you can configure control settings for the External DLP Policy groups.
Figure 14-7 Creating External DLP Policies
To configure control settings for an External DLP Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > External Data Loss Prevention page.
Click the link under the Destinations column for the policy group you want to configure.
Under the Edit Destination Settings section, choose “Define Destinations Scanning Custom Settings” from the drop down menu if it is not selected already.
14-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Figure 14-8 Scanning Destinations Settings for External DLP Policies
Logging
Step 4
Step 5
In the Destination to scan section, choose one of the following options:
•
•
Do not scan any uploads.
No upload requests are sent to the configured DLP system(s) for scanning. All upload requests are evaluated against the Access Policies.
Scan all uploads.
All upload requests are sent to the configured DLP system(s) for scanning. The upload request is blocked or evaluated against the Access Policies depending on the DLP system scanning verdict.
• Scan uploads to specified custom URL categories only.
Upload requests that fall in specific custom URL categories are sent to the configured DLP system for scanning. The upload request is blocked or evaluated against the Access Policies depending on the DLP system scanning verdict.
Click Edit custom categories list to select the URL categories to scan.
Submit and commit your changes.
Logging
The access logs indicate whether or not an upload request was scanned by either the Cisco IronPort Data
Security Filters or an external DLP server. The access log entries include a field for the Cisco IronPort
Data Security scan verdict and another field for the External DLP scan verdict based. For more information, see
Understanding Scanning Verdict Information, page 25-21
.
In addition to the access logs, the Web Security appliance provides the following log file types to troubleshoot Cisco IronPort Data Security and External DLP Policies:
• Data Security Logs.
Records client history for upload requests that are evaluated by the Cisco
IronPort Data Security Filters.
•
•
Data Security Module Logs.
Records messages related to the Cisco IronPort Data Security Filters.
Default Proxy Logs.
In addition recording errors related to the Web Proxy, the default proxy logs include messages related to connecting to external DLP servers. This allows you to troubleshoot connectivity or integration problems with external DLP servers.
The following text illustrates a sample Data Security Log entry:
Mon Mar 30 03:02:13 2009 Info: 303 10.1.1.1 - -
<<bar,text/plain,5120><foo,text/plain,5120>>
BLOCK_WEBCAT_IDS-allowall-DefaultGroup-DefaultGroup-NONE-DefaultRouting ns server.com nc
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-17
Logging
Chapter 14 Data Security and External DLP Policies
Table 14-3 describes the Data Security Log fields.
Table 14-3 Data Security Log Fields
Field Value
Mon Mar 30 03:02:13 2009 Info:
303
10.1.1.1
-
-
<<bar,text/plain,5120><foo,text/plai n,5120>>
BLOCK_WEBCAT_IDS-allowall-DefaultGro up-DefaultGroup-NONE-DefaultRouting ns
Description
Timestamp and trace level
Transaction ID
Source IP address
User name
Authorized group names
File name, file type, file size for each file uploaded at once
Note: This field does not include text/plain files that are less than the configured minimum request body size, the default of which is 4096 bytes. For more information on configuring the minimum request body size, see
Upload Requests Below a Minimum Size, page 14-2
.
Cisco IronPort Data Security Policy and action server.com
nc
Web reputation score
Outgoing URL
URL category
Note To learn when data transfer, such as a POST request, to a site was blocked by the external DLP server, search for the IP address or hostname of the DLP server in the access logs.
14-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 14 Data Security and External DLP Policies
Logging
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
14-19
Logging
Chapter 14 Data Security and External DLP Policies
14-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
15
Achieving Secure Mobility
This chapter contains the following information:
•
Achieving Secure Mobility Overview, page 15-1
•
•
•
•
•
Working with Remote Users, page 15-2
Enabling Secure Mobility, page 15-2
Transparently Identifying Remote Users, page 15-4
Configuring Secure Mobility Using the CLI, page 15-5
Achieving Secure Mobility Overview
Today, users and their devices are increasingly more mobile, connecting to the Internet from several locations, such as the office, home, airports, or cafes. Traditionally, users inside the network are protected from security threats, and users outside the traditional network boundary have no acceptable use policy enforcement, minimal protection against malware, and a high risk of data loss.
Employers want to create flexible working environments where employees and partners can work anywhere on any device, but they also want to protect corporate interests and assets from Internet-based threats at all times (always-on security).
Traditional network and content security solutions are great for protecting users and assets behind the network firewall, but are useless when users or devices are not connected to the network, or when data is not routed through the security solutions.
Cisco offers Cisco AnyConnect Secure Mobility Solution to extend the network perimeter to remote endpoints, enabling the seamless integration of web filtering services offered by the Web Security appliance. Secure Mobility Solution is a collection of features across multiple Cisco products that restores security and control in borderless networks. The Cisco products that work with Secure Mobility
Solution are the Cisco IronPort Web Security appliance, Cisco ASA 5500 series adaptive security appliance, and Cisco AnyConnect secure mobility client.
Using Secure Mobility Solution, mobile and remote users have a seamless experience and are always protected from risks as if they were local users connected within the network.
When Secure Mobility Solution is enabled on the Web Security appliance, you can distinguish remote users from local users. This allows you to perform the following tasks:
•
•
Create Identities and other policies for remote users.
View reports for remote traffic.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
15-1
Chapter 15 Achieving Secure Mobility
Working with Remote Users
• Enable single sign-on (SSO) for remote users.
For information on enabling single sign-on, see
Transparently Identifying Remote Users, page 15-4 .
Working with Remote Users
When Secure Mobility Solution is enabled, you can configure Identities and other policies to apply to users by their location:
• Remote users.
These users are connected to the network from a remote location using VPN (virtual private network). Users might be located in a home office, coffee shop, or hotel, for example. The
Web Security appliance automatically identifies remote users when both the Cisco adaptive security appliance and Cisco AnyConnect client are used for VPN access. Otherwise, the Web Security appliance administrator must specify remote users by configuring a range of IP addresses.
• Local users.
These users are connected to the network either physically or wirelessly.
You might want to create separate policies for remote and local users. For example, you can create
Access Policies that allow access to Arts and Entertainment sites when users are outside the office
(remote users), but block access when users are in the office (local users).
When you enable Secure Mobility Solution on the Security Services > AnyConnect Secure Mobility
Page, you identify remote users using one of the following methods:
• Associate by IP address.
Specify a range of IP addresses that the appliance should consider as assigned to remote devices. Typically, the Cisco adaptive security appliance assigns these IP addresses to devices that connect using VPN functionality. When the Web Security appliance receives a transaction from one of the configured IP addresses, it considers the user as a remote user.
• Integrate with a Cisco ASA.
Specify one or more Cisco adaptive security appliances the Web
Security appliance communicates with. The Cisco adaptive security appliance maintains an IP address-to-user mapping and communicates that information with the Web Security appliance.
When the Web Proxy receives a transaction, it obtains the IP address and determines the user by checking the IP address-to-user mapping. When users are determined by integrating with a Cisco adaptive security appliance, you can enable single sign-on for remote users.
For information on enabling single sign-on, see
Transparently Identifying Remote Users, page 15-4
.
Enabling Secure Mobility
To protect remote users using always-on security, first you must enable the Secure Mobility Solution feature on the Web Security appliance. When Secure Mobility Solution is enabled, you can distinguish between remote users from local users when creating Identities.
Note
You can also configure Secure Mobility Solution using the CLI. For more information, see Configuring
Secure Mobility Using the CLI, page 15-5 .
To enable Secure Mobility Solution:
Step 1
Step 2
Navigate to the Security Services > AnyConnect Secure Mobility page, and click Enable .
The AnyConnect Secure Mobility License Agreement appears.
Read the terms of the AnyConnect Secure Mobility License Agreement, and click Accept .
15-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 15 Achieving Secure Mobility
The AnyConnect Secure Mobility Settings page appears.
Enabling Secure Mobility
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Verify the Enable AnyConnect Secure Mobility field is enabled.
Configure how to identify remote users, by IP address or by integrating with one or more Cisco adaptive security appliances. For more information, see
Working with Remote Users, page 15-2 .
To identify remote users by IP address, select the IP Range option, enter a range of IP addresses in the
IP Range field, and then go to step
. Otherwise, go to step
To identify remote users by integrating with one or more Cisco adaptive security appliances, select the
Cisco ASA Integration option.
Configure at least one Cisco adaptive security appliance by entering the Cisco adaptive security appliance host name or IP address in the ASA Host Name or IP Address field, and the port number used to access the ASA in the Port field. The default port number for the Cisco ASA is 11999.
If multiple Cisco adaptive security appliances are configured in a cluster, click Add Row and configure each ASA in the cluster. If two Cisco adaptive security appliances are configured for high availability, enter only one host name or IP address for the active Cisco adaptive security appliance.
In the ASA Access Password field, enter the access password for the Cisco adaptive security appliances
and
7 . The access password must be at least eight characters, and no more than 20
characters. The allowed characters are:
0-9 a-z A-Z . , : ; _ / -
Note The password you enter here must match the access password configured for the specified Cisco adaptive security appliances.
Step 9
Step 10
Optionally, click Start Test to verify the Web Security appliance can connect to the configured Cisco adaptive security appliances.
Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
15-3
Chapter 15 Achieving Secure Mobility
Transparently Identifying Remote Users
Transparently Identifying Remote Users
When the Web Security appliance integrates with a Cisco adaptive security appliance, you can configure it to identify users by an authenticated user name transparently—that is, without prompting the end user.
You might want to do this to achieve single sign-on for remote users.
Note You can also identify users transparently using Novell eDirectory and Active Directory. For more information, see
Identifying Users Transparently, page 9-10
.
To configure transparent user identification for remote users:
Step 1
Step 2
Step 3
Enable Secure Mobility Solution on the Security Services > AnyConnect Secure Mobility page.
For more information, see
Enabling Secure Mobility, page 15-2 .
Create an Identity group that applies to remote users: a.
In the “Define Members by User Location” section, select Remote Users Only.
b.
c.
In the “Define Members by Authentication” section, select “Identify Users Transparently through
Cisco ASA Integration.”
Configure all other Identity options as desired.
For more information on creating Identities, see
Creating Identities, page 9-17 .
Create policies that use the Identity for remote users.
Logging
The access logs indicate whether each transaction was made by a local or remote user. You can also add the same custom format specifier (%l) to the existing access logs, or you can add the equivalent W3C field (auth-user-type) to the W3C access logs.
In addition to the access logs, the Web Security appliance provides the following logs for troubleshooting potential Secure Mobility Solution issues.
•
•
User Discovery Service (UDS) log.
The UDS log records data about how the Web Proxy discovers the user name without doing actual authentication. It includes information about interacting with the
Cisco adaptive security appliance for Secure Mobility Solution as well as integrating with the Novell eDirectory server for transparent user identification.
AnyConnect Secure Mobility Daemon log.
The AnyConnect Secure Mobility Daemon log records the interaction between the Web Security appliance and the AnyConnect client, including the status check.
15-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 15 Achieving Secure Mobility
Configuring Secure Mobility Using the CLI
Configuring Secure Mobility Using the CLI
describes the CLI commands you can use to configure and monitor Secure Mobility Solution.
Table 15-1 Secure Mobility CLI Commands
Command musconfig musstatus
Description
Use this command to enable Secure Mobility Solution and configure how to identify remote users, either by IP address or by integrating with one or more Cisco adaptive security appliances.
Note: Changes made using this command cause the Web Proxy to restart.
For more information on enabling and configuring Secure Mobility Solution, see
Enabling Secure Mobility, page 15-2
.
Use this command to display information related to Secure Mobility Solution when the Web Security appliance is integrated with an adaptive security appliance.
This command displays the following information:
• The status of the Web Security appliance connection with each adaptive security appliance.
•
•
•
The duration of the Web Security appliance connection with each adaptive security appliance in minutes.
The number of remote clients from each adaptive security appliance.
•
The number of remote clients being serviced, which is defined as the number of remote clients that have passed traffic through the Web Security appliance.
The total number of remote clients.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
15-5
Configuring Secure Mobility Using the CLI
Chapter 15 Achieving Secure Mobility
15-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
16
Controlling Access to SaaS Applications
This chapter contains the following information:
•
SaaS Access Control Overview, page 16-1
•
•
•
Understanding How SaaS Access Control Works, page 16-2
Configuring the Appliance as an Identity Provider, page 16-5
Creating SaaS Application Authentication Policies, page 16-8
SaaS Access Control Overview
Organizations are increasingly choosing to use software as a service (SaaS) applications instead of owning and managing software applications within the organization. SaaS applications typically reside
“in the cloud” instead of on-premise inside your network. There are many potential benefits to using
SaaS applications, such as cost savings, but there are also challenges, especially for IT administrators who have to manage access control to the SaaS applications.
Cisco offers the SaaS Access Control feature which provides IT administrators with seamless, secure controls necessary for managing access to SaaS applications and enforcing security policies. SaaS
Access Control allows IT administrators to easily control authentication and authorization for users who need to access SaaS applications.
When you enable Cisco SaaS Access Control, users log into the configured SaaS applications using their network authentication user credentials. That means they use the same user name and password for all
SaaS applications as well as network access. You can choose whether users are transparently signed in
(single sign-on functionality) or prompted to enter their authentication user name and password.
Using Cisco SaaS Access Control with the proper access controls of your SaaS application allows you to:
•
•
•
•
Control which users can access SaaS applications and from where.
Increase usability for end users by requiring them to remember only one password.
Quickly disable access to all SaaS applications when users are no longer employed by the organization. This is sometimes referred to as “zero day revocation.”
Reduce the risk of phishing attacks that ask users to enter their SaaS user credentials.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-1
Chapter 16 Controlling Access to SaaS Applications
Understanding How SaaS Access Control Works
Understanding How SaaS Access Control Works
The SaaS Access Control solution uses the Security Assertion Markup Language (SAML) to authorize access to SaaS applications. It works with SaaS applications that are strictly compliant with SAML version 2.0.
SAML is an XML-based standard for exchanging authentication and authorization data between different secure networks, sometimes referred to as security domains. The main problem that SAML solves is single sign-on between different security domains. Typically, SAML is used when there are users in one domain accessing a network (a different domain) using a web browser. This is sometimes referred to as web browser single sign-on.
To achieve web browser single sign-on, a SAML dialogue must be engaged by an entity in each domain, which SAML defines using the following terms:
• Identity provider.
An identity provider is an entity that produces SAML assertions. The identity provider is expected to authenticate its end users before producing a SAML assertion. The Web
Security appliance is an identity provider.
• Service provider.
A service provider is an entity that consumes SAML assertions. The SaaS applications you configure on the Web Security appliance are service providers. The service provider relies on the identity provider to identify the end user and communicate that identification to the service provider in the SAML assertion. The service provider makes an access control decision based on the assertion.
SAML assertions are containers of information passed between identity providers and service providers inside SAML requests and responses. Assertions contain statements (such as authentication and authorization statements) that service providers use to make access control decisions. Assertions start with the <saml:Assertion> tag.
SAML dialogues are called flows, and flows can be initiated by either provider:
• Service provider initiated flow.
The service provider is contacted by an end user requesting access so it starts a SAML dialogue by contacting the identity provider to provide identification for the user.
For service provider initiated flows, the end user accesses the service provider using a URL that contains the service provider’s domain, such as http://www.serviceprovider.com/ <URI> .
• Identity provider initiated flow.
The identity provider starts a SAML dialogue by contacting the service provider requesting access on behalf of an end user. For identity provider initiated flows, the end user accesses the service provider using a URL that contains a local domain, such as http://saas.example.com/ <URI> .
SaaS applications define whether they support service provider or identity provider initiated flows. For example, Salesforce supports identity provider initiated flows, Google Apps supports service provider initiated flows, and Cisco WebEx supports both.
The type of flow supported by a SaaS application determines how end users access the application. For more information, see
Understanding the Single Sign-On URL, page 16-4 .
Note This section does not provide a comprehensive discussion of SAML, nor how identity and security providers communicate with each other. For more detailed information, read about SAML at http://docs.oasis-open.org/security/saml/v2.0/ .
Authenticating SaaS Users
When users access a SaaS application, you can choose how to sign them into the SaaS application:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-2
Chapter 16 Controlling Access to SaaS Applications
Understanding How SaaS Access Control Works
•
•
Always prompt users for their local authentication credentials.
Prompt users for their local authentication credentials if the Web Proxy obtained their user names using transparent user identification.
Automatically sign in users to the SaaS application using their local authentication credentials.
•
Figure 16-1 shows where you configure how to sign in SaaS users in the SaaS Application
Authentication Policy.
Figure 16-1 Automatically Signing In SaaS Users
When you configure the SaaS Application Authentication Policy to automatically sign in users, the Web
Proxy tries to log the user into the SaaS application using the authentication credentials already associated with the user without prompting the user to enter the credentials again. These credentials may have been manually entered by the user or obtained using transparent user identification.
However, users might be prompted to enter their authentication credentials in the web browser in some cases. When users are prompted for their credentials, a form filled with fields is displayed in the web browser where they can enter their credentials. This happens under the following circumstances:
This happens when no authentication information is associated with the user due to one of the following reasons:
• Authentication is not required for the user to browse the web.
•
•
The user connects to the single sign-on URL before accessing any other website previously.
The user was authenticated with an Identity that uses IP-based authentication surrogates, the “Client
IP Idle Timeout” or the “Surrogate Timeout” value on the Web Security appliance has expired, and the user connects to the single sign-on URL before accessing any other website since the timeout expiration.
• The user was authenticated with an Identity that uses cookie-based authentication surrogates, the
“Surrogate Timeout” value has expired, and the user connects to the single sign-on URL before accessing any other website since the timeout expiration.
For more information about the single sign-on URL, see
Understanding the Single Sign-On URL, page 16-4
.
Note Users may also be forced to enter authentication credentials if they have already authenticated with the
Web Security appliance, but the user does not have the authorization to connect to the SaaS application.
This might happen if the user is not authenticated against the policy’s authentication realm or is not one of the listed users in the policy’s authentication realm.
When users are prompted to authenticate, the authentication credentials are sent to the Web Proxy using a secure HTTPS connection. The appliance uses its own certificate and private key to create an HTTPS connection with the client by default. Most browsers will warn users that the certificate is not valid. To prevent users from seeing the invalid certificate message, you can upload a certificate and key pair your organization uses. For information about uploading a certificate and key, see
Keys to Use with Credential Encryption and SaaS Access Control, page 21-26
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-3
Chapter 16 Controlling Access to SaaS Applications
Understanding How SaaS Access Control Works
Note To achieve single sign-on behavior using explicit forward requests for all authenticated users when the appliance is deployed in transparent mode, you must select the “Apply same surrogate settings to explicit forward requests” setting when you configure the Identity group.
Authentication Requirements
Some service providers require a particular authentication mechanism to allow users to access the SaaS application. If a service provider requires an authentication context that is not supported by an identity provider, users cannot access the service provider using single sign-on from the identity provider.
Therefore, SaaS Access Control only works with SaaS applications that require an authentication mechanism supported by the Web Security appliance. Currently, the Web Proxy uses the
“PasswordProtectedTransport” authentication mechanism. You configure this value when you create a
SaaS Application Authentication Policy using the Authentication Context setting. However, administrators typically choose “Automatic” as the Authentication Context setting.
For more information on creating SaaS Application Authentication Policies, see Creating SaaS
Application Authentication Policies, page 16-8
.
Enabling SaaS Access Control
To enable SaaS Access Control, you must configure settings on both the Web Security appliance and the
SaaS application. It is very important that the settings you configure on the appliance and SaaS application match each other appropriately.
When enabling SaaS Access Control, it is easiest to keep open a connection to the Web Security appliance and the SaaS application simultaneously. You will need to go back and forth between both components and copy and paste information between both.
Note For more information on configuring SaaS Access Control for particular SaaS applications, contact your technical sales representative or search the cisco.com website for additional information, such as white papers, knowledge base articles, or video tutorials.
To use SaaS Access Control, follow these steps:
1.
Configure the Web Security appliance as an identity provider.
For more information, see
Configuring the Appliance as an Identity Provider, page 16-5 .
2.
3.
Configure the SaaS application for single sign-on.
When configuring the SaaS application, you must also upload the certificate used on the Security Services > Identity Provider for SaaS page. For more information, see the SaaS application documentation.
Create one or more SaaS Application Authentication Policies for each SaaS application.
For more information, see
Creating SaaS Application Authentication Policies, page 16-8 .
Understanding the Single Sign-On URL
After you configure the Web Security appliance as an identity provider and create a SaaS Application
Authentication Policy for the SaaS application, the appliance creates a single sign-on URL (SSO URL).
How administrators use this URL depends on the flow type:
16-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 16 Controlling Access to SaaS Applications
Configuring the Appliance as an Identity Provider
•
•
Identity provider initiated flows.
Administrators should make the single sign-on URL available to end users to access this SaaS application. For example, administrators can create an internal web page that includes this URL as a link. After users login, the appliance redirects users to the SaaS application.
Service Provider initiated flows.
Administrators should configure this URL in the SaaS application. The SaaS application uses the single sign-on URL to redirect the browser session depending on the “SaaS SSO Authentication Prompt” setting in the policy group:
– Always prompt SaaS users for proxy authentication.
A Web Security appliance page appears where users can enter their local authentication credentials. After entering valid credentials, users are logged into the SaaS application.
– Transparently sign in SaaS users.
Users are logged into the SaaS application automatically.
The Web Security appliance uses the application name configured in the SaaS Application
Authentication Policy to generate the single sign-on URL. You can view the single sign-on URL on the
Web Security Manager > SaaS Policies page after you submit the changes.
The single sign-on URL format is: http:// IdentityProviderDomainName /SSOURL/ ApplicationName
Therefore, when the appliance Identity Provider Domain Name is idp.example.com and the application name in the SaaS Application Authentication Policy is GoogleApps, the single sign-on URL is: http://idp.example.com/SSOURL/GoogleApps
Using SaaS Access Control with Multiple Appliances
When you use multiple Web Security appliances with SaaS Access Control, you must perform the following steps:
• Configure the same Identity Provider Domain Name for each Web Security appliance.
•
•
Configure the same Identity Provider Entity ID for each Web Security appliance.
Upload the same certificate and private key to each appliance on the Security Services > Identity
Provider for SaaS page. Then upload this certificate to each SaaS application you configure.
Configuring the Appliance as an Identity Provider
When you configure the Web Security appliance as an identity provider, the settings you define apply to all SaaS applications it communicates with. The Web Security appliance uses a certificate and key to sign each SAML assertion it creates. You can either upload or generate the certificate and key.
After you choose which certificate and key to use for signing SAML assertions, you must upload the certificate to each SaaS application. You can do this using the Download Certificate link in the Signing
Certificate area. Uploading the certificate ensures the SaaS application (service provider) has the Web
Security appliance public key in order to form a trusted relationship between the service provider and the Web Security appliance (identity provider).
Note When AsyncOS for Web runs on a FIPS-compliant Web Security appliance, you must use the FIPS management console to generate or upload the signing certificate and key pair. When you generate or upload certificates and keys using the FIPS management console, the keys are protected by the HSM card. For more information on using the FIPS management console, see
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-5
Chapter 16 Controlling Access to SaaS Applications
Configuring the Appliance as an Identity Provider
Consider the following rules and guidelines when you configure the Web Security appliance as an identity provider:
•
•
The identity provider domain name must be resolvable within the network. For example, within the organization “example.com,” a transparent request to “http://idp.example.com/” should be network routable and can reach to the Web Security appliance within the network perimeter.
If you intend to use multiple Web Security appliances with SaaS Access Control, you must enter the same Identity Provider Domain Name for each appliance and the same Identity Provider Entity ID for each appliance. For more information, see
Using SaaS Access Control with Multiple Appliances, page 16-5 .
•
•
After you generate on or upload a certificate and key to the appliance, you must upload the same certificate to each SaaS application with which the Web Security appliance will communicate. You can do this by downloading the certificate from the appliance first.
Make note of the settings you configure when you configure the Web Security appliance as an identity provider. Some of these settings must be used when configuring the SaaS application for single sign-on. It is easiest to keep open a connection to the Web Security appliance and the SaaS application simultaneously. You will need to go back and forth between both components and copy and paste information between both
• The appliance constructs a single sign-on (SSO) login URL for each SaaS application based on the value you enter the Identity Provider Domain Name field and the SaaS application name configured
in the SaaS policy. For more information, see Understanding the Single Sign-On URL, page 16-4
.
To configure the Web Security appliance as an identity provider:
Step 1
Step 2
Navigate to the Security Services > Identity Provider for SaaS page.
Click Edit Settings .
Figure 16-2 Configuring the Appliance as an Identity Provider
Step 3 In the Identity Provider Domain Name field, enter a virtual domain name to use to access the Web
Security appliance as an identity provider instance.
The identity provider domain name should be resolvable within the network. For example, within the organization “example.com,” a transparent request to “http://idp.example.com/” should be network routable and can reach to the Web Security appliance within the network perimeter.
16-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 16 Controlling Access to SaaS Applications
Configuring the Appliance as an Identity Provider
Note If you intend to use multiple Web Security appliances with SaaS Access Control, you must enter the same Identity Provider Domain Name for each Web Security appliance. If you have only one appliance, you can use the appliance hostname as the Identity Provider Domain Name. For more information, see
Using SaaS Access Control with Multiple Appliances, page 16-5 .
Step 4 In the Identity Provider Entity ID field, enter the text you want to use that uniquely identifies this Web
Security appliance as an identity provider to all SaaS applications it will communicate with.
A URI format based string is recommended, but you can enter any unique string. The URI string does not have to be network accessible. Record the value you enter here because you will need to use the same value when you configure the SaaS application for single sign-on.
Note If you intend to use multiple Web Security appliances with SaaS Access Control, you must enter the same Identity Provider Entity ID for each Web Security appliance. For more information, see
Access Control with Multiple Appliances, page 16-5
.
Step 5 Configure a signing certificate the appliance should use when it communicates using a secure connection
(in the SAML flow) with service providers. You can use either of the following methods to configure the certificate:
• Uploaded certificate and key.
Go to step
• Generated certificate and key.
Go to step
Note If the appliance has both an uploaded certificate and key pair and a generated certificate and key pair, it only uses the certificate and key pair currently selected in the Signing Certificate section.
Step 6 To upload a root certificate and key: a.
Click Use Uploaded Certificate and Key.
b.
Click Browse for the Certificate field to navigate to the certificate file stored on the local machine.
If the file you upload contains multiple certificates or keys, the Web Proxy uses the first certificate or key in the file.
Note The certificate file must be in PEM format. DER format is not supported.
c.
Click Browse for the Key field to navigate to the private key file. The private key must be unencrypted.
Note The key length must be 512, 1024, or 2048 bits. Also, the private key file must be in PEM format. DER format is not supported.
d.
Click Upload Files to transfer the certificate and key files to the Web Security appliance.
The uploaded certificate information is displayed on the Edit Identity Provider Settings for SaaS
Single Sign on page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-7
Chapter 16 Controlling Access to SaaS Applications
Creating SaaS Application Authentication Policies
Step 7
Note After you upload the certificate and key, you can download the generated certificate to transfer it to the SaaS applications with which the Web Security appliance will communicate. Do this using the Download Certificate link in the generated key area.
e.
Go to step
To generate a certificate and key: a.
b.
c.
Click the Use Generated Certificate and Key option.
Click Generate New Certificate and Key .
In the Generate Certificate and Key dialog box, enter the information to display in the signing certificate.
Note You can enter any ASCII character except the forward slash ( / ) in the Common Name field.
d.
Click Generate . The Web Security appliance generates the certificate with the data you entered and generates a key.
The generated certificate information is displayed on the Edit Identity Provider Settings for SaaS
Single Sign on page.
Note After you generate the certificate and key, you can download the generated certificate to transfer it to the SaaS applications with which the Web Security appliance will communicate. Do this using the Download Certificate link in the generated key area.
Step 8 e.
Optionally, you can download the Certificate Signing Request (CSR) using the Download
Certificate Signing Request link so you can submit it to a certificate authority (CA). After you receive a signed certificate from the CA, click Browse and navigate to the signed certificate location. Click Upload File . You can do this anytime after generating the certificate on the appliance.
Submit and commit your changes.
Creating SaaS Application Authentication Policies
After you configure the Web Security appliance as an identity provider and you configure a SaaS application for single sign-on, you can create a SaaS Application Authentication Policy so the Web
Security appliance can communicate with the SaaS application and enable web browser single sign-on.
Consider the following rules and guidelines when you configure the SaaS application information in a
SaaS Application Authentication Policy:
• The Assertion Consumer Service Location URL must be must be resolvable within the network.
• The appliance constructs a single sign-on (SSO) login URL for each SaaS application based on the value you enter the Identity Provider Domain Name field for the appliance and the SaaS application name configured in the SaaS policy. For more information, see
Understanding the Single Sign-On
To create a SaaS Application Authentication Policy:
16-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 16 Controlling Access to SaaS Applications
Creating SaaS Application Authentication Policies
Step 1
Step 2
Navigate to the Web Security Manager > SaaS Policies page.
Click Add Applications to create a new policy for a particular SaaS application.
Figure 16-3 Creating a SaaS Application Authentication Policy
Step 3 Configure the settings defined in
.
Table 16-1 SaaS Application Authentication Policy Settings
Property Description
Application Name Enter a name to identify the SaaS application for this policy group. Each application name must be unique and only contain alphanumeric characters or the space character.
Description
The Web Security appliance uses the application name to generate a single sign-on URL. For more information, see
Understanding the Single Sign-On
.
Optionally, enter a description for this SaaS application.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-9
Chapter 16 Controlling Access to SaaS Applications
Creating SaaS Application Authentication Policies
Table 16-1 SaaS Application Authentication Policy Settings (continued)
Property
Metadata for Service
Provider
Description
Configure the metadata that describes the service provider referenced in this policy group. You can either describe the service provider properties manually or upload a metadata file provided by the SaaS application.
The Web Security appliance uses the metadata to determine how to communicate with the SaaS application (service provider) using SAML.
Contact the SaaS application to learn the correct settings to configure the metadata.
When you manually configure the metadata information, configure the following values:
•
•
Service Provider Entity ID.
Enter the text (typically in URI format) the
SaaS application uses to identify itself as a service provider.
Name ID Format.
Enter the format the appliance should use to identify users in the SAML assertion it sends to service providers. The value you enter here must match the corresponding setting configured on the SaaS application.
Authentication
• Assertion Consumer Service Location.
Enter the URL to where the Web
Security appliance should send the SAML assertion it creates. Read the
SaaS application documentation to determine that correct URL to use.
Sometimes, this is referred to as the login URL.
Note: The metadata file is an XML document following the SAML standard that describes a service provider instance. Not all SaaS applications use metadata files, but for those that do, contact the SaaS application provider for the file.
Choose the authentication realm or authentication sequence the Web Proxy should use to authenticate users accessing this SaaS application. Users must be a member of the authentication realm or authentication sequence to successfully access the SaaS application.
In the SaaS SSO Authentication Prompt section, choose how to sign users into the SaaS application. You might want to prompt users for their credentials for applications that store sensitive data, such as sales or HR data, and transparently sign in users for applications that do not store sensitive data.
For more information, see
Authenticating SaaS Users, page 16-2 .
16-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 16 Controlling Access to SaaS Applications
Creating SaaS Application Authentication Policies
Table 16-1 SaaS Application Authentication Policy Settings (continued)
Property
User Name
Identifier Mapping
Attribute Mapping
Options
Authentication
Context
Description
Specify how the Web Proxy should represent user names to the service provider in the SAML assertion.
You can pass the user names as they are used inside your network (no mapping), or you can change the internal user names into a different format using one of the following methods:
• Fixed Rule mapping.
The user names sent to the service provider are based on the internal user name with a fixed string added before or after the internal user name. Enter the fixed string and %s for the internal user name.
• LDAP query.
The user names sent to the service provider are based on one or more LDAP query attributes. Enter an expression containing LDAP attribute fields and optional custom text. You must enclose attribute names in angled brackets. You can include any number of attributes. For example, for the LDAP attributes “user” and “domain,” you could enter
<user>@<domain>.com
.
Optionally, you can provide to the SaaS application additional information about the internal users from the LDAP authentication server if required by the
SaaS application. Map each LDAP server attribute to a SAML attribute.
For example, you could map the LDAP attribute “mail” to the SAML attribute
“email.”
Specify the authentication mechanism the Web Proxy uses to authenticate its internal users. Currently, the Web Proxy uses “PasswordProtectedTransport,” however, administrators typically choose “Automatic.”
Note: The authentication context informs the service provider which authentication mechanism the identity provider used to authenticate the internal users. Some service providers require a particular authentication mechanism to allow users to access the SaaS application. If a service provider requires an authentication context that is not supported by an identity provider, users cannot access the service provider using single sign-on from the identity provider.
Step 4 Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
16-11
Creating SaaS Application Authentication Policies
Chapter 16 Controlling Access to SaaS Applications
16-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
17
Notifying End Users
This chapter contains the following information:
•
Notifying End Users of Organization Policies, page 17-1
•
•
•
•
•
•
•
•
Configuring General Settings for Notification Pages, page 17-3
Working With On-Box End-User Notification Pages, page 17-4
Defining End-User Notification Pages Off-Box, page 17-9
End-User Acknowledgement Page, page 17-12
Configuring the End-User URL Filtering Warning Page, page 17-16
Working with FTP Notification Messages, page 17-17
Custom Text in Notification Pages, page 17-17
Notification Page Types, page 17-18
Notifying End Users of Organization Policies
The Web Security appliance helps your organization implement and enforce policies for accessing the web. When a policy blocks a user from a website, you can configure the appliance to notify the user why it blocked the URL request. Web users see a webpage that explains that they were blocked from accessing a website and why they were blocked. These pages are called end-user notification pages. The
Web Proxy can display different end-user notification pages depending on the reason it blocked the URL request. You can use the provided end-user notification pages stored on the appliance or define your own off-box.
Configure end-user notification pages on the Security Services > End-User Notification page.
Figure 17-1 shows where you configure end-user notification settings.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-1
Notifying End Users of Organization Policies
Figure 17-1 Security Services > End-User Notification Page
Chapter 17 Notifying End Users
You can configure the following types of notification pages and settings:
•
•
On-box end-user notification pages.
The Web Proxy displays different, predefined notification pages depending on the reason for blocking the URL request. You can customize these pages. For more information, see
Working With On-Box End-User Notification Pages, page 17-4
.
Off-box end-user notification pages.
You can configure the Web Proxy to redirect all HTTP end-user notification pages to a specific URL. The Web Proxy includes parameters in the redirected
URL that explain the reasons for the block so the server in the redirected URL can customize the
•
•
•
•
End-user acknowledgement page.
You can configure the Web Proxy to inform users that it is filtering and monitoring their web activity. An end-user acknowledgement page is displayed when a user first accesses a browser after a certain period of time. When the end-user acknowledgement page appears, users must click a link to access the original site requested or any other website.
Language and logo settings apply to the end-user acknowledgement page as well as the notification pages. For more information, see
End-User Acknowledgement Page, page 17-12 .
End-user URL filtering warning page.
You can configure the Web Proxy to warn users that a site does not meet the organization’s acceptable use policies and allow them to continue if they choose.
An end-user URL filtering warning page is displayed when a user first accesses a website in a particular URL category after a certain period of time. You can also configure the warning page when a user accesses adult content when the site content ratings feature is enabled. When the warning page appears, users can click a link to access the original site requested. Language and logo settings apply to the end-user URL filtering warning page as well as the notification pages. For more information, see
Warning Users and Allowing Them to Continue, page 18-22
.
FTP notification messages.
The FTP Proxy displays a different, predefined notification messages depending on the reason for blocking a native FTP transaction. You can customize these pages with
a custom message. For more information, see Working with FTP Notification Messages, page 17-17
.
General notification settings.
You can configure the language used in on-box end-user notification pages for both HTTP and FTP. You can also configure a logo to use for on-box end-user notification pages for HTTP requests. For more information, see
Configuring General Settings for Notification
17-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Configuring General Settings for Notification Pages
Configuring General Settings for Notification Pages
You can configure the following general settings:
• Language.
You can configure a different language for HTTP and FTP end-user notification pages.
The HTTP language setting applies to all HTTP notification pages (acknowledgement, on-box end-user, customized end-user, and end-user URL filtering warning), and the FTP language applies to all FTP notification messages.
• Logo.
You can configure a logo for HTTP end-user notification pages only. The logo setting applies to all HTTP notification pages.
To configure the general settings for HTTP notification pages and FTP notification messages:
Step 1
Step 2
Navigate to the Security Services > End-User Notification page.
Click Edit Settings .
Step 3
Step 4
In the General Settings section under the HTTP/HTTPS section, select the language the Web Proxy should use when displaying HTTP notification pages. You can choose any of the following languages:
•
•
•
•
•
•
•
•
English
French
German
Italian
Spanish
Japanese
Korean
Portuguese
•
•
•
Russian
Thai
•
Traditional Chinese
Simplified Chinese
Choose whether or not to use a logo on each notification page. You can specify the Cisco logo or any graphic file referenced at the URL you enter in the Use Custom Logo field.
Note See
Custom Text and Logos: Authentication, and End-User Acknowledgement Pages, page 17-18
for more information about working with custom logos.
Step 5 Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-3
Chapter 17 Notifying End Users
Working With On-Box End-User Notification Pages
Working With On-Box End-User Notification Pages
When you choose on-box end-user notification pages, the Web Proxy displays a different page depending on the reason why it blocked the original page. However, you can still customize each page to make them specific to your organization.
You can customize the following features:
•
•
Custom message
Contact information
• Allow end-users to report misclassified pages to Cisco
You can also manually edit each on-box end-user notification page stored on the Web Security appliance.
For more information about how to do this, see
Editing On-Box End-User Notification Pages, page 17-5
.
Configuring On-Box End-User Notification Pages
To configure on-box end-user notification pages:
Step 1 Navigate to the Security Services > End-User Notification page, and click Edit Settings .
The Edit End-User Notification page appears.
Step 2
Step 3
From the Notification Type field, choose Use On Box End User Notification.
Configure the on-box end-user notification page settings.
17-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Working With On-Box End-User Notification Pages
describes the settings you can configure for on-box end-user notification pages.
Table 17-1 On-Box End-User Notification Page Settings
Setting
Custom Message
Contact Information
End-User
Misclassification
Reporting
Description
Choose whether or not to include additional text you specify on each notification page.
When you enter a custom message, AsyncOS places the message before the last sentence on the notification page which includes the contact information.
You can include some HTML tags in lower case to format the text. For a list of supported HTML tags, see
Supported HTML Tags in Notification Pages, page 17-17 .
See
Custom Text and Logos: Authentication, and End-User
Acknowledgement Pages, page 17-18 for more information about working
with custom messages.
Choose whether or not to customize the contact information listed on each notification page.
AsyncOS displays the contact information sentence as the last sentence on a page, before providing notification codes that users can provide to the network administrator.
Choose whether or not users can report misclassified URLs to Cisco.
When you enable this option, an additional button appears on the on-box end-user notification pages for sites blocked due to suspected malware or
URL filters. This button allows the user to report when they believe the page has been misclassified. It does not appear for pages blocked due to other policy settings.
When a user presses this button, data about the blocked request gets sent to the Web Security appliance. AsyncOS logs the information in the Feedback
Log, summarizes the data, and forwards it to Cisco.
This feature helps improve efficiency for administrators, and the Cisco
IronPort Customer Support process. Additionally, misclassification reports improve the efficacy of URL filtering.
For more information on reporting uncategorized and misclassified URLs to
Cisco, see
Reporting Uncategorized and Misclassified URLs, page 18-3
.
Step 4
Step 5
Click the “Preview Notification Page Customization” link to view the current end-user notification page in a separate browser window.
Submit and commit your changes.
Editing On-Box End-User Notification Pages
Each on-box end-user notification page is stored on the Web Security appliance as an HTML file. You can edit the content of these HTML pages to include additional text or to edit the overall look and feel of each page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-5
Chapter 17 Notifying End Users
Working With On-Box End-User Notification Pages
%N
%o
%O
%p
%P
%q
%G
%h
%H
%i
%E
%f
%F
%g
You can use variables in the HTML files to display specific information to the user. You can also turn each variable into a conditional variable to create if-then statements. For more information, see
Variables in Customized On-Box End-User Notification Pages, page 17-8
.
Table 17-2 describes the variables you can include in customized end-user notification pages.
Table 17-2 Variables for Customized End-User Notification Pages
%C
%d
%D
%e
%K
%l
%L
%M
%n
Variable Description
%a Authentication realm for FTP
%A
%b
%B
%c
ARP address
User-agent name
Blocking reason, such as BLOCK-SRC or BLOCK-TYPE
Error page contact person
%I
%j
%k
Entire Set-Cookie: header line, or empty string
Client IP address
User name
Error page email address
The error page logo URL
User feedback section
The URL for user feedback
The web category name, if available
Maximum file size allowed in MB
The hostname of the proxy
The server name of the URL
Transaction ID as a hexadecimal number
Management IP Address
URL category warning page custom text
Redirection link for the end-user acknowledgement page and end-user URL filtering warning page
Response file type
WWW-Authenticate: header line
Proxy-Authenticate: header line
The Method of the request, such as “GET” or “POST”
Malware category name, if available
Malware threat name, if available
Web reputation threat type, if available
Web reputation threat reason, if available
String for the Proxy-Connection HTTP header
Protocol
Identity policy group name
No
Yes
Yes
Yes
Yes
No
No
No
No
No
Yes
No
Yes
No
Yes
Always Evaluates to
TRUE if Used as
Conditional Variable
No
Yes
No
No
Yes
No
No
No
Yes
No
No
No
No
Yes
Yes
Yes
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-6
Chapter 17 Notifying End Users
Working With On-Box End-User Notification Pages
Table 17-2 Variables for Customized End-User Notification Pages (continued)
%Y
%y
%z
%Z
%%
%t
%T
%u
%U
%v
%W
%X
Variable Description
%Q
%r
%R
Policy group name for non-Identity polices
Redirect URL
Always Evaluates to
TRUE if Used as
Conditional Variable
Yes
No
Re-authentication is offered. This variable outputs an empty string when false and a space when true, so it is not useful to use it alone.
Instead, use it as condition variable. For more information, see
Using Variables in Customized On-Box End-User Notification
No
%S
For more information on re-authentication, see
The signature of the proxy No, always evaluates to FALSE
Timestamp in Unix seconds plus milliseconds
The date
The URI part of the URL (the URL excluding the server name)
The full URL of the request
HTTP protocol version
Yes
Yes
Yes
Yes
Yes
Management WebUI port
Extended blocking code. This is a 16-byte base64 value that encodes the most of the web reputation and anti-malware information logged in the access log, such as the ACL decision tag and WBRS score.
Yes
Yes
Administrator custom text string, if set, else empty
End-user acknowledgement page custom text
Web reputation score
DLP metadata
Prints the percent symbol (%) in the notification page
No
Yes
Yes
Yes
N/A
To edit the on-box end-user notification pages:
Step 1
Step 2
Step 3
Step 4
Use an FTP client to connect to the Web Security appliance.
Navigate to the configuration\eun
directory.
In this directory are subdirectories for each supported language for end-user notification pages.
Download the language directory files for the on-box end-user notification pages you want to edit.
On your local machine, use a text or HTML editor to edit each HTML file for the on-box end-user notification pages.
For a list of rules and guidelines, see
Rules and Guidelines for Editing On-Box End-User Notification
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-7
Chapter 17 Notifying End Users
Working With On-Box End-User Notification Pages
Step 5
Step 6
Step 7
Step 8
Use the FTP client to upload the customized HTML files to the same directory from which you downloaded them in step
.
Open an SSH client and connect to the Web Security appliance.
Run the advancedproxyconfig > EUN
CLI command.
Type 2 to use the custom end-user notification pages.
Note If the custom end-user notification pages option is currently enabled when you update the HTML files, you must type
1
to refresh the custom end-user notification pages. If you do not do this, the new files do not take effect until the Web Proxy restarts.
Step 9 Commit your change, and close the SSH client.
Rules and Guidelines for Editing On-Box End-User Notification Pages
Use the following rules and guidelines when editing on-box end-user notification pages:
•
•
Each customized on-box end-user notification page file must be a valid HTML file. For a list of
HTML tags you can include, see
Supported HTML Tags in Notification Pages, page 17-17 .
The customized on-box end-user notification page file names must exactly match the file names shipped with the Web Security appliance.
•
•
•
Do not include any links to URLs in the HTML files. Any link included in the notification pages are subject to the access control rules defined in the Access Policies and users might end up in a recursive loop.
If the configuration\eun directory does not contain a particular file with the required name, then the appliance displays the standard on-box end-user notification page.
For new customized on-box end-user notification pages to go into effect, you must first upload the customized files to the appliance and then enable the customized files using the advancedproxyconfig > EUN
CLI command.
Using Variables in Customized On-Box End-User Notification Pages
When editing on-box end-user notification pages, you can include conditional variables to create if-then statements to take different actions depending on the current state. For example, you can create a customized on-box end-user notification page that includes a redirect URL (%r) if re-authentication is offered (%R). In this example, you would create a conditional variable out of %R.
Table 17-3 describes the different conditional variable formats.
Table 17-3 Creating Conditional Variables in End-User Notification Pages
Conditional Variable Format
%?
V
Description
This conditional variable evaluates to TRUE if the output of variable
% V is not empty.
17-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Defining End-User Notification Pages Off-Box
Table 17-3
%# V
Creating Conditional Variables in End-User Notification Pages (continued)
Conditional Variable Format
%!
V
Description
Represents the following condition: else
Use this with the %?
V conditional variable.
Represents the following condition: endif
Use this with the %?
V conditional variable.
For example, the following text is some HTML code that uses %R as a conditional variable to check if re-authentication is offered, and uses %r as a regular variable to provide the re-authentication URL.
%?R
<div align="left">
<form name="ReauthInput" action="%r" method="GET">
<input name="Reauth" type="button" OnClick="document.location='%r'" id="Reauth" value="Login as different user...">
</form>
</div>
%#R
Any variable included in
can be used as a conditional variable. However, the best variables to use in conditional statements are the ones that relate to the client request instead of the server response, and the variables that may or may not evaluate to TRUE instead of the variables that always evaluate to TRUE. For example, the %t variable (timestamp in Unix seconds plus milliseconds) always evaluates to TRUE, so there is little value in making an if-then statement based on it.
Defining End-User Notification Pages Off-Box
You can define notification pages outside the Web Security appliance by redirecting all notification pages to a custom URL you specify. You might want to do this to display a different block page for different reasons, or to use a third party logging tool to log the block events.
When you redirect notification pages to a URL, by default, AsyncOS redirects all blocked websites to the URL regardless of the reason why it blocked the original page. However, AsyncOS also passes parameters as a query string appended to the redirect URL so you can ensure that the user sees a unique page explaining the reason for the block. For more information on the included parameters, see
Notification Page Parameters, page 17-10
.
When you want the user to view a different page for each reason for a blocked website, construct a CGI script on the web server that can parse the query string in the redirect URL. Then the server can perform a second redirect to an appropriate page.
Rules and Guidelines
Consider the following rules and guidelines when entering the custom URL for notification pages:
• You can use any HTTP or HTTPS URL.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-9
Chapter 17 Notifying End Users
Defining End-User Notification Pages Off-Box
•
•
The URL may specify a specific port number.
The URL may not have any arguments after the question mark.
The URL must contain a well-formed hostname.
•
For example, if you have the following URL entered in the Redirect to Custom URL field: http://www.example.com/eun.policy.html
And you have the following access log entry:
1182468145.492 1 172.17.0.8 TCP_DENIED/403 3146 GET http://www.espn.com/index.html
HTTP/1.1 - NONE/- - BLOCK_WEBCAT-DefaultGroup-DefaultGroup-NONE-NONE-DefaultRouting
<IW_sprt,-,-,-,-,-,-,-,-,-,-,-,-,-,-,IW_sprt,-> -
Then AsyncOS creates the following redirected URL: http://www.example.com/eun.policy.html?Time=21/Jun/
2007:23:22:25%20%2B0000&ID=0000000004&Client_IP=172.17.0.8&User=-
&Site=www.espn.com&URI=index.html&Status_Code=403&Decision_Tag=
BLOCK_WEBCAT-DefaultGroup-DefaultGroup-NONE-NONE-DefaultRouting
&URL_Cat=Sports%20and%20Recreation&WBRS=-&DVS_Verdict=-&
DVS_ThreatName=-&Reauth_URL=-
End-User Notification Page Parameters
AsyncOS passes the parameters to the web server as standard URL Parameters in the HTTP GET request.
It uses the following format:
<notification_page_url>?param1=value1¶m2=value2
Table 17-4 describes the parameters AsyncOS includes in the query string.
Table 17-4 End-User Notification Parameters for Redirected URLs
Parameter Name
Time
ID
Client_IP
User
Site
URI
Status_Code
Decision_Tag
Description
Date and time of the transaction.
Transaction ID.
IP address of the client.
Username of the client making the request, if available.
Hostname of the destination in the HTTP request.
URL path specified in the HTTP request.
HTTP status code for the request.
ACL decision tag as defined in the Access log entry that indicates how the DVS engine handled the transaction.
For more information about ACL decision tags, see ACL Decision Tags, page 25-18
.
17-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Defining End-User Notification Pages Off-Box
Table 17-4 End-User Notification Parameters for Redirected URLs (continued)
Parameter Name
URL_Cat
Description
URL category that the URL filtering engine assigned to the transaction request.
WBRS
DVS_Verdict
For a list of the different URL categories, see
URL Category Descriptions, page 18-27
.
Note: AsyncOS for Web sends the entire URL category name for both predefined and user defined URL categories. It performs URL encoding on the category name, so spaces are written as “%20”.
WBRS score that the Web Reputation Filters assigned to the URL in the request.
Malware category that the DVS engine assigns to the transaction.
For more information about malware categories,
DVS_ThreatName The name of the malware found by the DVS engine.
Reauth_URL A URL that users can click to authenticate again if the user is blocked from a website due to a restrictive URL filtering policy. Use this parameter when the
“Enable Re-Authentication Prompt If End User Blocked by URL Category or
User Session Restriction” global authentication setting is enabled and the user is blocked from a website due to a blocked URL category.
To use this parameter, make sure the CGI script performs the following steps:
1. Get the value of
Reauth_Url
parameter.
2. URL-decode the value.
3. Base64 decode the value and get the actual re-authentication URL.
4. Include the decoded URL on the end-user notification page in some way, either as a link or button, along with instructions for users informing them they can click the link and enter new authentication credentials that allow greater access.
For more information, see
Allowing Users to Re-Authenticate, page 21-27
.
Note AsyncOS always includes all parameters in each redirected URL. If no value exists for a particular parameter, AsyncOS passes a hyphen (-).
Redirecting End-User Notification Pages to a Custom URL
To redirect end-user notification pages to a custom URL:
Step 1
Step 2
Step 3
Navigate to the Security Services > End-User Notification page, and click Edit Settings .
The Edit End-User Notification page appears.
From the Notification Type field, choose Redirect to Custom URL.
In the Notification Page URL field, enter the URL to which you want to redirect blocked websites.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-11
Chapter 17 Notifying End Users
End-User Acknowledgement Page
Step 4
Note You can choose whether or not to preview the URL you enter by clicking the Preview Custom
URL link.
Submit and commit your changes.
End-User Acknowledgement Page
You can configure the Web Security appliance to inform users that it is filtering and monitoring their web activity. The appliance does this by displaying an end-user acknowledgement page when a user first accesses a browser after a certain period of time. When the end-user acknowledgement page appears, users must click a link to access the original site requested or any other website.
You might want to use an end-user acknowledgement page to force users to explicitly agree to the terms and conditions for browsing the World Wide Web from the organization’s network. This might be useful when the Web Proxy is in transparent mode because web users will not otherwise know that their web transactions are being filtered and monitored for security purposes.
When you configure the appliance to display an end-user acknowledgement page, it does so for every user accessing the web using HTTP or HTTPS. It displays the end-user acknowledgement page when a user tries to access a website for the first time, or after a configured time interval.
The Web Proxy tracks users by username if authentication has made a username available. If no user name is available, you can choose how to track users, either by IP address or web browser session cookie.
Note Native FTP transactions are exempt from the end-user acknowledgement page.
Table 17-5 describes the settings you can configure when you enable the end-user acknowledgement
page.
Table 17-5 End-User Acknowledgement Page Settings
Setting
Time Between
Acknowledgements
Inactivity Timeout
Description
The Time Between Acknowledgements determines how often the Web Proxy displays the end-user acknowledgement page for each user. Once a user clicks the link on the end-user acknowledgement page, the Web Proxy considers that user to have acknowledged the proxy for the time you enter for the Time Between Acknowledgements. This setting applies to users tracked by username and users tracked by IP address or session cookie. You can specify any value from 30 to 2678400 seconds (one month). Default is one day (86400 seconds).
When the Time Between Acknowledgements changes and is committed, the
Web Proxy uses the new value even for users who have already acknowledged the Web Proxy.
The Inactivity Timeout determines how long a user tracked and acknowledged by IP address or session cookie (unauthenticated users only) can be idle before the user is no longer considered acknowledged. You can specify any value from 30 to 2678400 seconds (one month). Default is four hours (14400 seconds).
17-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
End-User Acknowledgement Page
Table 17-5
Setting
Surrogate Type
End-User Acknowledgement Page Settings
Custom message
Description
The Surrogate Type determines which method the Web Proxy uses to track the user:
• IP Address.
If you select IP Address, the Web Proxy allows the user at that IP address to use any web browser or non-browser HTTP process to access the web once the user clicks the link on the end-user acknowledgement page. Tracking the user by IP address allows the user to access the web until the Web Proxy displays a new end-user acknowledgement page due to inactivity or the configured time interval for new acknowledgements. Unlike tracking by a session cookie, tracking by IP address allows the user to open up multiple web browser applications and not have to agree to the end-user acknowledgement unless the configured time interval has expired.
Note: When IP address is configured and the user is authenticated, the
Web Proxy tracks users by username instead of IP address.
• Session Cookie.
If you select Session Cookie, the Web Proxy sends the user’s web browser a cookie when the user clicks the link on the end-user acknowledgement page and uses the cookie to track their session. Users can continue to access the web using their web browser until the Time Between Acknowledgements value expires, they have been inactive longer than the allotted time, or they close their web browser. You might want to use session cookies to prevent non-browser
HTTP client applications from accessing the web without the end user’s knowledge, such as malware clients.
If the user using a non-browser HTTP client application, they must be able to click the link on the end-user acknowledgement page to access the web. If the user opens a second web browser application, the user must go through the end-user acknowledgement process again in order for the Web Proxy to send a session cookie to the second web browser.
Note: Using a session cookie to track users when the client accesses
HTTPS sites or FTP servers using FTP over HTTP does not work. For
more information on working around these issues, see Accessing
HTTPS and FTP Sites with the End-User Acknowledgement Page, page 17-14 .
The custom message is text you enter that appears on every end-user acknowledgement page. You can include some simple HTML tags to format the text. For example, you can change the color and size of the text, or make it italicized. See
Custom Text in Notification Pages, page 17-17
for more information.
Note You can only include a custom message when you configure the end-user acknowledgement page in the web interface, versus the
CLI.
Consider the following rules and guidelines when enabling the end-user acknowledgement page:
• When a user is tracked by IP address, the appliance uses the shortest value for maximum time interval and maximum IP address idle timeout to determine when to display the end-user acknowledgement page again.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-13
Chapter 17 Notifying End Users
End-User Acknowledgement Page
•
•
•
•
When a user is tracked using a session cookie, the Web Proxy displays the end-user acknowledgement page again if the user closes and then reopens their web browser or opens a second web browser application.
Using a session cookie to track users when the client accesses HTTPS sites or FTP servers using
FTP over HTTP does not work. For more information on working around these issues, see
HTTPS and FTP Sites with the End-User Acknowledgement Page, page 17-14 .
When the appliance is deployed in explicit forward mode and a user goes to an HTTPS site, the end-user acknowledgement page includes only the domain name in the link that redirects the user to the originally requested URL. If the originally requested URL contains text after the domain name, that text is truncated.
When the end-user acknowledgement page is displayed to a user, the access log entry for that transaction shows OTHER as the ACL decision tag. This is because the originally requested URL was blocked, and instead the user was shown the end-user acknowledgement page.
Accessing HTTPS and FTP Sites with the End-User Acknowledgement Page
The end-user acknowledgement page works because it displays an HTML page to the end user that forces them to click an acceptable use policy agreement. After users click the link, the Web Proxy redirects clients to the originally requested website. In keeps track of when users accepted the end-user acknowledgement page using a surrogate (either by IP address or web browser session cookie) if no username is available for the user.
However, using a session cookie to track users when the client accesses HTTPS sites or FTP servers using FTP over HTTP does not work.
• HTTPS.
The Web Proxy tracks whether the user has acknowledged the end-user acknowledgement page with a cookie, but it cannot obtain the cookie unless it decrypts the transaction. You can choose to either bypass (pass through) or drop HTTPS requests when the end-user acknowledgement page is enabled and tracks users using session cookies. Do this using the advancedproxyconfig > EUN
CLI command, and choose bypass for the “Action to be taken for HTTPS requests with Session based EUA (“bypass” or “drop”).” command.
• FTP over HTTP.
Web browsers never send cookies for FTP over HTTP transactions, so the Web
Proxy cannot obtain the cookie. To work around this, you can exempt FTP over HTTP transactions from requiring the end-user acknowledgement page. Do this by creating a custom URL category using “ftp://” as the regular expression (without the quotes) and defining and Identity policy that exempts users from the end-user acknowledgement page for this custom URL category.
Configuring the End-User Acknowledgement Page
You can enable and configure the end-user acknowledgement page in the web interface or the command line interface. However, when you configure the end-user acknowledgement page in the web interface, you can include a custom message that appears on each page. You can include some simple HTML tags in the custom message, such as font color and size.
In the CLI, use advancedproxyconfig > eun
.
To configure the end-user acknowledgement page in the web interface:
Step 1
Step 2
Navigate to the Security Services > End-User Notification page.
Click Edit Settings .
17-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Figure 17-2 Editing End-User Acknowledgment Page Settings
End-User Acknowledgement Page
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
In the End-User Acknowledgement Page section, enable the “Require end-user to click through acknowledgement page” field. See
Custom Text and Logos: Authentication, and End-User
Acknowledgement Pages, page 17-18 for information about how this feature works with custom
messages.
In the Time Between Acknowledgements field, enter the time interval the appliance uses between displaying the end-user acknowledgement page.
You can specify any value from 30 to 2678400 seconds (one month). Default is 1 day (86400 seconds).
You can enter the value in seconds, minutes, or days. Use ‘s’ for seconds, ‘m’ for minutes, and ‘d’ for days.
In the Inactivity Timeout field, enter the maximum IP address idle timeout.
You can specify any value from 30 to 2678400 seconds (one month). Default is four hours (14400 seconds). You can enter the value in seconds, minutes, or days. Use ‘s’ for seconds, ‘m’ for minutes, and
‘d’ for days.
Select IP Address or Session Cookie for the Surrogate Type.
In the Custom Message field, enter any text you want to appear on every end-user acknowledgement page.
You can include some HTML tags in lower case to format the text. For a list of supported HTML tags, see
Supported HTML Tags in Notification Pages, page 17-17 .
For example:
Please acknowledge the following statements <i>before</i> accessing the Internet.
Click the “Preview Acknowledgment Page Customization” link to view the current end-user acknowledgement page in a separate browser window.
Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-15
Chapter 17 Notifying End Users
Configuring the End-User URL Filtering Warning Page
Configuring the End-User URL Filtering Warning Page
You can configure the end-user URL filtering warning page on the Security Services > End-User
Notification page. You can include some simple HTML tags in the custom message, such as font color and size.
To configure the end-user URL filtering warning page:
Step 1
Step 2
Navigate to the Security Services > End-User Notification page, and click Edit Settings .
Scroll down to the End-User URL Filtering Warning Page section.
Figure 17-3 Editing End-User URL Filtering Warning Page Settings
Step 3
Step 4
Step 5
Step 6
In the Time Between Warning field, enter the time interval the Web Proxy uses between displaying the end-user URL filtering warning page for each URL category per user.
Once a user clicks the continue link on the end-user URL filtering warning page, the Web Proxy considers that user to have acknowledged the warning for the time you enter here. This setting applies to users tracked by username and users tracked by IP address.
You can specify any value from 30 to 2678400 seconds (one month). Default is 1 hour (3600 seconds).
You can enter the value in seconds, minutes, or days. Use ‘s’ for seconds, ‘m’ for minutes, and ‘d’ for days.
In the Custom Message field, enter any text you want to appear on every end-user URL filtering warning page.
You might want to include text for the organization’s acceptable use policies, or include a link to a page that details the acceptable use policies.
You can include some HTML tags in lower case to format the text. For a list of supported HTML tags, see
Supported HTML Tags in Notification Pages, page 17-17
.
For example:
Please acknowledge the following statements <i>before</i> accessing the Internet.
Click the “Preview URL Category Warning Page Customization” link to view the current end-user URL filtering warning page in a separate browser window.
Submit and commit your changes.
17-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Working with FTP Notification Messages
Working with FTP Notification Messages
The FTP Proxy displays a predefined notification message to native FTP clients when the FTP Proxy cannot establish a connection with the FTP server for any reason, such as an error with FTP Proxy authentication or a bad reputation for the server domain name.
To configure FTP notification messages:
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to the Security Services > End-User Notification page, and click Edit Settings .
Scroll down to the Native FTP section.
In the Language field, select the language to use when displaying native FTP notification messages.
In the Custom Message field, enter the text you want to display in every native FTP notification message.
Submit and commit your changes.
Custom Text in Notification Pages
The following sections apply to custom text entered for on-box end-user notification and end-user acknowledgement pages.
Supported HTML Tags in Notification Pages
You can format the text in on-box end-user notification and end-user acknowledgement pages using some HTML tags. Tags must be in lower case and follow standard HTML syntax (closing tags, etc.).
You can use the following HTML tags.
•
•
•
<a></a>
<span></span>
<b></b>
<big></big> •
•
•
•
<br>
<code></code>
<em></em>
<i></i> •
•
•
<small></small>
<strong></strong>
For example, you can make some text italic:
Please acknowledge the following statements <i>before</i> accessing the Internet.
With the <span> tag, you can use any CSS style to format text. For example, you can make some text red:
<span style=”color: red”>Warning:</span> You must acknowledge the following statements
<i>before</i> accessing the Internet.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-17
Chapter 17 Notifying End Users
Notification Page Types
Custom Text and Logos: Authentication, and End-User Acknowledgement
Pages
All combinations of URL paths and domain names in embedded links within custom text and the custom logo in on-box end-user notification, end-user acknowledgement, and end-user URL filtering warning pages are exempted from the following:
•
•
User authentication
End-user acknowledgment
• All scanning, such as malware scanning and web reputation scoring
For example, if the following URLs are embedded in custom text: http://www.example.com/index.html
http://www.mycompany.com/logo.jpg
Then all of the following URLs will also be treated as exempt from all scanning: http://www.example.com/index.html
http://www.mycompany.com/logo.jpg
http://www.example.com/logo.jpg
http://www.mycompany.com/index.html
Also, where an embedded URL is of the form:
<protocol>://<domain-name>/<directory path>/
then all sub-files and sub-directories under that directory path on the host will also be exempted from all scanning.
For example, if the following URL is embedded: http://www.example.com/gallery2/ URLs such as http://www.example.com/gallery2/main.php
will also be treated as exempt.
This allows administrators to create a more sophisticated page with embedded content so long as the embedded content is relative to the initial URL. However, administrators should also take care when deciding which paths to include as links and custom logos.
Notification Page Types
Users accessing the Internet sometimes cannot access the server they want. By default, the Web Proxy displays a notification page informing users they were blocked and the reason for the block. This section lists and describes all possible notification pages a user might see while accessing the Internet.
Possible reasons that cause notification pages to appear include the following:
• End-user notification pages are enabled and the user accessed the Internet in a way that violated an
Access Policy.
•
•
End-user notification pages are configured to allow end-users to report misclassified pages to Cisco and the user reported a misclassified page.
The end-user acknowledgement page is enabled and the user accessed the Internet for the first time since the timeout period expired.
•
•
The HTTPS Proxy is enabled and the appliance is configured to drop HTTPS requests to servers with invalid certificates.
The Web Security appliance could not access the server requested due to an external error, such as
DNS failure or an unavailable server.
17-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Most notification pages display a different set of codes that may help administrators or Cisco IronPort
Customer Support troubleshoot any potential problem. Some codes are for Cisco internal use only. The different codes that might appear in the notification pages are the same as the variables you can include in customized notification pages, as shown in
describes the different notification pages users might encounter.
Table 17-6 Notification Page Types
File Name and
Notification Title
ERR_ACCEPTED
Feedback Accepted,
Thank You
ERR_ADAPTIVE_SECUR
ITY
Policy: General
ERR_ADULT_CONTENT
Policy Acknowledgement
Notification Description
Notification page that is displayed after the users uses the “Report Misclassification” option.
Block page that is displayed when the user is blocked due to the Adaptive Scanning feature.
The warning page that is displayed when the end-user accesses a page that is classified as adult content. Users can click an acknowledgement link to continue to the originally requested site.
Notification Text
The misclassification report has been sent.
Thank you for your feedback.
Based on your organization’s security policies, this web site < URL > has been blocked because its content has been determined to be a security risk.
You are trying to visit a web page whose content are rated as explicit or adult. By clicking the link below, you acknowledge that you have read and agree with the organization's policies that govern the usage of the Internet for this type of content. Data about your browsing behavior may be monitored and recorded. You will be periodically asked to acknowledge this statement for continued access to this kind of web page.
ERR_AVC
Policy: Application
Controls
ERR_BAD_REQUEST
Bad Request
Block page that is displayed when the user is blocked due to the Application Visibility and
Control engine.
Click here to accept this statement and access the Internet.
Based on your organization’s access policies, access to application %1 of type %2 has been blocked.
ERR_BLOCK_DEST
Policy: Destination
Error page that results from an invalid transaction request.
The system cannot process this request. A non-standard browser may have generated an invalid HTTP request.
If you are using a standard browser, please retry the request.
Block page that is displayed when the user tries to access a blocked website address.
Based on your organization’s Access Policies, access to this web site < URL > has been blocked.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-19
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_BROWSER
Security: Browser
ERR_BROWSER_CUSTO
M
Policy: Browser
ERR_CERT_INVALID
Invalid Certificate
ERR_CONTINUE_UNAC
KNOWLEDGED
Policy Acknowledgement
ERR_DNS_FAIL
DNS Failure
ERR_EXPECTATION_FA
ILED
Expectation Failed
Notification Description
Block page that is displayed when the transaction request comes from an application that has been identified to be compromised by malware or spyware.
Notification Text
Based on your organization’s Access Policies, requests from your computer have been blocked because it has been determined to be a security threat to the organization’s network.
Your browser may have been compromised by a malware/spyware agent identified as
“< malware name >”.
Please contact < contact name > < email address > and provide the codes shown below.
If you are using a non-standard browser and believe it has been misclassified, use the button below to report this misclassification.
Block page that is displayed when the transaction request comes from a blocked user agent.
Based on your organization’s Access Policies, requests from your browser have been blocked.
This browser “< browser type >” is not permitted due to potential security risks.
Block page that is displayed when the requested HTTPS site uses an invalid certificate.
Warning page that is displayed when the user requests a site that is in a custom URL category that is assigned the Warn action. Users can click an acknowledgement link to continue to the originally requested site.
A secure session cannot be established because the site < hostname > provided an invalid certificate.
You are trying to visit a web page that falls under the URL Category < URL category >. By clicking the link below, you acknowledge that you have read and agree with the organization’s policies that govern the usage of the Internet for this type of content. Data about your browsing behavior may be monitored and recorded. You will be periodically asked to acknowledge this statement for continued access to this kind of web page.
Error page that is displayed when the requested
URL contains an invalid domain name.
Click here to accept this statement and access the Internet.
The hostname resolution (DNS lookup) for this hostname < hostname > has failed. The Internet address may be misspelled or obsolete, the host
< hostname > may be temporarily unavailable, or the DNS server may be unresponsive.
Error page that is displayed when the transaction request triggers the HTTP 417
“Expectation Failed” response.
Please check the spelling of the Internet address entered. If it is correct, try this request later.
The system cannot process the request for this site < URL >. A non-standard browser may have generated an invalid HTTP request.
If using a standard browser, please retry the request.
17-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_FILE_SIZE
Policy: File Size
ERR_FILE_TYPE
Policy: File Type
Notification Description
Block page that is displayed when the requested file is larger than the allowed maximum file size.
Block page that is displayed when the requested file is a blocked file type.
Notification Text
Based on your organization’s Access Policies, access to this web site or download < URL > has been blocked because the download size exceeds the allowed limit.
Based on your organization’s Access Policies, access to this web site or download < URL > has been blocked because the file type “< file type >” is not allowed.
ERR_FILTER_FAILURE
Filter Failure
Error page that is displayed when the URL filtering engine is temporarily unable to deliver a URL filtering response and the “Default
Action for Unreachable Service” option is set to Block.
Internal redirection page for some errors.
The request for page < URL > has been denied because an internal server is currently unreachable or overloaded.
Please retry the request later.
The page < URL > is being redirected to
< redirected URL >.
ERR_FOUND
Found
ERR_FTP_ABORTED
FTP Aborted
Error page that is displayed when the FTP over
HTTP transaction request triggers the HTTP
416 “Requested Range Not Satisfiable” response.
The request for the file < URL succeed. The FTP server <
> did not hostname > unexpectedly terminated the connection.
Please retry the request later.
ERR_FTP_AUTH_REQUI
RED
Error page that is displayed when the FTP over
HTTP transaction request triggers the FTP 530
“Not Logged In” response.
Authentication is required by the FTP server
< hostname >. A valid user ID and password must be entered when prompted.
FTP Authorization
Required
ERR_FTP_CONNECTION
_FAILED
FTP Connection Failed
Error page that is displayed when the FTP over
HTTP transaction request triggers the FTP 425
“Can’t open data connection” response.
In some cases, the FTP server may limit the number of anonymous connections. If you usually connect to this server as an anonymous user, please try again later.
The system cannot communicate with the FTP server < hostname >. The FTP server may be temporarily or permanently down, or may be unreachable because of network problems.
ERR_FTP_FORBIDDEN
FTP Forbidden
ERR_FTP_NOT_FOUND
FTP Not Found
Error page that is displayed when the FTP over
HTTP transaction request is for an object the user is not allowed to access.
Error page that is displayed when the FTP over
HTTP transaction request is for an object that does not exist on the server.
Please check the spelling of the address entered. If it is correct, try this request later.
Access was denied by the FTP server
< hostname >. Your user ID does not have permission to access this document.
The file < URL > could not be found. The address is either incorrect or obsolete.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-21
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_FTP_SERVER_ERR
FTP Server Error
ERR_FTP_SERVICE_UN
AVAIL
FTP Service Unavailable
ERR_GATEWAY_TIMEO
UT
Gateway Timeout
ERR_IDS_ACCESS_FOR
BIDDEN
IDS Access Forbidden
ERR_INTERNAL_ERRO
R
Internal Error
ERR_MALWARE_SPECI
FIC
Security: Malware
Detected
Notification Description
Error page that is displayed for FTP over
HTTP transactions that try to access a server that does support FTP. The server usually returns the HTTP 501 “Not Implemented” response.
Notification Text
The system cannot communicate with the FTP server < hostname >. The FTP server may be temporarily or permanently down, or may not provide this service.
Error page that is displayed for FTP over
HTTP transactions that try to access an FTP server that is unavailable.
Please confirm that this is a valid address. If it is correct, try this request later.
The system cannot communicate with the FTP server < hostname >. The FTP server may be busy, may be permanently down, or may not provide this service.
Please confirm that this is a valid address. If it is correct, try this request later.
Error page that is displayed when the requested server has not responded in a timely manner.
The system cannot communicate with the external server < hostname >. The Internet server may be busy, may be permanently down, or may be unreachable because of network problems.
Block page that is displayed when the user tries to upload a file that is blocked due to a configured Cisco IronPort Data Security
Policy.
Please check the spelling of the Internet address entered. If it is correct, try this request later.
Based on your organization’s data transfer policies, your upload request has been blocked.
File details:
Error page that is displayed when there is an internal error.
< file details >
Internal system error when processing the request for the page < URL >.
Block page that is displayed when malware is detected when downloading a file.
Please retry this request.
If this condition persists, please contact
< contact name > < email address > and provide the code shown below.
Based on your organization’s Access Policies, this web site < URL > has been blocked because it has been determined to be a security threat to your computer or the organization’s network.
Malware < malware name > in the category
< malware category > has been found on this site.
17-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_MALWARE_SPECI
FIC_OUTGOING
Security: Malware
Detected
Notification Description
Block page that is displayed when malware is detected when uploading a file.
Notification Text
Based on your organization’s policy, the upload of the file to URL (< URL >) has been blocked because the file was detected to contain malware that will be harmful to the receiving end's network security.
Malware Name: < malware name >
Malware Category: < malware category >
ERR_NATIVE_FTP_DENI
ED
Block message displayed in native FTP clients when the native FTP transaction is blocked.
530 Login denied
ERR_NO_MORE_FORW
ARDS
No More Forwards
ERR_POLICY
Policy: General
ERR_PROTOCOL
Policy: Protocol
ERR_PROXY_AUTH_RE
QUIRED
Error page that is displayed when the appliance has detected a forward loop between the Web
Proxy and another proxy server on the network. The Web Proxy breaks the loop and displays this message to the client.
Block page that is displayed when the request is blocked by any policy setting.
The request for the page < URL > failed.
The server address < hostname > may be invalid, or you may need to specify a port number to access this server.
Block page that is displayed when the request is blocked based on the protocol used.
Based on your organization’s Access Policies, access to this web site < URL > has been blocked.
Based on your organization’s Access Policies, this request has been blocked because the data transfer protocol “< protocol type >” is not allowed.
Notification page that is displayed when users must enter their authentication credentials to continue. This is used for explicit transaction requests.
Authentication is required to access the
Internet using this system. A valid user ID and password must be entered when prompted.
Proxy Authorization
Required
ERR_PROXY_PREVENT
_MULTIPLE_LOGIN
Already Logged In From
Another Machine
ERR_PROXY_REDIRECT
Redirect
Block page that is displayed when someone tries to access the web using the same username that is already authenticated with the
Web Proxy on a different machine. This is used when the User Session Restrictions global authentication option is enabled.
Based on your organization’s policies, the request to access the Internet was denied because this user ID has an active session from another IP address.
Redirection page.
If you want to login as a different user, click on the button below and enter a different a user name and password.
This request is being redirected. If this page does not automatically redirect, click here to proceed.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-23
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_PROXY_UNACKNO
WLEDGED
Policy Acknowledgement
Notification Description
End-user acknowledgement page.
For more information, see
Acknowledgement Page, page 17-12
.
ERR_PROXY_UNLICEN
SED
Proxy Not Licensed
ERR_RANGE_NOT_SATI
SFIABLE
Range Not Satisfiable
ERR_REDIRECT_PERM
ANENT
Notification Text
Please acknowledge the following statements before accessing the Internet.
Your web transactions will be automatically monitored and processed to detect dangerous content and to enforce organization’s policies.
By clicking the link below, you acknowledge this monitoring and accept that data about the sites you visit may be recorded. You will be periodically asked to acknowledge the presence of the monitoring system. You are responsible for following organization’s polices on Internet access.
Click here to accept this statement and access the Internet.
Internet access is not available without proper licensing of the security device.
Block page that is displayed when there is no valid license key for the Web Security appliance Web Proxy.
Internal redirection page.
Please contact < contact name > < email address > and provide the code shown below.
Note To access the management interface of the security device, enter the configured IP address with port.
Error page that is displayed when the requested range of bytes cannot be satisfied by the web server.
The system cannot process this request. A non-standard browser may have generated an invalid HTTP request.
If you are using a standard browser, please retry the request.
The page < URL > is being redirected to
< redirected URL >.
Redirect Permanent
ERR_REDIRECT_REPEA
T_REQUEST
Internal redirection page.
Please repeat your request.
Redirect
ERR_SAAS_AUTHENTIC
ATION
SaaS Policy: Access
Denied
Notification page that is displayed when users must enter their authentication credentials to continue. This is used for accessing SaaS applications.
Based on your organization’s policy, the request to access < URL > was redirected to a page where you must enter the login credentials. You will be allowed to access the application if authentication succeeds and you have the proper privileges.
17-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Table 17-6 Notification Page Types (continued)
File Name and
Notification Title
ERR_SAAS_AUTHORIZ
ATION
SaaS Policy: Access
Denied
ERR_SAML_PROCESSIN
G
SaaS Policy: Access
Denied
ERR_SERVER_NAME_E
XPANSION
Server Name Expansion
ERR_URI_TOO_LONG
URI Too Long
Notification Description
Block page that is displayed when users try to access a SaaS application that they have no privilege to access.
Notification Text
Based on your organization’s policy, the access to the SaaS application < URL > is blocked because you are not an authorized user. If you want to login as a different user, enter a different username and password for a user that is authorized to access this application.
Error page that is displayed when an internal process fails trying to process the single sign-on URL for accessing a SaaS application.
The request to access < user name > did not go through because errors were found during the process of the single sign on request.
Internal redirection page that automatically expands the URL and redirects users to the updated URL.
The server name < redirected URL >.
hostname > appears to be an abbreviation, and is being redirected to
<
ERR_WBRS
Security: Malware Risk
ERR_WEBCAT
Policy: URL Filtering
ERR_WWW_AUTH_REQ
UIRED
WWW Authorization
Required
Block page that is displayed when the URL length is too long.
Block page that is displayed when the Web
Reputation Filters block the site due to a low web reputation score.
The requested URL was too long and could not be processed. This may represent an attack on your network.
Please contact < contact name > < email address > and provide the code shown below.
Based on your organization’s access policies, this web site < URL > has been blocked because it has been determined by Web Reputation
Filters to be a security threat to your computer or the organization’s network. This web site has been associated with malware/spyware.
Threat Type: %o
Block page that is displayed when users try to access a website in a blocked URL category.
Notification page that is displayed when the requested server requires users to enter their credentials to continue.
Threat Reason: %O
Based on your organization’s Access Policies, access to this web site < URL > has been blocked because the web category “< category type >” is not allowed.
Authentication is required to access the requested web site < hostname >. A valid user
ID and password must be entered when prompted.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-25
Notification Page Types
Chapter 17 Notifying End Users
17-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-27
Notification Page Types
Chapter 17 Notifying End Users
17-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-29
Notification Page Types
Chapter 17 Notifying End Users
17-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-31
Notification Page Types
Chapter 17 Notifying End Users
17-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-33
Notification Page Types
Chapter 17 Notifying End Users
17-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-35
Notification Page Types
Chapter 17 Notifying End Users
17-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 17 Notifying End Users
Notification Page Types
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
17-37
Notification Page Types
Chapter 17 Notifying End Users
17-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
18
URL Filters
This chapter contains the following information:
•
URL Filters Overview, page 18-1
•
•
•
•
•
•
•
•
•
•
•
Configuring the URL Filtering Engine, page 18-4
Managing Updates to the Set of URL Categories, page 18-5
Filtering Transactions Using URL Categories, page 18-9
Custom URL Categories, page 18-16
Filtering Adult Content, page 18-18
Redirecting Traffic, page 18-21
Warning Users and Allowing Them to Continue, page 18-22
Creating Time Based URL Filters, page 18-23
Viewing URL Filtering Activity, page 18-24
Regular Expressions, page 18-24
URL Category Descriptions, page 18-27
URL Filters Overview
AsyncOS for Web allows administrators to control user access based on the web server category of a particular HTTP or HTTPS request. For example, you can block all HTTP requests for gambling web sites, or you can decrypt all HTTPS requests for web-based email websites.
Using policy groups, you can create secure policies that control access to web sites containing objectionable or questionable content. The sites that are actually blocked, dropped, allowed, or decrypted depend on the categories you select when setting up category blocking for each policy group.
To control user access based on a URL category, you must enable Cisco IronPort Web Usage Controls.
This is a multi-layered URL filtering engine that uses domain prefixes and keyword analysis to categorize URLs, and real-time response content analysis using the Dynamic Content Analysis engine if no category is determined by prefixes and keywords. It includes over 80 predefined URL categories.
This engine also allows end users and administrators to report to Cisco any miscategorized URLs as well as uncategorized URLs for future inclusion in the categorization database. For more information, see
Dynamic Content Analysis Engine, page 18-2
.
You can use URL categories when performing the following tasks:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-1
Chapter 18 URL Filters
URL Filters Overview
• Define policy group membership.
You can define policy group membership by the URL category of the request URL.
• Control access to HTTP, HTTPS, and FTP requests.
You can choose to allow or block HTTP and
FTP requests by URL category using Access Policies, and you can choose to pass through, drop, or decrypt HTTPS requests by URL category using Decryption Policies. You can also choose whether or not to block upload requests by URL category using Cisco IronPort Data Security Policies. For more information, see
Filtering Transactions Using URL Categories, page 18-9
.
In addition to the predefined URL categories included with the URL filtering engine, you can create user defined custom URL categories that specify specific hostnames and IP addresses. For more information, see
Custom URL Categories, page 18-16 .
Dynamic Content Analysis Engine
The Dynamic Content Analysis engine is a scanning engine called at response time to categorize a transaction that failed categorization using only the URL in the client request. You might want to enable
Dynamic Content Analysis when your organization’s traffic visits more of the newer, and therefore not yet categorized, sites on the Internet.
Enable the Dynamic Content Analysis engine when you enable Cisco IronPort Web Usage Controls on the Security Services > Acceptable Use Controls page.
After the Dynamic Content Analysis engine categorizes a URL, it stores the category verdict and URL in a temporary cache. This allows future transactions to benefit from the earlier response scan and be categorized at request time instead of at response time, and it improves overall performance.
The Dynamic Content Analysis engine categorizes URLs when controlling access to websites in Access
Policies only. It does not categorize URLs when determining policy group membership or when controlling access to websites using Decryption or Cisco IronPort Data Security Policies. This is because the engine works by analyzing the response content from the destination server, so it cannot be used on decisions that must be made at request time before any response is downloaded from the server.
Enabling the Dynamic Content Analysis engine can impact transaction performance. However, most transactions are categorized using the Cisco IronPort Web Usage Controls URL categories database, so the Dynamic Content Analysis engine is usually only called for a small percentage of transactions.
Note It is possible for an Access Policy, or an Identity used in an Access Policy, to define policy membership by a predefined URL category and for the Access Policy to perform an action on the same URL category.
In this case, it is also possible for the URL in the request to be uncategorized when determining Identity and Access Policy group membership, but to be categorized by the Dynamic Content Analysis engine after receiving the server response. In this scenario, Cisco IronPort Web Usage Controls ignores the category verdict from the Dynamic Content Analysis engine and the URL retains the “uncategorized” verdict for the remainder of the transaction. However, future transactions still benefit from the new category verdict.
Uncategorized URLs
An uncategorized URL is a URL that does not match any pre-defined URL category or included custom
URL category.
18-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Filters Overview
Note When determining policy group membership, a custom URL category is considered included only when it is selected for policy group membership.
All transactions resulting in unmatched categories are reported on the Reporting > URL Categories page as “Uncategorized URLs.” A large number of uncategorized URLs are generated from requests to web sites within the internal network. Because this type of internal transaction can falsely inflate reporting data and misrepresent the efficacy of the URL filtering engine, Cisco recommends using custom URL categories to group internal URLs and allow all requests to internal web sites. This decreases the number of web transactions reported as “Uncategorized URLs” and instead reports internal transactions as part of “URL Filtering Bypassed” statistics.
For more information, see
Understanding Unfiltered and Uncategorized Data, page 18-24 .
For more information about creating custom URL categories, see
Custom URL Categories, page 18-16 .
Matching URLs to URL Categories
When the URL filtering engine matches a URL category to the URL in a client request, it first evaluates the URL against the custom URL categories included in the policy group. If the URL in the request does not match an included custom category, the URL filtering engine compares it to the predefined URL categories. If the URL does not match any included custom or predefined URL categories, the request is uncategorized.
Note When determining policy group membership, a custom URL category is considered included only when it is selected for policy group membership.
Tip
Misclassified URLs, page 18-3 .
For more information about uncategorized URLs, see
.
Reporting Uncategorized and Misclassified URLs
When you use Cisco IronPort Web Usage Controls, you can report uncategorized and misclassified
URLs to Cisco. Cisco provides a URL submission tool on its website that allows you to submit multiple
URLs simultaneously: https://securityhub.cisco.com/web/submit_urls
To check the status of submitted URLs, click the Status on Submitted URLs tab on this page.
You can also use the URL submission tool to look up the assigned URL category for any URL.
The URL Categories Database
The category that a URL falls into is determined by a filtering categories database. The Web Security appliance collects information and maintains a separate database for each URL filtering engine. The filtering categories databases periodically receive updates from the Cisco IronPort update server
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-3
Chapter 18 URL Filters
Configuring the URL Filtering Engine
( https://update-manifests.ironport.com
). Server updates are automated, and the update interval is set by the server as opposed to the appliance. Updates to the database occur regularly, and require no administrator intervention.
Cisco IronPort Web Usage Controls shares some database components with the Web Reputation Filters
(WBRS) database. Because of this shared information, Cisco recommends fully participating in the
SensorBase Network because it allows Cisco IronPort Web Usage Controls to validate and categorize all
URLs dynamically classified by the Dynamic Content Analysis engine, including all URLs that could not otherwise be classified, improving overall efficacy.
For information about update intervals and the Cisco IronPort update server, see
Security Service Components, page 27-41 .
The URL categories database includes many different factors and sources of data internal to Cisco and from the Internet. One of the factors occasionally considered, heavily modified from the original, is information from the Open Directory Project.
Tip To see what category a particular web site is assigned to, go to the URL in
.
Configuring the URL Filtering Engine
To apply predefined category settings to policy groups and configure custom settings to manage web transactions, see the sections below. By default, the Cisco IronPort Web Usage Controls URL filtering engine is enabled in the System Setup Wizard. You can change this setting and configure URL filtering options using the following procedure:
Step 1
Step 2
Navigate to the Security Services > Acceptable Use Controls page.
Click Edit Global Settings .
The Edit Acceptable Use Controls Settings page appears.
Step 3 Verify the Enable Acceptable Use Controls property is enabled.
Note For information about the Application Visibility and Control setting, see
“Understanding Application Visibility and Control.”
Step 4 Choose whether or not to enable the Dynamic Content Analysis Engine.
18-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Managing Updates to the Set of URL Categories
Step 5
Step 6
For more information on the Dynamic Content Analysis Engine, see
Dynamic Content Analysis Engine, page 18-2
.
Choose the default action the Web Proxy should use when the URL filtering engine is unavailable, either
Monitor or Block. Default is Monitor.
Submit and commit your changes.
Managing Updates to the Set of URL Categories
The set of predefined URL categories for Cisco IronPort Web Usage Control may occasionally be updated, in order to accommodate new web trends and evolving usage patterns.
Updates to the URL category set are distinct from the changes that simply add new URLs and re-map misclassified URLs, as described in
The URL Categories Database, page 18-3
. Category set updates may change configurations in your existing policies and therefore require action from you.
URL category set updates may occur between product releases; an AsyncOS upgrade is not required.
Information about each update will be available from http://www.cisco.com/en/US/products/ps10164/prod_release_notes_list.html
.
You should take the following actions:
When to Act
Before updates occur
For Information, Review This Section
•
Understanding the Impacts of URL Category Set Updates, page 18-5
(Do these tasks as part of your initial setup)
•
•
•
Controlling Updates to the URL Category Set, page 18-8
Choosing Default Settings for New and Changed Categories, page 18-9
Ensuring that You Receive Alerts About Category and Policy Changes, page 18-9
After updates occur •
Responding to Alerts about URL Category Set Updates, page 18-9
•
•
URL Category Set Updates and Reports, page 24-15
This section describes how URL category set changes impact reporting and web tracking data.
Policy changes resulting from URL category set updates are logged in the
GUI logs. See the Logging chapter for more information.
Understanding the Impacts of URL Category Set Updates
URL category set updates can have the following impacts on existing Access Policies, Decryption
Policies, and Cisco IronPort Data Security policies, and on Identities:
•
•
Effects of URL Category Set Changes on Policy Group Membership, page 18-5
Effects of URL Category Set Updates on Filtering Actions in Policies, page 18-6
Effects of URL Category Set Changes on Policy Group Membership
This section applies to all policy types with membership that can be defined by URL category, and to
Identities.
When policy group membership is defined by URL category, changes to the category set may have the following effects:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-5
Chapter 18 URL Filters
Managing Updates to the Set of URL Categories
•
•
If the sole criterion for membership is a deleted category, the policy or identity is disabled.
If membership in any policy is defined by a URL category that changes, and if this causes ACL list changes, the web proxy will restart. For the effects of proxy restarts, see
Restart on Commit, page 2-10 .
Effects of URL Category Set Updates on Filtering Actions in Policies
URL category set updates can change policy behavior in the following ways:
Table 18-1 Effects of URL Category Set Updates
Change Effect on Policies and Identities
A new category can be added
A category can be deleted
For each policy, the default action for newly-added categories is the action specified for
Uncategorized URLs for that policy.
The action associated with the deleted category is deleted.
If the policy depended exclusively on the deleted category, the policy is disabled.
If a policy depends on an identity that depended exclusively on a deleted category, the policy will be disabled.
No change to the behavior of the existing policy. A category can be renamed
A category can split A single category can become multiple new categories.
For example, a single “Arts and Entertainment” category might become two categories, “Arts” and
“Entertainment”.
Both new categories have the action associated with the original category.
18-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Managing Updates to the Set of URL Categories
Table 18-1 Effects of URL Category Set Updates
Change
Two or more existing categories can merge
Effect on Policies and Identities
If all original categories in a policy had the same action assigned, the merged category has the same action as the original categories. If all original categories were set to “Use Global Setting” then the merged category is also set to “Use Global Setting.”
If the policy had different actions assigned to the original categories, the action assigned to the merged category depends on the Uncategorized URLs setting in that policy:
• If Uncategorized URLs is set to Block (or “Use Global Setting” when the global setting is
Block), then the most restrictive action among the original categories is applied to the merged category.
• If Uncategorized URLs is set to any action other than Block (or “Use Global Setting” when the global setting is anything other than Block), then the least restrictive action among the original categories is applied to the merged category.
In this case, sites that were previously blocked may now be accessible to users.
If policy membership is defined by URL category, and some of the categories involved in the merge, or the Uncategorized URLs action, are not included in the policy membership definition, then the values in the Global Policy are used for the missing items.
The order of restrictiveness is as follows (not all actions are available for all policy types):
•
•
•
Block
Drop
Decrypt
Warn •
•
•
Time-based
Monitor
• Pass Through
For more information, see Merged Categories - Examples, page 18-7 .
Note: Time-based policies that are based on merged categories adopt the action associated with any one of the original categories. (In time-based policies, there may be no obviously most- or least-restrictive action.)
Merged Categories - Examples
Some examples of merged categories, based on settings on the URL Filtering page for the policy:
Table 18-2 Example Outcomes When Categories Merge
Original Category 1 Original Category 2
Monitor
Block Block
Use Global
Settings
Use Global Settings
Uncategorized URLs Merged Category
Monitor
Block
Settings
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-7
Chapter 18 URL Filters
Managing Updates to the Set of URL Categories
Table 18-2 Example Outcomes When Categories Merge
Original Category 1 Original Category 2
Warn Block
Monitor •
•
Block or
Use Global Settings, when Global is set to Block
Uncategorized URLs
Monitor
Merged Category
Warn
Thus, use the least restrictive among the original categories.
• Block or Block
• Use Global Setting, when Global is set to
Block
Thus, use the most restrictive among the original categories.
• Monitor or Monitor Block • Monitor or
For policies in which membership is defined by URL category:
• Use Global Settings, when Global is set to Monitor
• Use Global Setting, when Global is set to
Monitor
Thus, use the least restrictive among the original categories.
An action for this category is not specified in this policy, but the value in the Global Policy for this category is Block
An action for Uncategorized URLs is not specified in this policy, but the value in the
Global Policy for Uncategorized URLs is
Monitor
Monitor
Monitor
Controlling Updates to the URL Category Set
By default, URL category set updates occur automatically. However, because these updates may change existing policy configurations, you may prefer to disable all automatic updates, including URL category set updates.
If you disable updates, you will need to manually update all services listed in the Update Servers (list) section of the System Administration > Upgrade and Update Settings page. See
URL Category Set, page 18-8 and
Manually Updating Security Service Components, page 27-41
.
To disable all automatic updates, see
Configuring the Update and Upgrade Settings from the Web
Configuring the Update and Upgrade Settings from the CLI, page 27-41
. If you use the CLI, disable updates by setting the update interval to zero (0).
Manually Updating the URL Category Set
Note Do not interrupt an update in progress.
If you have disabled automatic updates, you can manually update the set of URL categories at your convenience:
Step 1
Step 2
Navigate to the Security Services > Acceptable Use Controls page.
Determine whether an update is available:
18-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Filtering Transactions Using URL Categories
Step 3
Look at the “Cisco IronPort Web Usage Controls - Web Categorization Categories List” item in the
Acceptable Use Controls Engine Updates table.
To update, click Update Now .
Choosing Default Settings for New and Changed Categories
URL category set updates may change the behavior of your existing policies. You should specify default settings for certain changes when you configure your policies, so that they are ready when URL category set updates occur.
When new categories are added, or existing categories merge into a new category, the default action for these categories for each policy are affected by the Uncategorized URLs setting in that policy. To choose
.
To verify existing settings and/or make changes, click the URL Filtering link for each Access Policy,
Decryption Policy, and Cisco IronPort Data Security policy, and check the selected setting for
Uncategorized URLs.
Ensuring that You Receive Alerts About Category and Policy Changes
Category set updates trigger two types of alerts: Alerts about category changes and alerts about policies that have changed or been disabled as a result of category set changes.
To verify that you will receive alerts about URL category set updates, go to System Administration >
Alerts and make sure you will receive Warning-level alerts in the System category. More information about alerts is in
Responding to Alerts about URL Category Set Updates
When you receive an alert about category set changes, you should do the following:
• Check policies and identities to be sure that they still meet your policy goals after category merges, additions, and deletions, and
• Consider modifying policies and identities to benefit from new categories and the added granularity of split categories.
Use the information in
Understanding the Impacts of URL Category Set Updates, page 18-5 to guide
your review of your policies and identities.
Filtering Transactions Using URL Categories
The URL filtering engine configured allows you to filter transactions in Access, Decryption, and Data
Security Policies. To configure URL filtering in a policy group, click the link in the policies table under the URL Categories column for the policy group you want to edit. For more information about the policies table, see
Using the Policies Tables, page 8-5 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-9
Chapter 18 URL Filters
Filtering Transactions Using URL Categories
When you configure URL categories for policy groups, you can configure actions for custom URL categories, if any are defined, and predefined URL categories. For more information about custom URL categories, see
Custom URL Categories, page 18-16 .
The URL filtering actions you can configure depends on the type of policy group.
• Access Policies.
See
Configuring URL Filters for Access Policy Groups, page 18-10
.
•
•
Decryption Policies.
See
Configuring URL Filters for Decryption Policy Groups, page 18-12 .
Cisco IronPort Data Security Policies.
See Configuring URL Filters for Data Security Policy
.
Configuring URL Filters for Access Policy Groups
You can configure URL filtering for user defined Access Policy groups and the Global Policy Group.
To configure URL filtering in an Access Policy group:
Step 1
Step 2
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the URL Filtering column for the policy group you want to edit.
The Access Policies: URL Filtering: policyname page appears.
Figure 18-1 Configuring Access Policy URL Categories
Step 3 Optionally, in the Custom URL Category Filtering section, you can add custom URL categories on which to take action in this policy: a.
Click Select Custom Categories .
The Select Custom Categories for this Policy dialog box appears.
18-10 b.
Choose which custom URL categories to include in this policy and click Apply .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Filtering Transactions Using URL Categories
Choose which custom URL categories the URL filtering engine should compare the client request against. The URL filtering engine compares client requests against included custom URL categories, and ignores excluded custom URL categories. The URL filtering engine compares the URL in a client request to included custom URL categories before predefined URL categories.
The custom URL categories included in the policy appear in the Custom URL Category Filtering section.
Step 4 In the Custom URL Category Filtering section, choose an action for each included custom URL category.
describes each action.
Table 18-3 URL Category Filtering for Access Policies
Action
Use Global
Setting
Redirect
Allow
Monitor
Warn
Block
Time-Based
Description
Uses the action for this category in the Global Policy Group. This is the default action for user defined policy groups.
Applies to user defined policy groups only.
Note: When a custom URL category is excluded in the global Access Policy, then the default action for included custom URL categories in user defined Access Policies is
Monitor instead of Use Global Settings. You cannot choose Use Global Settings when a custom URL category is excluded in the global Access Policy.
Redirects traffic originally destined for a URL in this category to a location you specify. When you choose this action, the Redirect To field appears. Enter a URL to which to redirect all traffic.
For more information about redirecting traffic, see
Redirecting Traffic, page 18-21
.
Always allows client requests for web sites in this category.
Allowed requests bypass all further filtering and malware scanning.
Only use this setting for trusted web sites. You might want to use this setting for internal sites.
The Web Proxy neither allows nor blocks the request. Instead, it continues to evaluate the client request against other policy group control settings, such as web reputation filtering.
The Web Proxy initially blocks the request and displays a warning page, but allows the user to continue by clicking a hypertext link in the warning page.
For more information, see
Warning Users and Allowing Them to Continue, page 18-22 .
The Web Proxy denies transactions that match this setting.
The Web Proxy blocks or monitors the request during the time ranges you specify.
For more information about creating time based URL filtering actions, see
Time Based URL Filters, page 18-23 .
Step 5 In the Predefined URL Category Filtering section, choose one of the following actions for each category:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-11
Chapter 18 URL Filters
Filtering Transactions Using URL Categories
Step 6
Step 7
•
•
Use Global Settings
Monitor
Warn •
•
•
Block
Time-Based
See
for details on these actions.
In the Uncategorized URLs section, choose the action to take for client requests to web sites that do not fall into a predefined or custom URL category. This setting also determines the default action for new and merged categories resulting from URL category set updates. For details, see
Category Set Updates on Filtering Actions in Policies, page 18-6
.
Submit and commit your changes.
Configuring URL Filters for Decryption Policy Groups
You can configure URL filtering for user defined Decryption Policy groups and the global Decryption
Policy group.
To configure URL filtering in a Decryption Policy group:
Step 1
Step 2
Navigate to the Web Security Manager > Decryption Policies page.
Click the link in the policies table under the URL Categories column for the policy group you want to edit.
The Decryption Policies: URL Categories: policyname page appears.
Figure 18-2 Configuring Decryption Policy URL Categories
Step 3 Optionally, in the Custom URL Category Filtering section, you can add custom URL categories on which to take action in this policy: a.
Click Select Custom Categories .
The Select Custom Categories for this Policy dialog box appears.
18-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Filtering Transactions Using URL Categories b.
Choose which custom URL categories to include in this policy and click Apply .
Choose which custom URL categories the URL filtering engine should compare the client request against. The URL filtering engine compares client requests against included custom URL categories, and ignores excluded custom URL categories. The URL filtering engine compares the
URL in a client request to included custom URL categories before predefined URL categories.
The custom URL categories included in the policy appear in the Custom URL Category Filtering section.
Step 4 Choose an action for each custom and predefined URL category.
Table 18-4 describes each action.
Table 18-4 URL Category Filtering for Decryption Policies
Action
Use Global
Setting
Pass Through
Monitor
Description
Uses the action for this category in the global Decryption Policy group. This is the default action for user defined policy groups.
Applies to user defined policy groups only.
When a custom URL category is excluded in the global Decryption Policy, then the default action for included custom URL categories in user defined Decryption
Policies is Monitor instead of Use Global Settings. You cannot choose Use Global
Settings when a custom URL category is excluded in the global Decryption Policy.
Passes through the connection between the client and the server without inspecting the traffic content. You might want to pass through connections to trusted secure sites, such as well known banking and financial institutions.
The Web Proxy neither allows nor blocks the request. Instead, it continues to evaluate the client request against other policy group control settings, such as web reputation filtering.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-13
Chapter 18 URL Filters
Filtering Transactions Using URL Categories
Table 18-4
Action
Decrypt
Drop
URL Category Filtering for Decryption Policies (continued)
Description
Allows the connection, but inspects the traffic content. The appliance decrypts the traffic and applies Access Policies to the decrypted traffic as if it were a plaintext
HTTP connection. By decrypting the connection and applying Access Policies, you can scan the traffic for malware. You might want to decrypt connections to third party email providers, such as gmail or hotmail.
For more information about how the appliance decrypts HTTPS traffic, see
Decrypting HTTPS Traffic, page 12-9
.
Drops the connection and does not pass the connection request to the server. The appliance does not notify the user that it dropped the connection. You might want to drop connections to third party proxies that allow users on the network bypass the organization’s acceptable use policies.
Note If you want to block a particular URL category for HTTPS requests, choose to decrypt that URL category in the Decryption Policy group and then choose to block the same URL category in the
Access Policy group.
Step 5
Step 6
In the Uncategorized URLs section, choose the action to take for client requests to web sites that do not fall into a predefined or custom URL category.
This setting also determines the default action for new and merged categories resulting from URL category set updates. For details, see
Effects of URL Category Set Updates on Filtering Actions in
You can choose any action listed in
.
Submit and commit your changes.
Configuring URL Filters for Data Security Policy Groups
You can configure URL filtering for user defined Data Security Policy groups and the Global Policy
Group.
To configure URL filtering in a Data Security Policy group:
Step 1
Step 2
Navigate to the Web Security Manager > Cisco IronPort Data Security page.
Click the link in the policies table under the URL Categories column for the policy group you want to edit.
The Cisco IronPort Data Security Policies: URL Categories: policyname page appears.
18-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Figure 18-3
Filtering Transactions Using URL Categories
Configuring Data Security Policy URL Categories
Step 3 Optionally, in the Custom URL Category Filtering section, you can add custom URL categories on which to take action in this policy: a.
Click Select Custom Categories .
The Select Custom Categories for this Policy dialog box appears.
b.
Choose which custom URL categories to include in this policy and click Apply .
Choose which custom URL categories the URL filtering engine should compare the client request against. The URL filtering engine compares client requests against included custom URL categories, and ignores excluded custom URL categories. The URL filtering engine compares the
URL in a client request to included custom URL categories before predefined URL categories.
The custom URL categories included in the policy appear in the Custom URL Category Filtering section.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-15
Chapter 18 URL Filters
Custom URL Categories
Step 4 In the Custom URL Category Filtering section, choose an action for each custom URL category.
Table 18-5 describes each action.
Table 18-5 URL Category Filtering for Cisco IronPort Data Security Policies
Action
Use Global
Setting
Allow
Monitor
Block
Description
Uses the action for this category in the Global Policy Group. This is the default action for user defined policy groups.
Applies to user defined policy groups only.
When a custom URL category is excluded in the global Cisco IronPort Data Security
Policy, then the default action for included custom URL categories in user defined
Cisco IronPort Data Security Policies is Monitor instead of Use Global Settings. You cannot choose Use Global Settings when a custom URL category is excluded in the global Cisco IronPort Data Security Policy.
Always allows upload requests for web sites in this category. Applies to custom URL categories only.
Allowed requests bypass all further data security scanning and the request is evaluated against Access Policies.
Only use this setting for trusted web sites. You might want to use this setting for internal sites.
The Web Proxy neither allows nor blocks the request. Instead, it continues to evaluate the upload request against other policy group control settings, such as web reputation filtering.
The Web Proxy denies transactions that match this setting.
Step 5
Step 6
Step 7
In the Predefined URL Category Filtering section, choose one of the following actions for each category:
• Use Global Settings
•
•
Monitor
Block
See
for details on these actions.
In the Uncategorized URLs section, choose the action to take for upload requests to web sites that do not fall into a predefined or custom URL category. This setting also determines the default action for new and merged categories resulting from URL category set updates. For details, see
Category Set Updates on Filtering Actions in Policies, page 18-6
.
Submit and commit your changes.
Custom URL Categories
The Web Security appliance ships with many predefined URL categories by default, such as Web-based
Email and more. However, you can also create user defined custom URL categories that specify specific hostnames and IP addresses. You might want to create custom URL categories for internal sites or a group of external sites you know you can trust.
Create, edit, and delete custom URL categories on the Web Security Manager > Custom URL Categories page.
18-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Figure 18-4 Custom URL Categories Page
Custom URL Categories
Edit custom URL category.
Add a custom URL category.
Delete custom URL category.
Note The Web Security appliance uses the first four characters of custom URL category names preceded by
“c_” in the access logs. Consider the custom URL category name if you use Sawmill for IronPort to parse the access logs. If the first four characters of the custom URL category include a space, Sawmill for
IronPort cannot properly parse the access log entry. Instead, only use supported characters in the first four characters if you will use Sawmill for IronPort to parse the access logs. If you want to include the full name of a custom URL category in the access logs, add the %XF format specifier to the access logs.
For more information on how to do this, see
Custom Formatting in Access Logs and W3C Logs, page 25-28
.
It is possible to create multiple custom URL categories and include the same URL in each category. The order of the custom URL categories matters. Categories listed higher in the list take priority over categories listed lower. When you include these custom URL categories in the same Access, Decryption, or Cisco IronPort Data Security Policy group and define different actions to each category, the action of the higher included custom URL category takes effect.
To create or edit a custom URL category:
Step 1
Step 2
Navigate to the Web Security Manager > Custom URL Categories page.
To create a custom URL category, click Add Custom Category . To edit an existing custom URL category, click the name of the URL category.
Figure 18-5 Creating a Custom URL Category
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-17
Chapter 18 URL Filters
Filtering Adult Content
Step 3 Enter the settings in
for the custom URL category.
Table 18-6 Custom URL Category Settings
Setting
Category Name
List Order
Sites
Advanced: Regular
Expressions
Description
Enter a name for the URL category. This name appears when you configure
URL filtering for policy groups.
Choose the order in the list of custom URL categories to place this category.
Enter “1” for the topmost URL category.
The URL filtering engine evaluates a client request against the custom URL categories in the order specified.
Enter one or more addresses that belong in the custom category.
You can enter multiple addresses separated by line breaks or commas. You can enter addresses using any of the following formats:
•
•
•
•
IP address, such as 10.1.1.0
CIDR address, such as 10.1.1.0/24
Domain name, such as example.com
Hostname, such as crm.example.com
• Partial hostname, such as .example.com
Note: Entering a partial hostname, such as .example.com, also matches www.example.com.
You can use regular expressions to specify multiple web servers that match the pattern you enter.
Note: The URL filtering engine compares URLs with addresses entered in the
Sites field first. If the URL of a transaction matches an entry in the Sites field, it is not compared to any expression entered here.
For more information about using regular expressions in the Web Security appliance, see
Regular Expressions, page 18-24 .
Step 4 Optionally, click Sort URLs to sort all addresses in the Sites field.
Note Once you sort the addresses, you cannot retrieve their original order.
Step 5 Submit and commit your changes.
Filtering Adult Content
You can configure the Web Security appliance to filter adult content from some web searches and websites. You might want to do this to allow access to these sites, such as google.com and youtube.com, while still restricting potentially unsafe content from reaching users. For example, a school district could allow access to educational videos on youtube.com, but block inappropriate contents for students.
AsyncOS for Web offers the following features to filter adult content:
18-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Filtering Adult Content
• Enforce safe searches.
Many search engines support a filtering technology feature that classifies inappropriate content on the web as adult. When this filtering feature is enabled, content classified as adult is filtered from the search results before presented to the user. This feature is commonly called safe search. However, for most search engines, this feature is enabled and disabled by end users. You can configure the Web Security appliance so that outgoing search requests appear to search engines as safe search requests. This gives the control to an administrator on the network instead of the end user. You might want to do this to prevent users from bypassing acceptable use policies using search engines.
• Enforce site content ratings.
Many content sharing sites that serve user-generated photos and videos classify some of their content as adult.They allow users to restrict their own access to the adult content on these sites by either enforcing their own safe search feature or blocking access to adult content, or both. This classification feature is commonly called content ratings.
You enforce safe searches and site content ratings for different users by enabling the feature at the Access
Policy level. Not all search engines or content sharing websites are supported, but AsyncOS for Web can support additional search engines and websites during URL filtering engine updates. The Access
Policies > URL Filtering > policyname page always lists the currently supported search engines and websites for each feature. The list of supported search engines and content sharing websites may increase with AVC engine updates.
Consider the following rules and guidelines when enforcing safe search and site content ratings:
• To use the safe search and site content ratings features, AsyncOS for Web must use the URL filtering engine included with Cisco IronPort Web Usage Controls.
•
•
The safe search feature enforces strict safe searches.
When the URL of one of the supported search engines or supported content ratings websites is included in a custom URL category with the Allow action applied, then users can access that URL as if the safe search or content ratings features were disabled. That is, no search results are blocked and all content is visible.
•
•
•
•
You can choose whether or not to block users from search engines that are not currently supported by the Web Security appliance safe search feature.
Due to the limitations inherent in youtube.com, the Web Proxy is not able to block embedded
YouTube videos from a third party website.
When configuring the site content ratings feature, you can choose whether to block users from adult content or to provide them with end-user URL filtering warning page that allows them to view the adult content after clicking a link to accept the warning message. For more information, see
Users and Allowing Them to Continue, page 18-22
.
Any Access Policy that has either the safe search or site content ratings feature enabled is considered a safe browsing Access Policy.
To enforce safe searches and site content ratings:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Access Policies page.
Click the link under the URL Categories column for an Access Policy group or the Global Policy Group.
The Access Policies: URL Filtering: policyname page appears.
When editing a user-defined Access Policy, choose Define Content Filtering Custom Settings in the
Content Filtering section.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-19
Chapter 18 URL Filters
Filtering Adult Content
Step 4
Step 5
Step 6
Step 7
Step 8
Click the Enable Safe Search check box to enable the safe search feature.
Choose whether to block users from search engines that are not currently supported by the Web Security appliance safe search feature.
Click the Enable Site Content Rating check box to enable the site content ratings feature.
Choose whether to block all adult content from the supported content ratings websites or to display the end-user URL filtering warning page.
Submit and commit your changes.
Logging Adult Content Access
By default, the access logs include a safe browsing scanning verdict inside the angled brackets of each entry. The safe browsing scanning verdict indicates whether or not either the safe search or site content ratings feature was applied to the transaction. You can also add the safe browsing scanning verdict variable to the access logs or W3C access logs:
• Access logs: %XS
• W3C access logs: x-request-rewrite
Table 18-7 describes the safe browsing scanning verdict values.
Table 18-7 Safe Browsing Scanning Verdict Values
Value ensrch encrt unsupp err
-
Description
The original client request was unsafe and the safe search feature was applied.
The original client request was unsafe and the site content ratings feature was applied.
The original client request was to an unsupported search engine.
The original client request was unsafe, but neither the safe search nor the site content ratings feature could be applied due to an error.
Neither the safe search nor the site content ratings feature was applied to the client request because the features were bypassed (for example, the transaction was allowed in a custom
URL category) or the request was made from an unsupported application.
For more information on logging, see
Requests blocked due to either the safe search or site content rating features, use one of the following
ACL decision tags in the access logs:
•
•
•
BLOCK_SEARCH_UNSAFE
BLOCK_CONTENT_UNSAFE
BLOCK_UNSUPPORTED_SEARCH_APP
18-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
• BLOCK_CONTINUE_CONTENT_UNSAFE
For more information on the ACL decision tags, see
.
Redirecting Traffic
Redirecting Traffic
In addition to using the Web Security appliance to monitor and block traffic to certain websites, you can also use it to redirect users to a different website. You can configure the appliance to redirect traffic originally destined for a URL in a custom URL category to a location you specify. This allows you to redirect traffic at the appliance instead of at the destination server.
You might want to redirect traffic at the appliance if your organization published the links to an internal site, but the location of the site changed since publication, or if you do not have control over the web server.
Configure the appliance to redirect custom URL categories to another location when you configure the
URL categories for an Access Policy group. You can redirect traffic for a custom Access Policy group or the Global Policy Group.
To redirect traffic, you must define at least one custom URL category. For more information about creating custom URL categories, see
Custom URL Categories, page 18-16
.
Note Beware of infinite loops when you configure the appliance to redirect traffic. For example, if you redirect traffic destined for http://A.example.com to http://B.example.com and you also inadvertently redirect traffic destined for http://B.example.com to http://A.example.com, then you create an infinite loop. In this case, the appliance redirects the traffic back and forth between the two URLs indefinitely.
Logging and Reporting
When you redirect traffic, the access log entry for the originally requested website has an ACL tag that starts with REDIRECT_CUSTOMCAT. Later in the access log (typically the next line) appears the entry for the website to which the user was redirected.
The reports displayed on the Reporting tab display redirected transactions as “Allowed.”
Redirecting Traffic in the Access Policies
To redirect traffic:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Navigate to the Web Security Manager > Access Policies page.
Click the link under the URL Categories column for an Access Policy group or the Global Policy Group.
The Access Policies: URL Filtering: policyname page appears.
In the Custom URL Category Filtering section, click Select Custom Categories .
In the Select Custom Categories for this Policy dialog box, choose “Include in policy” for the custom
URL category you want to redirect.
Click Apply .
Click the Redirect column for the custom category you want to redirect.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-21
Chapter 18 URL Filters
Warning Users and Allowing Them to Continue
Step 7 Enter the URL to which you want to redirect traffic in the Redirect To field for the custom category.
Step 8 Submit and commit your changes.
Warning Users and Allowing Them to Continue
In addition to using the Web Security appliance to block traffic to certain websites, you can also use it to warn users that a site does not meet the organization’s acceptable use policies and allow them to continue if they choose. You might want to warn users and allow them to continue if your organization wants to discourage its users from accessing certain sites, but does not want to or is not allowed by law to block access to those sites.
You can warn users and allow them to continue using one of the following methods:
•
•
Choose the Warn action for a URL category in an Access Policy group.
Enable the site content ratings feature and warn users that access adult content instead of blocking them. For more information on the site content ratings feature, see
Filtering Adult Content, page 18-18
.
When users access a URL that is configured to warn and continue, they initially see an IronPort notification page with a warning about accessing sites of this category or content. The end-user URL filtering warning page includes the following elements:
• Default warning text provided by Cisco
•
•
Custom text provided by the Web Security appliance administrator (optional)
Notification code listing the invoked Access Policy and the URL category being warned or the safe browsing scanning verdict.
• A hypertext link to the originally requested URL
Users are tracked in the access log by user name if authentication has made a user name available, and tracked by IP address if no user name is available.
When you use the warn and continue feature, you can configure the following settings that affect the end-user URL filtering warning page:
• Time Between Warning.
The Time Between Warning determines how often the Web Proxy displays the end-user URL filtering warning page for each URL category per user. Once a user clicks the continue link on the end-user URL filtering warning page, the Web Proxy considers that user to have acknowledged the warning for the time you enter for the Time Between Warning. This setting applies to users tracked by username and users tracked by IP address. You can specify any value from 30 to 2678400 seconds (one month). Default is 1 hour (3600 seconds).
• Custom message.
The custom message is text you enter that appears on every end-user URL filtering warning page. You might want to include text for the organization’s acceptable use policies, or include a link to a page that details the acceptable use policies. You can include some simple
HTML tags to format the text. For example, you can change the color and size of the text, or make it italicized. See
Custom Text in Notification Pages, page 17-17
for more information.
18-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Creating Time Based URL Filters
Configure these settings on the Security Services > End-User Notification page. For more information, see
Configuring the End-User URL Filtering Warning Page, page 17-16 .
Note The warn and continue feature only works for HTTP and decrypted HTTPS transactions. It does not work with native FTP transactions.
User Experience When Warning Users
When the URL filtering engine warns users for a particular request, it provides a warning page that the
Web Proxy sends to the end user. However, not all websites display the warning page to the end user. For example, some Web 2.0 websites display dynamic content using javascript instead of a static webpage and are not likely to display the warning page from the Web Proxy. When this happens, users are blocked from the URL that is assigned the Warn option without being given the chance to continue accessing the site anyway.
Creating Time Based URL Filters
You can configure how the Web Security appliance to handles requests for URLs in particular categories differently based on time and day. For example, you can block access to social networking sites, such as blogs and forums, during business hours.
To define URL filtering actions by time you must first define at least one time range. For information about time ranges, see
Working with Time Based Policies, page 8-9 .
To create time based URL filtering actions for an Access Policy:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the URL Categories column for the policy group you want to edit.
The Access Policies: URL Filtering: policyname page appears.
Select Time-Based for the custom or predefined URL category you want to configure based on time range.
Figure 18-6 Defining Time Based URL Filtering Actions
When you select Time-Based for the URL category, additional fields appear under the category name where you can choose the actions.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-23
Chapter 18 URL Filters
Viewing URL Filtering Activity
Step 4
Step 5
Step 6
Step 7
In the In Time Range field, choose the defined time range to use for the URL category.
For information about defining time ranges, see
Creating Time Ranges, page 8-9
.
In the Action field, choose the action to enact on transactions in this URL category during the defined time range.
In the Otherwise field, choose the action to enact on transactions in this URL category outside the defined time range.
Submit and commit your changes.
Viewing URL Filtering Activity
The Reporting > URL Categories page provides a collective display of URL statistics that includes information about top URL categories matched and top URL categories blocked. Additionally, this page displays category-specific data for bandwidth savings and web transactions. For detailed information about monitoring and reporting functionality, see
Understanding Unfiltered and Uncategorized Data
When viewing URL statistics on the Reporting > URL Categories page, it is important to understand how to interpret the following data:
• URL Filtering Bypassed — This data represents policy, port, and admin user agent blocking that occurs before URL filtering.
• Uncategorized URL — This data represents all transactions for which the URL filtering engine is queried, but no category is matched.
Access Log File
The access log file records the URL category for each transaction in the scanning verdict information section of each entry. For more information about the access log, see
. For a list of each URL category, see
URL Category Descriptions, page 18-27
.
Regular Expressions
Regular expressions are pattern matching descriptions that contain normal printable characters and special characters that are used to match patterns in text strings. For example, a text string such as
“welcome” matches “welcome” or “welcomemyfriend.” When a match occurs, the function returns true.
If no match occurs, the function returns false. Actions are executed only when a pattern-matching expression is true.
The Web Security appliance uses POSIX extended regular expression syntax, fully described by IEEE
POSIX 1003.2. However, the appliance does not support using a backward slash to escape a forward slash. If you need to use a forward slash in a regular expression, type the forward slash without a backward slash.
18-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
Regular Expressions
Note Technically, AsyncOS for Web uses the Flex regular expression analyzer. For more detailed information about how it reads regular expressions, see http://flex.sourceforge.net/manual/Patterns.html.
You can use regular expressions in the following locations:
• Custom URL categories for Access Policies.
When you create a custom URL category to use with
Access Policy groups, you can use regular expressions to specify multiple web servers that match the pattern you enter. For more information about creating custom URL categories, see
• Custom user agents to block.
When you edit the applications to block for an Access Policy group, you can use regular expressions to enter specific user agents to block, such as Skype or Microsoft
Internet Explorer. For more information about using regular expressions to block user agents, see
Policy: Protocols and User Agents, page 10-12
.
Note Regular expressions that perform extensive character matching consume resources and can affect system performance. For this reason, regular expressions should be cautiously applied.
Forming Regular Expressions
Regular expressions are rules that typically use the word “matches” in the expression. They can be applied to match specific URL destinations or web servers. For example, the following regular expression matches any pattern containing blocksite.com:
\.blocksite\.com
Consider the following regular expression example: server[0-9]\.example\.com
In this example, server[
0-9
] matches server0
, server1
, server2
, ..., server9
in the domain example.com
.
In the following example, the regular expression matches files ending in
.exe
,
.zip
, and .
bin
in the downloads
directory.
/downloads/.*\.(exe|zip|bin)
Avoid using regular expressions strings that are redundant because they can cause higher CPU usage on the Web Security appliance. A redundant regular expression is one that starts or ends with “.*”.
Note You must enclose regular expressions that contain blank spaces or non-alphanumeric characters in
ASCII quotation marks.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-25
Chapter 18 URL Filters
Regular Expressions
Regular Expression Character Table
Table 18-8 describes characters that are commonly used to form regular expressions:
Table 18-8 Regular Expression Character Descriptions
\
+
|
?
^
$
.
Character Description
Matches a single character.
* Matches zero or more occurrences of the preceding regular expression.
For example:
[0-9]* matches any number of digits
[ ]
“.*” matches any arbitrary string of characters
Matches the beginning of a line as the first character of a regular expression.
Matches the end of a line as the last character of a regular expression.
Matches one or more occurrences of the preceding regular expression.
Matches zero or one occurrence of the preceding regular expression.
Matches the preceding regular expression or the following regular expression. For example: x|y matches either x or y abc|xyz matches either of the strings abc or xyz
Matches the characters or digits that are enclosed within the brackets.
For example:
[a-z] matches any character between a and z
{ }
( )
“...”
[r-u] matches any of the characters r, s, t, or u
[0-3] matches any of the single digits 0, 1, 2, 3
Specifies the number of times to match the previous pattern.
For example:
D{1,3} matches one to three occurrences of the letter D
Group characters in a regular expression.
For example:
(abc)* matches abc or abcabcabc
Literally interprets any characters enclosed within the quotation marks.
Escape character.
Note To match the literal version of any of the special characters, the character must be preceded by a backslash “\”. For example, to exactly match a period “.” the regular expression must use “\.” as in
“\.example\.com”. However, the appliance does not support using a backward slash to escape a forward slash. If you need to use a forward slash in a regular expression, type the forward slash without a backward slash.
18-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
URL Category Descriptions
This section lists the URL categories for Cisco IronPort Web Usage Controls. The tables also include the abbreviated URL category names that may appear in the Web Reputation filtering and anti-malware scanning section of an access log file entry.
Tip
Misclassified URLs, page 18-3 .
URL Category
Adult
Alcohol
Arts
Astrology
Note In the access logs, the URL category abbreviations for Cisco IronPort Web Usage Controls include the prefix “IW_” before each abbreviation so that the “art” category becomes “IW_art.”
Advertisements
lists and describes the URL categories for Cisco IronPort Web Usage Controls at the time of this release. For information about URL category set updates, including the location of any revisions to this list, see
Managing Updates to the Set of URL Categories, page 18-5
.
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls
Abbreviation adlt
Code Description
1006 Directed at adults, but not necessarily pornographic.
May include adult clubs (strip clubs, swingers clubs, escort services, strippers); general information about sex, non-pornographic in nature; genital piercing; adult products or greeting cards; information about sex not in the context of health or disease.
www.adultentertainmentexpo
.com
www.adultnetline.com
adv alc
1027 Banner and pop-up advertisements that often accompany a web page; other advertising websites that provide advertisement content. Advertising services and sales are classified as “Business and
Industry.”
1077 Alcohol as a pleasurable activity; beer and wine making, cocktail recipes; liquor sellers, wineries, vineyards, breweries, alcohol distributors. Alcohol addiction is classified as “Health and Nutrition.”
Bars and restaurants are classified as “Dining and
Drinking.” www.adforce.com
www.doubleclick.com
www.samueladams.com
www.whisky.com
art astr
1002 Galleries and exhibitions; artists and art; photography; literature and books; performing arts and theater; musicals; ballet; museums; design; architecture. Cinema and television are classified as
“Entertainment.” www.moma.org
www.nga.gov
1074 Astrology; horoscope; fortune telling; numerology; psychic advice; tarot.
www.astro.com
www.astrology.com
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-27
Chapter 18 URL Filters
URL Category Descriptions
URL Category
Auctions
Business and
Industry
Chat and Instant
Messaging
Cheating and
Plagiarism
Child Abuse
Content
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
Abbreviation auct busi chat
Code Description
1088 Online and offline auctions, auction houses, and classified advertisements.
www.craigslist.com
1019 Marketing, commerce, corporations, business practices, workforce, human resources, transportation, payroll, security and venture capital; office supplies; industrial equipment (process equipment), machines and mechanical systems; heating equipment, cooling equipment; materials handling equipment; packaging equipment; manufacturing: solids handling, metal fabrication, construction and building; passenger transportation; commerce; industrial design; construction, building materials; shipping and freight (freight services, trucking, freight forwarders, truckload carriers, freight and transportation brokers, expedited services, load and freight matching, track and trace, rail shipping, ocean shipping, road feeder services, moving and storage).
1040 Web-based instant messaging and chat rooms.
www.ebay.com
www.freightcenter.com
www.staples.com
www.icq.com
plag cprn
1051 Promoting cheating and selling written work, such as term papers, for plagiarism.
1064 Worldwide illegal child sexual abuse content.
Without exception, Cisco blocks child abuse content for all customers, and for legal reasons keeps no logs. This category is never displayed. www.meebo.com
www.bestessays.com
www.superiorpapers.com
—
Computer Security csec
Computers and
Internet comp
Dating date
Digital Postcards card
1065 Offering security products and services for corporate and home users.
www.computersecurity.com
1003 Information about computers and software, such as hardware, software, software support; information for software engineers, programming and networking; website design; the web and Internet in general; computer science; computer graphics and clipart. “Freeware and Shareware” is a separate category.
1055 Dating, online personals, matrimonial agencies.
www.symantec.com
www.xml.com
www.w3.org
www.eharmony.com
www.match.com
1082 Enabling sending of digital postcards and e-cards.
www.all-yours.net
www.delivr.net
18-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category
Dining and
Drinking
Dynamic and
Residential
Education
Entertainment
Extreme
Fashion
File Transfer
Services
Filter Avoidance
Finance
Freeware and
Shareware
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
Abbreviation food
Code Description
1061 Eating and drinking establishments; restaurants, bars, taverns, and pubs; restaurant guides and reviews.
dyn edu www.hideawaybrewpub.com
www.restaurantrow.com
1091 IP addresses of broadband links that usually indicates users attempting to access their home network, for example for a remote session to a home computer.
http://109.60.192.55
http://dynalink.co.jp
http://ipadsl.net
1001 Education-related, such as schools, colleges, universities, teaching materials, and teachers’ resources; technical and vocational training; online training; education issues and policies; financial aid; school funding; standards and testing.
www.education.com
www.greatschools.org
ent extr fash
1093 Details or discussion of films; music and bands; television; celebrities and fan websites; entertainment news; celebrity gossip; entertainment venues. Compare with the “Arts” category.
www.eonline.com
www.ew.com
1075 Material of a sexually violent or criminal nature; violence and violent behavior; tasteless, often gory photographs, such as autopsy photos; photos of crime scenes, crime and accident victims; excessive obscene material; shock websites.
www.car-accidents.com
www.crime-scene-photos.co
m
1076 Clothing and fashion; hair salons; cosmetics; accessories; jewelry; perfume; pictures and text relating to body modification; tattoos and piercing; modeling agencies. Dermatological products are classified as “Health and Nutrition.” www.fashion.net
www.findabeautysalon.com
fts filt fnnc free
1071 File transfer services with the primary purpose of providing download services and hosted file sharing www.rapidshare.com
www.yousendit.com
1025 Promoting and aiding undetectable and anonymous web usage, including cgi, php and glype anonymous proxy services.
www.bypassschoolfilter.com
www.filterbypass.com
1015 Primarily financial in nature, such as accounting practices and accountants, taxation, taxes, banking, insurance, investing, the national economy, personal finance involving insurance of all types, credit cards, retirement and estate planning, loans, mortgages.
Stock and shares are classified as “Online Trading.” finance.yahoo.com
www.bankofamerica.com
1068 Providing downloads of free and shareware software.
www.freewarehome.com
www.shareware.com
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-29
Chapter 18 URL Filters
URL Category Descriptions
URL Category
Gambling
Games
Government and
Law
Hacking
Hate Speech
Health and
Nutrition
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
Abbreviation gamb game gov hack hate hlth
Code Description
1049 Casinos and online gambling; bookmakers and odds; gambling advice; competitive racing in a gambling context; sports booking; sports gambling; services for spread betting on stocks and shares. Websites dealing with gambling addiction are classified as
“Health and Nutrition.” Government-run lotteries are classified as “Lotteries”.
www.888.com
www.gambling.com
1007 Various card games, board games, word games, and video games; combat games; sports games; downloadable games; game reviews; cheat sheets; computer games and Internet games, such as role-playing games.
www.games.com
www.shockwave.com
www.usa.gov
www.law.com
1011 Government websites; foreign relations; news and information relating to government and elections; information relating to the field of law, such as attorneys, law firms, law publications, legal reference material, courts, dockets, and legal associations; legislation and court decisions; civil rights issues; immigration; patents and copyrights; information relating to law enforcement and correctional systems; crime reporting, law enforcement, and crime statistics; military, such as the armed forces, military bases, military organizations; anti-terrorism.
1050 Discussing ways to bypass the security of websites, software, and computers.
www.hackthissite.org
www.gohacking.com
www.kkk.com
www.nazi.org
1016 Websites promoting hatred, intolerance, or discrimination on the basis of social group, color, religion, sexual orientation, disability, class, ethnicity, nationality, age, gender, gender identity; sites promoting racism; sexism; racist theology; hate music; neo-Nazi organizations; supremacism;
Holocaust denial.
1009 Health care; diseases and disabilities; medical care; hospitals; doctors; medicinal drugs; mental health; psychiatry; pharmacology; exercise and fitness; physical disabilities; vitamins and supplements; sex in the context of health (disease and health care); tobacco use, alcohol use, drug use, and gambling in the context of health (disease and health care); food in general; food and beverage; cooking and recipes; food and nutrition, health, and dieting; cooking, including recipe and culinary websites; alternative medicine.
www.health.com
www.webmd.com
18-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
URL Category
Humor
Illegal Activities
Illegal Downloads
Illegal Drugs
Infrastructure and
Content Delivery
Networks
Internet Telephony
Abbreviation lol
Code Description
1079 Jokes, sketches, comics and other humorous content.
Adult humor likely to offend is classified as “Adult.” www.humor.com
www.jokes.com
ilac ildl drug infr voip
1022 Promoting crime, such as stealing, fraud, illegally accessing telephone networks; computer viruses; terrorism, bombs, and anarchy; websites depicting murder and suicide as well as explaining ways to commit them.
1084 Providing the ability to download software or other materials, serial numbers, key generators, and tools for bypassing software protection in violation of copyright agreements. Torrents are classified as
“Peer File Transfer.” www.ekran.no
www.thedisease.net
www.keygenguru.com
www.zcrack.com
1047 Information about recreational drugs, drug paraphernalia, drug purchase and manufacture.
www.cocaine.org
1018 Content delivery infrastructure and dynamically generated content; websites that cannot be classified more specifically because they are secured or otherwise difficult to classify.
www.hightimes.com
www.akamai.net
www.webstat.net
1067 Telephonic services using the Internet.
www.evaphone.com
Job Search
Lingerie and
Swimsuits
Lotteries
Mobile Phones job ling lotr cell
1004 Career advice; resume writing and interviewing skills; job placement services; job databanks; permanent and temporary employment agencies; employer websites.
www.skype.com
www.careerbuilder.com
www.monster.com
1031 Intimate apparel and swimwear, especially when modeled.
www.swimsuits.com
www.victoriassecret.com
1034 Sweepstakes, contests and state-sponsored lotteries. www.calottery.com
1070 Short Message Services (SMS); ringtones and mobile phone downloads. Cellular carrier websites are included in the “Business and Industry” category.
www.flalottery.com
www.cbfsms.com
www.zedge.net
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-31
Chapter 18 URL Filters
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
URL Category
Nature
News
Non-Governmental
Organizations
Abbreviation natr news ngo
Code Description
1013 Natural resources; ecology and conservation; forests; wilderness; plants; flowers; forest conservation; forest, wilderness, and forestry practices; forest management (reforestation, forest protection, conservation, harvesting, forest health, thinning, and prescribed burning); agricultural practices (agriculture, gardening, horticulture, landscaping, planting, weed control, irrigation, pruning, and harvesting); pollution issues (air quality, hazardous waste, pollution prevention, recycling, waste management, water quality, and the environmental cleanup industry); animals, pets, livestock, and zoology; biology; botany.
1058 News; headlines; newspapers; television stations; magazines; weather; ski conditions.
www.enature.com
www.nature.org
www.cnn.com
news.bbc.co.uk
www.panda.org
1087 Non-governmental organizations such as clubs, lobbies, communities, non-profit organizations and labor unions.
www.unions.org
Non-Sexual Nudity nsn
Online
Communities
Online Storage and
Backup
Online Trading
Organizational
Parked Domains
Peer File Transfer comm osb trad pem park p2p
1060 Nudism and nudity; naturism; nudist camps; artistic nudes.
www.artenuda.com
www.naturistsociety.com
www.igda.org
1024 Affinity groups; special interest groups; web newsgroups; message boards. Excludes websites classified as “Professional Networking” or “Social
Networking.” www.ieee.org
1066 Offsite and peer-to-peer storage for backup, sharing, and hosting.
www.adrive.com
www.dropbox.com
www.tdameritrade.com
1028 Online brokerages; websites that enable the user to trade stocks online; information relating to the stock market, stocks, bonds, mutual funds, brokers, stock analysis and commentary, stock screens, stock charts, IPOs, stock splits. Services for spread betting on stocks and shares are classified as “Gambling.”
Other financial services are classified as “Finance." www.scottrade.com
— 1085 Websites used to access business email (often via
Outlook Web Access).
1092 Websites that monetize traffic from the domain using paid listings from an ad network, or are owned by “squatters” hoping to sell the domain name for a profit. These also include fake search websites which return paid ad links.
1056 Peer-to-peer file request websites. This does not track the file transfers themselves.
www.domainzaar.com
www.parked.com
www.bittorrent.com
www.limewire.com
18-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
URL Category
Personal Sites
Abbreviation pers
Code Description
1081 Websites about and from private individuals; personal homepage servers; websites with personal contents; personal blogs with no particular theme.
Photo Searches and
Images img www.karymullis.com
www.stallman.org
Politics
Pornography
Professional
Networking pol porn pnet
1090 Facilitating the storing and searching for, images, photographs, and clip-art.
1083 Websites of politicians; political parties; news and information on politics, elections, democracy, and voting.
1089 Social networking for the purpose of career or professional development. See also “Social
Networking.” www.flickr.com
www.photobucket.com
www.politics.com
www.thisnation.com
1054 Sexually explicit text or depictions. Includes explicit anime and cartoons; general explicit depictions; other fetish material; explicit chat rooms; sex simulators; strip poker; adult movies; lewd art; web-based explicit email.
www.redtube.com
www.youporn.com
www.linkedin.com
www.europeanpwn.net
Real Estate rest
Reference
Religion
SaaS and B2B
Safe for Kids
Science and
Technology
Search Engines and
Portals
Sex Education
Shopping ref rel saas kids sci srch sxed shop
1045 Information that would support the search for real estate; office and commercial space; real estate listings, such as rentals, apartments, and homes; house building.
www.realtor.com
www.zillow.com
1017 City and state guides; maps, time; reference sources; dictionaries; libraries.
www.wikipedia.org
www.yellowpages.com
1086 Religious content, information about religions; religious communities.
www.religionfacts.com
www.religioustolerance.org
1080 Web portals for online business services; online meetings.
1057 Directed at, and specifically approved for, young children.
www.netsuite.com
www.salesforce.com
kids.discovery.com
www.nickjr.com
www.physorg.com
1012 Science and technology, such as aerospace, electronics, engineering, mathematics, and other similar subjects; space exploration; meteorology; geography; environment; energy (fossil, nuclear, renewable); communications (telephones, telecommunications).
1020 Search engines and other initial points of access to information on the Internet.
www.science.gov
www.bing.com
1052 Factual websites dealing with sex; sexual health; contraception; pregnancy.
www.google.com
www.avert.org
1005 Bartering; online purchasing; coupons and free offers; general office supplies; online catalogs; online malls.
www.scarleteen.com
www.amazon.com
www.shopping.com
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-33
Chapter 18 URL Filters
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
URL Category
Abbreviation
Social Networking snet
Social Science
Society and
Culture
Software Updates
Sports and
Recreation
Streaming Audio
Streaming Video
Tobacco
Transportation
Travel
Unclassified socs scty swup sprt aud vid tob trns trvl
—
Code Description
1069 Social networking. See also “Professional
Networking.” www.facebook.com
1014 Sciences and history related to society; archaeology; anthropology; cultural studies; history; linguistics; geography; philosophy; psychology; women's studies.
1010 Family and relationships; ethnicity; social organizations; genealogy; seniors; child-care.
www.twitter.com
www.archaeology.org
www.anthropology.net
www.childcare.gov
www.familysearch.org
1053 Websites that host updates for software packages.
www.softwarepatch.com
1008
1073 Real-time streaming audio content including
Internet radio and audio feeds.
1072
All sports, professional and amateur; recreational activities; fishing; fantasy sports; public parks; amusement parks; water parks; theme parks; zoos and aquariums; spas.
Real-time streaming video including Internet television, web casts, and video sharing.
www.versiontracker.com
www.espn.com
www.recreation.gov
www.live-radio.net
www.shoutcast.com
www.hulu.com
www.youtube.com
1078 Pro-tobacco websites; tobacco manufacturers; pipes and smoking products (not marketed for illegal drug use). Tobacco addiction is classified as “Health and
Nutrition.” www.bat.com
www.tobacco.org
1044 Personal transportation; information about cars and motorcycles; shopping for new and used cars and motorcycles; car clubs; boats, airplanes, recreational vehicles (RVs), and other similar items. Note, car and motorcycle racing is classified as “Sports and
Recreation.”
1046 Business and personal travel; travel information; travel resources; travel agents; vacation packages; cruises; lodging and accommodation; travel transportation; flight booking; airfares; car rental; vacation homes.
— Websites which are not in the Cisco database are recorded as unclassified for reporting purposes. This may include mistyped URLs. www.cars.com
www.motorcycles.com
www.expedia.com
www.lonelyplanet.com
—
18-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Table 18-9 URL Category Descriptions for Cisco IronPort Web Usage Controls (continued)
URL Category
Weapons
Web Hosting
Web Page
Translation
Web-Based Email
Abbreviation weap
Code Description
1036 Information relating to the purchase or use of conventional weapons such as gun sellers, gun auctions, gun classified ads, gun accessories, gun shows, and gun training; general information about guns; other weapons and graphic hunting sites may be included. Government military websites are classified as “Government and Law.” whst 1037 Website hosting; bandwidth services.
www.coldsteel.com
www.gunbroker.com
www.bluehost.com
tran mail
1063 Translation of web pages between languages.
www.godaddy.com
babelfish.yahoo.com
translate.google.com
1038 Public web-based email services. Websites enabling individuals to access their company or organization’s email service are classified as
“Organizational Email.” mail.yahoo.com
www.hotmail.com
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-35
URL Category Descriptions
Chapter 18 URL Filters
18-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-37
URL Category Descriptions
Chapter 18 URL Filters
18-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-39
URL Category Descriptions
Chapter 18 URL Filters
18-40
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-41
URL Category Descriptions
Chapter 18 URL Filters
18-42
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-43
URL Category Descriptions
Chapter 18 URL Filters
18-44
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-45
URL Category Descriptions
Chapter 18 URL Filters
18-46
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-47
URL Category Descriptions
Chapter 18 URL Filters
18-48
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-49
URL Category Descriptions
Chapter 18 URL Filters
18-50
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-51
URL Category Descriptions
Chapter 18 URL Filters
18-52
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 18 URL Filters
URL Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
18-53
URL Category Descriptions
Chapter 18 URL Filters
18-54
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
19
Understanding Application Visibility and Control
This chapter contains the following information:
•
Controlling Applications Overview, page 19-1
•
•
•
•
Understanding Application Control Settings, page 19-3
Controlling Bandwidth, page 19-8
Controlling Instant Messaging Traffic, page 19-12
Viewing AVC Activity, page 19-13
Controlling Applications Overview
The Web has become the ubiquitous platform for application delivery in the enterprise, whether that is browser based application platforms like Salesforce.com and Google Apps, or rich media applications like Cisco WebEx using web protocols as a widely available transport in and out of enterprise networks.
Cisco IronPort Web Usage Controls includes the Application Visibility and Control engine (AVC engine) which enables administrators to apply deeper controls to particular application types. The AVC engine is an acceptable use policy component that inspects web traffic to gain deeper understanding and control of web traffic used for applications. Application control gives you more granular control over web traffic than just URL filtering, for example.
The AVC engine allows you to create policies to control application activity on the network without having to fully understand the underlying technology of each application.
Application control gives you visibility and control over the following types of applications:
• Evasive applications, such as anonymizers and encrypted tunnels.
•
•
Collaboration applications, such as Cisco Webex and instant messaging.
Resource intensive applications, such as streaming media.
To control applications using the AVC engine, perform the following steps:
1.
Enable the AVC engine. For more information, see
Enabling the AVC Engine, page 19-2
.
2.
Define application control settings in the Access Policies. For more information, see
Application Control Settings, page 19-3
.
Using the AVC engine, you can block or allow applications by application type or a particular application. You can also apply deeper controls to particular application types. For example, you can perform the following tasks:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-1
Chapter 19 Understanding Application Visibility and Control
Enabling the AVC Engine
•
•
•
Limit bandwidth consumed by some application types to control congestion.
For more information, see
Controlling Bandwidth, page 19-8 .
Allow instant messaging traffic, but disallow file sharing using instant messenger.
For more information, see
Controlling Instant Messaging Traffic, page 19-12 .
Enforce safe search on search engines and user generated content sites.
For more information, see
Filtering Adult Content, page 18-18
.
• Restrict access to adult content on some content sharing sites.
For more information, see
Filtering Adult Content, page 18-18
.
The AVC engine can dynamically receive updates from the Cisco IronPort update server, including
You can also view the AVC engine scanning activity in the Application Visibility report on the Reporting
> Application Visibility page. For more information, see
Viewing AVC Activity, page 19-13
.
User Experience with Blocked Requests
When the AVC engine blocks a transaction, the Web Proxy sends a block page to the end user. However, not all websites display the block page to the end user. For example, some Web 2.0 websites display dynamic content using javascript instead of a static webpage and are not likely to display the block page.
Users are still properly blocked from downloading malicious data, but they may not always be informed of this by the website.
AVC Engine Updates
AsyncOS periodically queries the update servers for new updates to all security service components, including the AVC engine. AVC engine updates can include support for new application types and applications as well as updated support for existing applications if any application behavior changes. By updating the AVC engine in between AsyncOS versions, the Web Security appliance remains flexible without requiring a server upgrade.
AVC engine updates are maintained by the Cisco Security Intelligence Operations (SIO) center. Cisco
SIO updates signatures as necessary to adapt to the changing marketplace.
Because the AVC engine can receive support for new applications and application types, AsyncOS for
Web assigns the following default actions for the Global Access Policy:
• New application types default to Monitor.
•
•
New application behaviors, such as block file transfer within a particular application, default to
Monitor.
New applications for an existing application type default to the application type default.
Enabling the AVC Engine
Enable the AVC engine when you enable Cisco IronPort Web Usage Controls.
To enable the AVC engine:
Step 1 Navigate to the Security Services > Acceptable Use Controls page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-2
Chapter 19 Understanding Application Visibility and Control
Step 2 Click Edit Global Settings .
The Edit Acceptable Use Controls Settings page appears.
Understanding Application Control Settings
Step 3
Step 4
Step 5
Verify the Enable Acceptable Use Controls property is enabled.
In the Acceptable Use Controls Service area, select Cisco IronPort Web Usage Controls, and then select
Enable Application Visibility and Control.
Submit and commit your changes.
Understanding Application Control Settings
Controlling applications involves configuring the following elements:
•
•
•
Application types.
A category that contains one or more applications. For example, Instant
Messaging is an application type that contains Google Talk and AOL Instant Messenger.
Applications.
Particular applications that belong in an application type. For example, YouTube is an application in the Media application type.
Application behaviors.
Particular actions or behaviors that users can do within an application that administrators can control. For example, users can transfer files while using an application, such as
Yahoo Messenger. Not all applications include application behaviors you can configure.
You can configure application control settings in Access Policy groups. From the Web Security Manager
> Access Policies page, click the Applications link for the policy group you want to configure. The
Access Policies: Applications Visibility and Control: policyname page appears, or the “Applications
Visibility and Control page” for short.
The Applications Visibility and Control page shows the current applications you can configure as determined by the current AVC engine signature. Regardless of the particular applications you can configure, the Applications Visibility and Control page offers the following views for configuring applications:
•
•
Browse view.
You can browse for application types. You might want to use Browse view to configure applications of a particular type at the same time. For more information, see
Search view.
You can search for applications. You might want to use Search view when the total list of applications is long and you need to quickly find and configure a particular application. For more information, see
Working with Search View, page 19-5 .
You can configure most of the same control settings in both views. However, you can only configure the bandwidth control limits for application types in Browse view.
When configuration applications, you can choose the following actions:
• Block.
This action is a final action. Users are prevented from viewing a webpage and instead an end-user notification page displays.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-3
Chapter 19 Understanding Application Visibility and Control
Understanding Application Control Settings
•
•
Monitor.
This action is an intermediary action. The Web Proxy continues comparing the transaction to the other control settings to determine which final action to apply. For more information, see
Understanding the Monitor Action, page 10-2
.
Restrict.
This action indicates that an application behavior is blocked. For example, when you block file transfers for a particular instant messaging application, the action for that application is Restrict.
Working with Browse View
shows the Applications Visibility and Control page in Browse view for a user defined Access
Policy.
Figure 19-1 Configuring Applications for a User Defined Access Policy—Browse View
Click to expand application type and configure each application.
Click to define the same action for all applications in the type.
Applications
Application Type
Click to configure this application.
Click to define the bandwidth limit for the entire application type.
Configure the settings for this application.
Application Behavior
shows the Applications Visibility and Control page in Browse view for the Global Access
Policy.
19-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Figure 19-2
Understanding Application Control Settings
Configuring Applications for the Global Access Policy—Browse View
Define global settings for each application and application behavior.
Click to define the default action for the application type.
Configure the bandwidth limit for the type.
Configure the default action for the type.
Working with Search View
Policy.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-5
Chapter 19 Understanding Application Visibility and Control
Understanding Application Control Settings
Figure 19-3 Configuring Applications for a User Defined Access Policy—Search View
Configure search criteria.
Click to column headers to sort columns.
Click to configure this application.
Configure the settings for this application.
Rules and Guidelines
Consider the following rules and guidelines when configuring application control settings:
• The supported application types, applications, and application behaviors may change between
AsyncOS for Web upgrades during AVC engine updates.
•
•
When an application type is collapsed in Browse view, the summary for the application type lists the final actions for the applications and does not indicate whether the actions are inherited from the global policy or configured in the current Access Policy. To learn more about the action for an application, expand the application type.
In the Global Access Policy, you can set the default action for each application type. You might want to set the default action for each application type so new applications introduced in an Application
Visibility and Control engine update automatically inherit the default action.
19-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Understanding Application Control Settings
•
•
•
You can quickly configure the same action for all applications in an application type by clicking the
“edit all” link for the application type in Browse view. However, you can only configure the application action, not application behavior actions. To configure application behaviors, you must edit the application individually instead of editing all applications for a type at once.
In Search view, when you sort the table by the action column, the sort order is by the final action.
For example, “Use Global (Block)” comes after “Block” in the sort order.
Decryption may cause some applications to fail unless the root certificate for signing is installed on the client. For more information, see
Using Decryption with the AVC Engine, page 12-13 . For more
information on the appliance root certificate, see
Working with Root Certificates, page 12-11 .
Configuring Application Control Settings
To configure Application settings in an Access Policy group:
Step 1
Step 2
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the Applications column for the policy group you want to edit.
The Applications Visibility and Control page appears.
Figure 19-4 Applications Visibility and Control Page—User Defined Access Policy
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
When configuring the Global Access Policy, define the default action for each application type in the
Default Actions for Application Types section. For details on how to do this, see
.
When configuring a user defined Access Policy, choose Define Applications Custom Settings in the Edit
Applications Settings section.
In the Application Settings area, choose Browse view or Search view from the drop down menu.
Configure the action for each application and application behavior.
For more information on work with each view, see
Working with Browse View, page 19-4
and
Working with Search View, page 19-5
.
Configure the bandwidth controls for each applicable application. For more information, see
Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-7
Chapter 19 Understanding Application Visibility and Control
Controlling Bandwidth
Controlling Bandwidth
The AVC engine allows administrators to control the amount of bandwidth used for particular application types. Not all application types support bandwidth controls.
You can define the following bandwidth limits:
•
•
Overall bandwidth limit.
Define an overall limit for all users on the network for the supported application types. The overall bandwidth limit affects the traffic between the Web Security appliance and web servers. It does not limit traffic served from the web cache. You might want to define an overall bandwidth limit to restrict the amount of network traffic used for high traffic sites, such as streaming media sites. For more information, see
Configuring Overall Bandwidth Limits, page 19-8
.
User bandwidth limit.
Define a limit for particular users on the network per application type. User bandwidth limits traffic from web servers as well as traffic served from the web cache. You might want to define user bandwidth limits to restrict the amount of traffic consumed by heavy usage users to enforce acceptable use policies. For more information, see
Configuring User Bandwidth Limits, page 19-9 .
When both the overall limit and user limit applies to a transaction, the most restrictive option applies.
You can define bandwidth limits for particular URL categories by defining an Identity group for a URL category and using it in an Access Policy that restricts the bandwidth.
Note Defining bandwidth limits only throttles the data going to users. It does not block data based on reaching a quota.
Configuring Overall Bandwidth Limits
The overall bandwidth limit affects the traffic between the Web Security appliance and web servers for all users on the network.
To define an overall bandwidth limit:
Step 1 Navigate to the Web Security Manager > Overall Bandwidth Limits page.
Figure 19-5 Configuring the Overall Bandwidth Limit
Step 2
Step 3
Step 4
Select the Limit to option.
Enter the amount of traffic to limit in either Megabits per second (Mbps) or kilobits per second (kbps).
Submit and commit your changes.
19-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Controlling Bandwidth
Configuring User Bandwidth Limits
You define user bandwidth limits by configuring bandwidth control settings on the Applications
Visibility and Control page of Access Policies. You can define the following types of bandwidth controls for users in Access Policies:
• Default bandwidth limit for an application type.
In the Global Access Policy, you can define the default bandwidth limit for all applications of an application type. For more information, see
Configuring the Default Bandwidth Limit for an Application Type, page 19-9
.
•
•
Bandwidth limit for an application type.
In a user defined Access Policy, you can override the default bandwidth limit for the application type defined in the Global Access Policy. You can configure no bandwidth limit or a different bandwidth limit value. For more information, see
Overriding the Default Bandwidth Limit for an Application Type, page 19-9 .
Bandwidth limit for an application.
In a user defined or Global Access Policy, you can choose to apply the application type bandwidth limit or no limit (exempt the application type limit). You might choose no bandwidth limit for an application to exempt the application from the bandwidth limit established that application type. For more information, see
Configuring Bandwidth Controls for an
.
Configuring the Default Bandwidth Limit for an Application Type
To configure the default bandwidth limit for an application type:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the Applications column for the Global Access Policy.
The Applications Visibility and Control page appears.
In the Default Actions for Application Types section, click the link next to “Bandwidth Limit” for the application type you want to edit.
The Applications Visibility and Control page expands, allowing you to specify the bandwidth control settings.
Select Set Bandwidth Limit and enter the amount of traffic to limit in either Megabits per second (Mbps) or kilobits per second (kbps). See
for details on how to do this.
Click Done.
Submit and commit your changes.
Overriding the Default Bandwidth Limit for an Application Type
You can override the default bandwidth limit defined at the Global Access Policy group in the user defined Access Policies. You can only do this in Browse view.
To override the default bandwidth limit for an application type:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the Applications column for the user defined policy group you want to edit.
The Applications Visibility and Control page appears.
Choose Define Applications Custom Settings in the Edit Applications Settings section.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-9
Chapter 19 Understanding Application Visibility and Control
Controlling Bandwidth
Note Ensure you remain in Browse view. Do not switch to Search view.
Figure 19-6 Overriding the Default Bandwidth Limit for an Application Type
Step 4
Click to override default bandwidth limit.
Click the link next to “Bandwidth Limit” for the application type you want to edit.
The Applications Visibility and Control page expands, allowing you to specify the bandwidth control settings.
Step 5
Step 6
Step 7
To choose a different bandwidth limit value, select Set Bandwidth Limit and enter the amount of traffic to limit in either Megabits per second (Mbps) or kilobits per second (kbps). To specify no bandwidth limit, select No Bandwidth Limit for Application Type.
Click Done.
Submit and commit your changes.
Configuring Bandwidth Controls for an Application
To configure bandwidth controls for an application:
Step 1
Step 2
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the Applications column for the policy group you want to edit.
The Applications Visibility and Control page appears.
19-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Step 3 Expand the application type that contains the application you want to define.
Controlling Bandwidth
Click to expand the application type.
The Applications Visibility and Control page expands to allow you to configure each application in the application type.
Step 4 Click the link for the application you want to configure.
The Applications Visibility and Control page expands, allowing you to specify the bandwidth control settings for the application.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-11
Chapter 19 Understanding Application Visibility and Control
Controlling Instant Messaging Traffic
Step 5 Select Monitor, and then choose to use either the bandwidth limit defined for the application type or no limit.
Note The bandwidth limit setting is not applicable when the application is blocked or when no bandwidth limit is defined for the application type.
Step 6
Step 7
Click Done.
Submit and commit your changes.
Controlling Instant Messaging Traffic
You can use the AVC engine to apply control settings to some instant messenger (IM) traffic that runs on top of HTTP. You can block or monitor the IM traffic, and depending on the IM service, you can block particular activities (also known as application behaviors) in an IM session. For example, you can allow an IM session with a particular IM service provider, but block file transfers within that session.
The AVC engine does not control native IM traffic.
You control IM traffic by configuring Instant Messenger application settings on the Applications
Visibility and Control page of Access Policies.
To control IM traffic:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Access Policies page.
Click the link in the policies table under the Applications column for the policy group you want to edit.
The Applications Visibility and Control page appears.
Expand the Instant Messaging application type.
Step 4
Click to expand the Instant Messaging application type.
Click the link next to the IM application you want to configure.
19-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Viewing AVC Activity
The Applications Visibility and Control page expands, allowing you to specify control settings for the application.
Step 5
Step 6
Step 7
Step 8
To block all traffic for this IM application, select Block.
To monitor the IM application, but block particular activities within the application, select Monitor, and then select the application behavior to block.
Click Done.
Submit and commit your changes.
Viewing AVC Activity
The Reporting > Application Visibility page displays information about the top applications and application types used. It also displays the top applications and application types blocked. You can click the individual applications and application types to view more detailed information about each. For detailed information about monitoring and reporting functionality, see
Access Log File
The access log file records the information returned by the Application Visibility and Control engine for each transaction. The scanning verdict information section in the access logs includes the fields listed in
.
Table 19-1 Application Visibility Control Logging Information
Description
Application name
Application type
Application behavior
Custom Field in Access Logs
%XO
%Xu
%Xb
Custom Field in W3C Logs x-avc-app x-avc-type x-avc-behavior
For more information about the access log, see
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-13
Viewing AVC Activity
Chapter 19 Understanding Application Visibility and Control
19-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 19 Understanding Application Visibility and Control
Viewing AVC Activity
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
19-15
Viewing AVC Activity
Chapter 19 Understanding Application Visibility and Control
19-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
20
Configuring Security Services
This chapter contains the following information:
•
Configuring Security Services Overview, page 20-1
•
•
•
•
•
•
•
•
Web Reputation Filters Overview, page 20-2
Anti-Malware Scanning Overview, page 20-4
Understanding Adaptive Scanning, page 20-8
Enabling Web Reputation and Anti-Malware Filters, page 20-9
Configuring Web Reputation and Anti-Malware in Policies, page 20-10
Maintaining the Database Tables, page 20-17
Malware Category Descriptions, page 20-19
Configuring Security Services Overview
The Web Security appliance uses multiple security components to protect end users from a broad range of web-based malware threats:
•
•
Anti-malware scanning.
The Cisco IronPort DVS™ engine works with multiple anti-malware scanning engines integrated on the appliance to block malware threats. For more information, see
Anti-Malware Scanning Overview, page 20-4 .
Web Reputation Filters.
This is a security feature that analyzes web server behavior and assigns a reputation score to a URL to determine the likelihood that it contains URL-based malware. For more information, see
Web Reputation Filters Overview, page 20-2 .
To protect end users from malware, you enable these features on the appliance, and then configure anti-malware and web reputation settings per policy. For more information, see
Reputation and Anti-Malware Filters, page 20-9 and
Configuring Web Reputation and Anti-Malware in
You can configure anti-malware and web reputation settings for each policy group, but when you configure Access Policies, you can also have AsyncOS for Web choose the best combination of anti-malware scanning and web reputation scoring to use when determining what content to block. For more information, see
Understanding Adaptive Scanning, page 20-8 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-1
Chapter 20 Configuring Security Services
Web Reputation Filters Overview
Web Reputation Filters Overview
Web Reputation Filters is a security feature that analyzes web server behavior and assigns a web-based reputation score (WBRS) to a URL to determine the likelihood that it contains URL-based malware. It helps protect against URL-based malware that threatens end-user privacy and sensitive corporate information. The Web Security appliance uses web reputation scores to identify suspicious activity and stop malware attacks before they occur.
Web Reputation Filters are designed to combat the increasingly prevalent and dynamic nature of malware, especially to protect users from legitimate web sites that have been compromised by malware writers.
You can use Web Reputation Filters with Access, Decryption, and Cisco IronPort Data Security Policies.
Web Reputation Scores
Web Reputation Filters use statistically significant data to assess the reliability of Internet domains and score the reputation of URLs. Data such as how long a specific domain has been registered, or where a web site is hosted, or whether a web server is using a dynamic IP address is used to judge the trustworthiness of a given URL.
The web reputation calculation associates a URL with network parameters to determine the probability that malware exists. The aggregate probability that malware exists is then mapped to a Web Reputation
Score between -10 and +10, with +10 being the least likely to contain malware.
Example parameters include the following:
•
•
•
•
•
URL categorization data
Presence of downloadable code
Presence of long, obfuscated End-User License Agreements (EULAs)
Global volume and changes in volume
•
•
•
•
Network owner information
History of a URL
Age of a URL
Presence on any block lists
•
•
•
Presence on any allow lists
URL typos of popular domains
Domain registrar information
IP address information
Note Cisco does not collect personally identifiable information such as user names, passwords, or client IP addresses.
Understanding How Web Reputation Filtering Works
Web Reputation Scores are associated with an action to take on a URL request. The available actions depend on the policy group type that is assigned to the URL request:
20-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Web Reputation Filters Overview
•
•
•
Access Policies.
You can choose to block, scan, or allow.
Decryption Policies.
You can choose to drop, decrypt, or pass through.
Cisco IronPort Data Security Policies.
You can choose to block or monitor.
You can configure each policy group to correlate an action to a particular Web Reputation Score.
Web Reputation in Access Policies
When you configure web reputation settings in Access Policies, you can choose to configure the settings manually, or let AsyncOS for Web choose the best options using Adaptive Scanning.
When Adaptive Scanning is enabled, you can enable or disable web reputation filtering in each Access
Policy, but you cannot edit the Web Reputation Scores. For more information on Adaptive Scanning, see
Understanding Adaptive Scanning, page 20-8 .
describes the default Web Reputation Scores for Access Policies that you can edit when
Adaptive Scanning is disabled.
Table 20-1 Default Web Reputation Scores for Access Policies
Score Action
-10 to -6.0
Block
-5.9 to 5.9
Scan
6.0 to 10.0
Allow
Description
Bad site. The request is blocked, and no further malware scanning occurs.
•
•
Example
URL downloads information without user permission.
•
•
Sudden spike in URL volume.
URL is a typo of a popular domain.
Undetermined site. Request is passed to the DVS engine for further malware scanning. The
DVS engine scans the request and server response content.
•
Recently created URL that has a dynamic IP address and contains downloadable content.
Network owner IP address that has a positive Web Reputation Score.
Good site. Request is allowed.
No malware scanning required.
• URL contains no downloadable content.
•
•
•
Reputable, high-volume domain with long history.
Domain present on several allow lists.
No links to URLs with poor reputations.
For example, by default, URLs in an HTTP request that are assigned a Web Reputation Score of +7 are allowed and require no further scanning. However, a weaker score for an HTTP request, such as +3, is automatically forwarded to the Cisco IronPort DVS engine where it is scanned for malware. Any URL in an HTTP request that has a very poor reputation is blocked.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-3
Chapter 20 Configuring Security Services
Anti-Malware Scanning Overview
Web Reputation in Decryption Policies
Table 20-2 describes the default Web Reputation Scores for Decryption Policies.
Table 20-2 Default Web Reputation Scores for Decryption Policies
Score
-10 to -9.0
-8.9 to 5.9
6.0 to 10.0
Action Description
Drop Bad site. The request is dropped with no notice sent to the end user.
Use this setting with caution.
Decrypt Undetermined site. Request is allowed, but the connection is decrypted and Access Policies are applied to the decrypted traffic.
For more information about how the appliance decrypts HTTPS traffic, see
Decrypting HTTPS Traffic, page 12-9
.
Pass through Good site. Request is passed through with no inspection or decryption.
Web Reputation in Cisco IronPort Data Security Policies
Table 20-3 describes the default Web Reputation Scores for Cisco IronPort Data Security.
Table 20-3 Default Web Reputation Scores for Cisco IronPort Data Security Policies
Score
-10 to -6.0
-5.9 to 0.0
Action
Block
Monitor
Description
Bad site. The transaction is blocked, and no further scanning occurs.
The transaction will not be blocked based on Web Reputation, and will proceed to content checks (file type and size).
Note Sites with no score are monitored.
Anti-Malware Scanning Overview
The Web Security appliance anti-malware feature is a security component that uses the Cisco IronPort
DVS™ engine in combination with multiple anti-malware scanning engines integrated on the appliance to identify and stop web-based malware threats, including zero-day threats. The DVS engine works with the Webroot™, McAfee, and Sophos anti-malware scanning engines.
For more information about the DVS engine, see
Cisco IronPort DVS™ (Dynamic Vectoring and
Streaming) Engine, page 20-4 .
To use the anti-malware component of the appliance, you must first enable anti-malware scanning and configure global settings, and then apply specific settings to different policies. For more information,
see Enabling Web Reputation and Anti-Malware Filters, page 20-9
and
Configuring Web Reputation and
Anti-Malware in Policies, page 20-10
.
Cisco IronPort DVS™ (Dynamic Vectoring and Streaming) Engine
The Cisco IronPort Dynamic Vectoring and Streaming (DVS) engine inspects web traffic to provide protection against the widest variety of web-based malware ranging from commercially invasive adware applications, to malicious trojans, system monitors, and phishing attacks.
20-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Anti-Malware Scanning Overview
The Cisco IronPort DVS engine can use one or more scanning engines to determine malware risk.
Depending on the features purchased with the appliance, you can enable any of the following scanning engines:
•
•
Webroot.
Webroot’s automated spyware detection system rapidly identifies existing and new spyware threats on the Internet by intelligently scanning millions of sites on a daily basis. Webroot uses a signature database to help detect threats on the Internet. For more information, see
McAfee.
The McAfee scanning engine can detect existing and new malware threats by using a signature database of malware information and heuristic analysis. For more information, see
• Sophos.
The Sophos scanning engine detects existing and new malware threats using a signature database. For more information, see
The scanning engines inspect transactions to determine a malware scanning verdict to pass to the DVS engine. A malware scanning verdict is a value assigned to a URL request or server response that determines the probability that it contains malware. The DVS engine determines whether to monitor or block the request based on the malware scanning verdicts. For more information about malware scanning verdicts, see
Malware Scanning Verdict Values, page 25-37 .
Although you can enable all scanning engines globally, you can enable either the Sophos or McAfee scanning engine (but not both simultaneously) to each Access or Outbound Malware Scanning Policy.
Similarly, you can also enable the Webroot scanning engine with either Sophos or McAfee to each
Access or Outbound Malware Scanning Policy. You might want to enable the Sophos scanning engine instead of the McAfee scanning engine if the client machines have McAfee anti-malware software installed.
In some cases, the DVS engine might determine multiple verdicts for a single URL. For more information about how the DVS handles multiple verdicts, see
Working with Multiple Malware Verdicts, page 20-5
.
Understanding How the DVS Engine Works
The DVS engine performs anti-malware scanning on URL transactions that are forwarded from the Web
Reputation Filters. Web Reputation Filters calculate the probability that a particular URL contains malware, and assign a URL score that is associated with an action to block, scan, or allow the transaction.
When the assigned web reputation score indicates to scan the transaction, the DVS engine receives the
URL request and server response content. The DVS engine, in combination with the Webroot and/or
Sophos or McAfee scanning engines, returns a malware scanning verdict. The DVS engine uses information from the malware scanning verdicts and Access Policy settings to determine whether to block or deliver the content to the client.
When you enable both Webroot and Sophos or McAfee, the DVS engine determines how to scan the content to optimize performance and efficacy.
Working with Multiple Malware Verdicts
In some cases, the DVS engine might determine multiple malware verdicts for a single URL. Multiple verdicts can come from one or both enabled scanning engines:
• Different verdicts from different scanning engines.
When you enable both Webroot and either
Sophos or McAfee, each scanning engine might return different malware verdicts for the same object.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-5
Chapter 20 Configuring Security Services
Anti-Malware Scanning Overview
• Different verdicts from the same scanning engine.
A scanning engine might return multiple verdicts for a single object when the object contains multiple infections. For example, a zip file might contain multiple files, each infected with a different kind of malware.
When a URL causes multiple verdicts, the appliance takes different action depending on whether one or both enabled scanning engines return the multiple malware verdicts.
Different Scanning Engines
When a URL causes multiple verdicts from both enabled scanning engines, the appliance performs the most restrictive action. For example, if one scanning engine returns a block verdict and the other a monitor verdict, the DVS engine always blocks the request. Only the most restrictive verdict is logged and reported.
Same Scanning Engine
When a URL causes multiple verdicts from the same scanning engine, the appliance takes action according to the verdict with the highest priority. Only the highest verdict is logged and reported. The following text lists the possible malware scanning verdicts from the highest to the lowest priority.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Virus
Trojan Downloader
Trojan Horse
Trojan Phisher
Hijacker
System monitor
Commercial System Monitor
Dialer
Worm
Browser Helper Object
Phishing URL
Adware
Encrypted file
Unscannable
• Other Malware
Suppose the McAfee scanning engine detects both adware and a virus in the scanned object, and that the appliance is configured to block adware and monitor viruses. According to the list above, viruses belong in a higher priority verdict category than adware. Therefore, the appliance monitors the object and reports the verdict as virus in the reports and logs. It does not block the object even though it is configured to block adware.
Webroot Scanning
The Webroot scanning engine inspects objects to determine the malware scanning verdict to send to the
DVS engine. The Webroot scanning engine inspects the following objects:
20-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Anti-Malware Scanning Overview
• URL request.
Webroot evaluates a URL request to determine if the URL is a malware suspect. If
Webroot suspects the response from this URL might contain malware, the appliance monitors or blocks the request, depending on how the appliance is configured. If Webroot evaluation clears the request, the appliance retrieves the URL and scans the server response.
• Server response.
When the appliance retrieves a URL, Webroot scans the server response content and compares it to the Webroot signature database.
For more information about how the DVS engine uses malware scanning verdicts to handle web traffic, see
Cisco IronPort DVS™ (Dynamic Vectoring and Streaming) Engine, page 20-4 .
McAfee Scanning
The McAfee scanning engine inspects objects downloaded from a web server in HTTP responses. After inspecting the object, it passes a malware scanning verdict to the DVS engine so the DVS engine can determine whether to monitor or block the request.
The McAfee scanning engine uses the following methods to determine the malware scanning verdict:
•
•
Matching virus signature patterns
Heuristic analysis
For more information about how the DVS engine uses malware scanning verdicts to handle web traffic, see
Cisco IronPort DVS™ (Dynamic Vectoring and Streaming) Engine, page 20-4 .
Matching Virus Signature Patterns
McAfee uses virus definitions in its database with the scanning engine to detect particular viruses, types of viruses, or other potentially unwanted software. It searches for virus signatures in files.
When you enable McAfee, the McAfee scanning engine always uses this method to scan server response content.
Heuristic Analysis
New threats on the web appear almost daily. Using only virus signatures, the engine cannot detect a new virus or other malware because its signature is not yet known. However, by using heuristic analysis, the
McAfee scanning engine can detect new classes of currently unknown viruses and malware in advance.
Heuristic analysis is a technique that uses general rules, rather than specific rules, to detect new viruses and malware. When the McAfee scanning engine uses heuristic analysis, it looks at the code of an object, applies generic rules, and determines how likely the object is to be virus-like.
Using heuristic analysis increases the likelihood of catching viruses and malware before McAfee updates its virus signature database. However, it also increases the possibility of reporting false positives
(clean content designated as a virus). It also might impact appliance performance.
When you enable McAfee, you can choose whether or not to also enable heuristic analysis when scanning objects.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-7
Chapter 20 Configuring Security Services
Understanding Adaptive Scanning
McAfee Categories
Table 20-4 lists the McAfee verdicts and how they correspond to malware scanning verdict categories.
Table 20-4 Appliance Categories for McAfee Verdicts
McAfee Verdict
Known Virus
Trojan
Joke File
Test File
Wannabe
Killed
Commercial Application
Potentially Unwanted Object
Potentially Unwanted Software Package
Encrypted File
Malware Scanning Verdict Category
Virus
Trojan Horse
Adware
Virus
Virus
Virus
Commercial System Monitor
Adware
Adware
Encrypted File
For a list of malware scanning verdicts, see
Malware Scanning Verdict Values, page 25-37
.
Sophos Scanning
The Sophos scanning engine inspects objects downloaded from a web server in HTTP responses. After inspecting the object, it passes a malware scanning verdict to the DVS engine so the DVS engine can determine whether to monitor or block the request. You might want to enable the Sophos scanning engine instead of the McAfee scanning engine if the client machines have McAfee anti-malware software installed.
For more information about how the DVS engine uses malware scanning verdicts to handle web traffic, see
Cisco IronPort DVS™ (Dynamic Vectoring and Streaming) Engine, page 20-4
.
Understanding Adaptive Scanning
Adaptive Scanning is a logic layer that associates web reputation and the content type and decides based on the current threat profile which anti-malware scanning engine will process the web request.
Adaptive Scanning improves efficacy by identifying high-risk content and automatically selecting the best combination of available anti-malware services. Content which is identified as known malware can be automatically blocked. Adaptive Scanning applies the “Outbreak Heuristics” anti-malware category to transactions it identifies as malware prior to running any scanning engines. You can choose whether or not to block these transactions when you configure anti-malware settings on the appliance.
Enabling Adaptive Scanning increases efficacy for filtering out malware, but causes a slight decrease in appliance performance.
To use Adaptive Scanning, you must enable Web Reputation Filters.
When Adaptive Scanning is enabled, the web reputation and anti-malware settings you can configure in
Access Policies is slightly different:
20-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Enabling Web Reputation and Anti-Malware Filters
•
•
You can enable or disable web reputation filtering in each Access Policy, but you cannot edit the
Web Reputation Scores.
You can enable anti-malware scanning in each Access Policy, but you cannot choose which anti-malware scanning engine to enable. Adaptive Scanning chooses the most appropriate engine for each web request.
Note If Adaptive Scanning is not enabled and an Access Policy has particular web reputation and anti-malware settings configured, and then Adaptive Scanning is enabled, any existing web reputation and anti-malware settings are overridden.
Enabling Web Reputation and Anti-Malware Filters
The Web Reputation Filters, DVS engine, and the Webroot, McAfee, and Sophos scanning engines are enabled by default during system setup. Anytime after system setup, you can enable web reputation and anti-malware filters and configure global settings.
After the Web Reputation and Anti-Malware Filters are enabled, you can configure web reputation and anti-malware settings in policy groups. For more information, see
Configuring Web Reputation and
Anti-Malware in Policies, page 20-10 .
To enable Web Reputation and Anti-Malware Filters:
Step 1
Step 2
Step 3
Navigate to the Security Services > Web Reputation and Anti-Malware page.
Click Edit Global Settings .
The Edit Web Reputation and Anti-Malware Settings page appears.
Configure the web reputation and anti-malware settings as necessary.
Table 20-5 describes the settings
you can configure.
Table 20-5 Web Reputation and Anti-Malware Filter Settings
Setting
Web Reputation
Filtering
Adaptive Scanning
Description
Choose whether or not to enable Web Reputation Filtering.
Object Scanning
Limits
Sophos
Choose whether or not to enable Adaptive Scanning. You can only enable
Adaptive Scanning when Web Reputation Filtering is enabled.
For more information, see
Understanding Adaptive Scanning, page 20-8
.
Specify a maximum request/response size.
The Maximum Object Size value you specify applies to the entire size of requests and responses that might be scanned by security components on the
Web Security appliance, such as the Cisco IronPort Data Security Filters or the
Webroot scanning engine. When an upload or download size exceeds this size, the security component may abort the scan in progress and may not provide a scanning verdict to the Web Proxy.
Choose whether or not to enable the Sophos scanning engine.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-9
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Table 20-5
Setting
McAfee
Webroot
Web Reputation and Anti-Malware Filter Settings (continued)
Description
Choose whether or not to enable the McAfee scanning engine.
When you enable the McAfee scanning engine, you can choose whether or not to enable heuristic scanning. For more information about heuristic scanning, see
Note: Heuristic analysis increases security protection, but can result in false positives and decreased performance.
Choose whether or not to enable the Webroot scanning engine.
When you enable the Webroot scanning engine, you can configure the Threat
Risk Threshold (TRT). The TRT assigns a numerical value to the probability that malware exists.
Proprietary algorithms evaluate the result of a URL matching sequence and assign a Threat Risk Rating (TRR). This value is associated with the threat risk threshold setting. If the TRR value is greater than or equal to the TRT, the URL is considered malware and is passed on for further processing.
Note: Setting the Threat Risk Threshold to a value lower than 90 dramatically increases the rate of URL blocking and denies legitimate requests. Cisco strongly recommends maintaining the TRT default value of 90. The minimum value for a TRT setting is 51.
Step 4 Submit and commit your changes.
Configuring Web Reputation and Anti-Malware in Policies
When Web Reputation and Anti-Malware Filters are enabled on the appliance, you can configure different settings in policy groups.
You can enable monitoring or blocking for malware categories based on malware scanning verdicts. You can configure anti-malware settings in the following policy groups:
• Access Policies.
The settings you can configure vary depending on whether or not Adaptive
Scanning is enabled. For more information, see Configuring Web Reputation and Anti-Malware in
• Outbound Malware Scanning Policies.
For more information on configuring anti-malware settings in Outbound Malware Scanning Policies, see
Controlling Upload Requests Using Outbound
Malware Scanning Policies, page 13-6 .
You can configure web reputation settings in the following policy groups:
•
•
•
Access Policies.
The settings you can configure vary depending on whether or not Adaptive
Scanning is enabled. For more information, see Configuring Web Reputation and Anti-Malware in
Decryption Policies.
For more information, see Configuring Web Reputation for Decryption
.
Cisco IronPort Data Security Policies.
For more information, see Configuring Web Reputation for
Decryption Policies, page 20-15 .
20-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Configuring Web Reputation and Anti-Malware in Access Policies
When Adaptive Scanning is enabled, the web reputation and anti-malware settings you can configure for
Access Policies are slightly different than when Adaptive Scanning is turned off. For more information, see
Understanding Adaptive Scanning, page 20-8 .
Note If your deployment includes a Security Management appliance, and you are configuring this feature in a Configuration Master, options on this page depend on whether Adaptive Security is enabled for the relevant configuration master. Check the setting on the Security Management appliance, on the Web >
Utilities > Security Services Display page.
Adaptive Scanning Enabled
To configure web reputation and anti-malware settings in Access Policies with Adaptive Scanning enabled:
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to the Web Security Manager > Access Policies page.
Click the Web Reputation and Anti-Malware Filtering link for the Access Policy you want to configure.
Under the “Web Reputation and Anti-Malware Settings” section, choose Define Web Reputation and
Anti-Malware Custom Settings if it is not chosen already.
This allows you to configure web reputation and anti-malware settings for this Access Policy that differ from the global policy.
In the Web Reputation Settings section, choose whether or not to enable Web Reputation Filtering.
Adaptive Scanning chooses the most appropriate web reputation score thresholds for each web request.
Scroll down to the Cisco IronPort DVS Anti-Malware Settings section.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-11
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Figure 20-1 Access Policy Anti-Malware Settings—Adaptive Scanning Enabled
Step 6 Configure the anti-malware settings for the policy as necessary.
Table 20-6 describes the anti-malware
settings you can configure for Access Policies when Adaptive Scanning is enabled.
Table 20-6 Anti-Malware Settings for Access Policies—Adaptive Scanning Enabled
Setting
Enable Suspect User
Agent Scanning
Description
Choose whether or not to scan traffic based on the user agent field specified in the HTTP request header.
Enable Anti-Malware
Scanning
When you select this checkbox, you can choose to monitor or block suspect user agents in the Additional Scanning section at the bottom of the page.
Choose whether or not to use the DVS engine to scan traffic for malware.
Adaptive Scanning chooses the most appropriate engine for each web request.
Malware Categories Choose whether to monitor or block the various malware categories based on a malware scanning verdict. For more information on each category, see
Malware Category Descriptions, page 20-19
.
Other Categories Choose whether to monitor or block the types of objects and responses listed in this section.
Note: The category Outbreak Heuristics applies to transactions which are identified as malware by Adaptive Scanning prior to running any scanning engines.
Note: URL transactions are categorized as unscannable when the configured maximum time setting is reached or when the system experiences a transient error condition. For example, transactions might be categorized as unscannable during scanning engine updates or AsyncOS upgrades. The malware scanning verdicts SV_TIMEOUT and SV_ERROR, are considered unscannable transactions.
20-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Step 7 Submit and commit your changes.
Adaptive Scanning Disabled
To configure web reputation and anti-malware settings in Access Policies with Adaptive Scanning disabled:
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to the Web Security Manager > Access Policies page.
Click the Web Reputation and Anti-Malware Filtering link for the Access Policy you want to configure.
Under the “Web Reputation and Anti-Malware Settings” section, choose Define Web Reputation and
Anti-Malware Custom Settings if it is not chosen already.
This allows you to configure web reputation and anti-malware settings for this Access Policy that differ from the global policy.
Configure the settings in the Web Reputation Settings section. For more information, see
Web Reputation for Access Policies, page 20-14 .
Scroll down to the Cisco IronPort DVS Anti-Malware Settings section.
Figure 20-2 Access Policy Anti-Malware Settings—Adaptive Scanning Disabled
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-13
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Step 6 Configure the anti-malware settings for the policy as necessary.
Table 20-7 describes the anti-malware
settings you can configure for Access Policies when Adaptive Scanning is disabled.
Table 20-7 Anti-Malware Settings for Access Policies—Adaptive Scanning Disabled
Setting
Enable Suspect User
Agent Scanning
Enable Webroot
Description
Choose whether or not to enable the appliance to scan traffic based on the user agent field specified in the HTTP request header.
When you select this checkbox, you can choose to monitor or block suspect user agents in the Additional Scanning section at the bottom of the page.
Choose whether or not to enable the appliance to use the Webroot scanning engine when scanning traffic. When you enable Webroot scanning, you can choose to monitor or block some additional categories in the Malware categories on this page.
Enable Sophos or
McAfee
Choose whether or not to enable the appliance to use either the Sophos or
McAfee scanning engine when scanning traffic. When you enable Sophos or
McAfee scanning, you can choose to monitor or block some additional categories in the Malware categories on this page.
Malware Categories Choose whether to monitor or block the various malware categories based on a malware scanning verdict.
Other Categories
The categories listed in this section depend on which scanning engines you enable above. For more information on each category, see
.
Choose whether to monitor or block the types of objects and responses listed in this section.
Note URL transactions are categorized as unscannable when the configured maximum time setting is reached or when the system experiences a transient error condition. For example, transactions might be categorized as unscannable during scanning engine updates or AsyncOS upgrades. The malware scanning verdicts SV_TIMEOUT and
SV_ERROR, are considered unscannable transactions.
Step 7 Submit and commit your changes.
Configuring Web Reputation Scores
When you install and set up the Web Security appliance, it has default settings for Web Reputation
Scores. However, you can modify threshold settings for web reputation scoring to fit your organization’s needs.
You configure the web reputation filter settings for each policy group.
Configuring Web Reputation for Access Policies
You can edit the web reputation score thresholds in Access Policies when Adaptive Scanning is disabled.
To edit the web reputation score thresholds for an Access Policy:
Step 1 Navigate to the Web Security Manager > Access Policies page.
20-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Step 2
Step 3
Click the link under the Web Reputation and Anti-Malware Filtering column for the Access Policy group you want to edit.
Under the Web Reputation and Anti-Malware Settings section, choose “Define Web Reputation and
Anti-Malware Custom Settings” from the drop down menu if it is not selected already.
This allows you to configure web reputation and anti-malware settings for this Access Policy that differ from the global policy.
Figure 20-3 Web Reputation Filter Settings for Access Policies
Step 4
Step 5
Step 6
Move these markers to change the Web
Reputation threshold values.
Verify the Enable Web Reputation Filtering field is enabled.
Move the markers to change the range for URL block, scan, and allow actions.
Submit and commit your changes.
Configuring Web Reputation for Decryption Policies
To edit the web reputation filter settings for a Decryption Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Decryption Policies page.
Click the link under the Web Reputation column for the Decryption Policy group you want to edit.
Under the Web Reputation Settings section, choose “Define Web Reputation Custom Settings” from the drop down menu if it is not selected already.
This allows you to override the override the web reputation settings from the Global Policy Group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-15
Chapter 20 Configuring Security Services
Configuring Web Reputation and Anti-Malware in Policies
Figure 20-4 Web Reputation Filter Settings for Decryption Policies
Step 4
Step 5
Step 6
Step 7
Move these markers to change the
Web Reputation threshold values.
Choose action for sites with no assigned Web Reputation Score.
Verify the Enable Web Reputation Filtering field is checked.
Move the markers to change the range for URL drop, decrypt, and pass through actions.
In the Sites with No Score field, choose the action to take on request for sites that have no assigned Web
Reputation Score.
Submit and commit your changes.
Configuring Web Reputation for Cisco IronPort Data Security Policies
Only negative and zero values can be configured for web reputation threshold settings for Cisco IronPort
Data Security Policies. By definition, all positive scores are monitored.
To edit the web reputation filter settings for a Data Security Policy group:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > Cisco IronPort Data Security page.
Click the link under the Web Reputation column for the Data Security Policy group you want to edit.
Under the Web Reputation Settings section, choose “Define Web Reputation Custom Settings” from the drop down menu if it is not selected already.
20-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Figure 20-5
Maintaining the Database Tables
Web Reputation Filter Settings for Cisco IronPort Data Security Policies
Step 4
Step 5
Move the marker to change the Web Reputation threshold value.
This allows you to override the web reputation settings from the Global Policy Group.
Move the marker to change the range for URL block and monitor actions.
For more information on these actions, see
Data Security Policy Groups, page 14-3 .
Submit and commit your changes.
Maintaining the Database Tables
The web reputation, Webroot, Sophos, and McAfee databases periodically receive updates from the
Cisco IronPort update server ( https://update-manifests.ironport.com
). Server updates are automated, and the update interval is set by the server, not the appliance. Updates to the database tables occur automatically with no administrator intervention.
For information about update intervals and the Cisco IronPort update server, see
Security Service Components, page 27-41
.
The Web Reputation Database
The Web Security appliance collects information and maintains a filtering database that contains aggregated traffic statistics, request attributes, and information about how different types of requests are handled. Additionally, the appliance can be configured to send web reputation statistics to a Cisco
SensorBase Network server. SensorBase server information is leveraged with data feeds from the
SensorBase Network and the collective information is used to produce a Web Reputation Score.
Note For more information, see
The Cisco SensorBase Network, page 2-11 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-17
Chapter 20 Configuring Security Services
Logging
Logging
The access log file records the information returned by the Web Reputation Filters and the DVS engine for each transaction. The scanning verdict information section in the access logs includes many fields to help understand the cause for the action applied to a transaction. For example, some fields display the web reputation score or the malware scanning verdict Sophos passed to the DVS engine.
For more information about the scanning verdict information section in the access log file, see
Understanding Scanning Verdict Information, page 25-21
.
For more information about reading access log files, see
Access Log File, page 25-15 . For more an
example access log entry that explains web reputation processing, see
Web Reputation Filters Example, page 25-25
.
Logging Adaptive Scanning
how the adaptive scanning engine affected transactions.
Table 20-8 Adaptive Scanning Logging Information
Custom Field in
Access Logs
%X6
Custom Field in W3C Logs Description x-as-malware-threat-name The anti-malware name returned by Adaptive
Scanning. If the transaction is not blocked, this field returns a hyphen (“-”).
This variable is included in the scanning verdict information (in the angled brackets at the end of each access log entry).
Transactions blocked and monitored by the adaptive scanning engine use the following ACL decision tags:
•
•
BLOCK_AMW_RESP
MONITOR_AMW_RESP
20-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Malware Category Descriptions
Malware Category Descriptions
describes the different categories of malware the Web Security appliance can block.
Table 20-9 Malware Category Descriptions
Malware Type
Adware
Generic Spyware
Description
Adware encompasses all software executables and plug-ins that direct users towards products for sale. Some adware applications have separate processes that run concurrently and monitor each other, ensuring that the modifications are permanent. Some variants enable themselves to run each time the machine is started. These programs may also change security settings making it impossible for users to make changes to their browser search options, desktop, and other system settings.
A browser helper object is a browser plug-in that may perform a variety of functions related to serving advertisements or hijacking user settings.
Browser Helper
Object
Commercial System
Monitor
A commercial system monitor is a piece of software with system monitor characteristics that can be obtained with a legitimate license through legal means.
Dialer A dialer is a program that utilizes your modem or another type of Internet access to connect you to a phone line or a site that causes you to accrue long distance charges to which you did not provide your full, meaningful, and informed consent.
Spyware is a type of malware installed on computers that collects small pieces of information about users without their knowledge.
Hijacker
Other Malware
A hijacker modifies system settings or any unwanted changes to a user’s system that may direct them to a website or run a program without a user’s full, meaningful, and informed consent.
This category is used to catch all other malware and suspicious behavior that does not exactly fit in one of the other defined categories.
Phishing URL
PUA
System Monitor
A phishing URL is displayed in the browser address bar. In some cases, it involves the use of domain names and resembles those of legitimate domains.
Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal personal identity data and financial account credentials.
Potentially Unwanted Application. A PUA is an application that is not malicious, but which may be considered to be undesirable.
A system monitor encompasses any software that performs one of the following actions:
•
•
Overtly or covertly records system processes and/or user action.
Makes those records available for retrieval and review at a later time.
Trojan Downloader A trojan downloader is a Trojan that, after installation, contacts a remote host/site and installs packages or affiliates from the remote host. These installations usually occur without the user’s knowledge. Additionally, a Trojan
Downloader’s payload may differ from installation to installation since it obtains downloading instructions from the remote host/site.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-19
Chapter 20 Configuring Security Services
Malware Category Descriptions
Table 20-9
Malware Type
Trojan Horse
Trojan Phisher
Virus
Worm
Malware Category Descriptions (continued)
Description
A trojan horse is a destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves.
A trojan phisher may sit on an infected computer waiting for a specific web page to be visited or may scan the infected machine looking for user names and passwords for bank sites, auction sites, or online payment sites.
A virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes.
A worm is program or algorithm that replicates itself over a computer network and usually performs malicious actions.
20-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 20 Configuring Security Services
Malware Category Descriptions
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
20-21
Malware Category Descriptions
Chapter 20 Configuring Security Services
20-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
21
Authentication
This chapter contains the following information:
•
Authentication Overview, page 21-1
•
•
•
•
•
•
•
•
•
•
•
•
•
Understanding How Authentication Works, page 21-4
Working with Authentication Realms, page 21-10
Working with Authentication Sequences, page 21-12
Appliance Behavior with Multiple Authentication Realms, page 21-14
Testing Authentication Settings, page 21-15
Configuring Global Authentication Settings, page 21-17
Sending Authentication Credentials Securely, page 21-25
Allowing Users to Re-Authenticate, page 21-27
Tracking Authenticated Users, page 21-29
Bypassing Authentication, page 21-29
LDAP Authentication, page 21-30
NTLM Authentication, page 21-35
Supported Authentication Characters, page 21-39
Authentication Overview
Authentication is the act of confirming the identity of a user. By using authentication in the Web Security appliance, you can control access to the Web for each user or a group of users. This allows you to enforce the organization’s policies and comply with regulations. When you enable authentication, the Web
Security appliance authenticates clients on the network before allowing them to connect to a destination server.
The Web Security appliance supports the following authentication protocols:
• Lightweight Directory Access Protocol (LDAP).
The appliance supports standard LDAP server authentication and secure LDAP authentication. You can use a Basic authentication scheme. For more information about LDAP configuration options, see
LDAP Authentication, page 21-30 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-1
Chapter 21 Authentication
Authentication Overview
• NT Lan Manager (NTLM).
The appliance supports NTLM to enable authentication between the appliance and a Microsoft Windows domain controller. You can use either NTLMSSP or Basic authentication schemes. For more information about NTLM configuration options, see
To enable authentication, you must create at least one authentication realm. An authentication realm is a set of authentication servers (or a single server) supporting a single authentication protocol with a particular configuration. For more information about authentication realms, see
Authentication Realms, page 21-10 .
When you create more than one realm, you can group the realms into an authentication sequence. An authentication sequence is a group of authentication realms listed in the order the Web Security appliance uses for authenticating clients. For more information about authentication sequences, see
Working with Authentication Sequences, page 21-12
.
You configure some authentication options at a global level, independent of any realm. For more information, see
Configuring Global Authentication Settings, page 21-17 .
By creating authentication realms and sequences, you can configure the Web Security appliance to use one or more authentication servers for authenticating clients on the network. For more information about how the appliance works when it uses multiple authentication servers, see
Multiple Authentication Realms, page 21-14 .
After creating an authentication realm and possibly a sequence, too, you can create or edit Identities based on authentication realms or sequences. Note, however, that if you delete an authentication realm or sequence, any Identity group that depends on the deleted realm or sequence becomes disabled. For more information about using authentication with Identities, see
Understanding How Authentication
Affects Identity Groups, page 9-3 .
Client Application Support
When the Web Security appliance is deployed in transparent mode and a transaction requires authentication, the Web Proxy replies to the client application asking for authentication credentials.
However, not all client applications support authentication, so they have no method for prompting users to provide their user names and passwords. These applications cannot be used when the Web Security appliance is deployed in transparent mode.
The following is a partial list of applications that do not work when the appliance is deployed in transparent mode:
• Mozilla Thunderbird
•
•
•
•
•
Adobe Acrobat Updates
HttpBridge
Subversion, by CollabNet
Microsoft Windows Update
Microsoft Visual Studio
Note If users need to access a particular URL using one of these client applications, then create an Identity based on a custom URL category that does not require authentication and place the Identity above all other Identities that require authentication. When you do this, the client application will not be asked for authentication.
21-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Authentication Overview
Working with Upstream Proxy Servers
You can connect the Web Security appliance to an upstream proxy server. The upstream proxy server might be another Web Security appliance or a third party proxy. When the Web Security appliance is connected to an upstream proxy server, whether or not you can enable authentication depends on the authentication type:
• NTLMSSP.
When NTLMSSP authentication is used to authenticate users, you should only enable authentication on either the Web Security appliance or the upstream proxy server, but not both.
Cisco recommends configuring the Web Security appliance to use authentication. This allows you to create policies based on user authentication.
•
If both the appliance and the upstream proxy use authentication with NTLMSSP, depending on the configurations, the appliance and upstream proxy might engage in an infinite loop of requesting authentication credentials. For example, if the upstream proxy requires Basic authentication, but the appliance requires NTLMSSP authentication, then the appliance can never successfully pass Basic credentials to the upstream proxy. This is due to limitations in authentication protocols.
Basic.
When Basic authentication is used to authenticate users, you can enable authentication on either the appliance or upstream proxy server, or on both the appliance and upstream proxy server.
However, when both the Web Security appliance and upstream proxy server use Basic authentication, do not enable the Credential Encryption feature on the downstream Web Security appliance. When Credential Encryption is enabled on the downstream appliance, client requests fail because the Web Proxy receives a “Authorization” HTTP header from clients, but the upstream proxy server requires a “Proxy-Authorization” HTTP header.
Authenticating Users
When users access the web through the Web Security appliance, they might get prompted to enter a user name and password. The Web Proxy requires authentication credentials for some users depending on the configured Identity and Access Policy groups. Users should enter the user name and password of the credentials recognized by the organization’s authentication server.
When the Web Proxy uses NTLMSSP authentication with an NTLM authentication realm, users are typically not prompted to enter a user name and password if single sign-on is configured correctly.
However, if users are prompted for authentication, they must type the name of their Windows domain before their user name. For example, if user jsmith is on Windows domain MyDomain, then the user should type the following text in the user name field:
MyDomain\jsmith
However, if the Web Proxy uses Basic authentication for an NTLM authentication realm, then entering the Windows domain is optional. If the user does not enter the Windows domain, then the Web Proxy prepends the default Windows domain.
Note When the Web Proxy uses authentication with an LDAP authentication realm, ensure users do not enter the Windows domain name.
Working with Failed Authentication
Sometimes users are blocked from the web due to authentication failure. The following list describes reasons for authentication failure and remedial actions you can take:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-3
Chapter 21 Authentication
Understanding How Authentication Works
•
•
•
Client application cannot perform authentication.
Some clients cannot perform authentication or cannot perform the type of authentication that is required. If a client application causes authentication to fail, you can define an Identity policy based on the user agent and exclude it from requiring authentication. Or, you can define an Identity policy based on a custom URL category to exclude all clients from requiring authentication when accessing particular URLs.
Authentication server is unavailable.
An authentication server might be unavailable if the network connection is broken or if the server is experiencing a problem. To avoid this problem, configure the
“Action if Authentication Service Unavailable” global authentication setting. For more information, see
Configuring Global Authentication Settings, page 21-17 .
Invalid credentials.
When a client passes invalid authentication credentials, the Web Proxy continually requests valid credentials, essentially blocking access to the web by default. However, you can grant limited access to users who fail authentication. For more information, see
Guest Access to Users Who Fail Authentication, page 9-8 .
Note You can configure the Web Proxy to request authentication again if an authenticated user is blocked from a website due to restrictive URL filtering or being prevented from logging into multiple machines simultaneously. To do this, enable the “Enable Re-Authentication Prompt If End User Blocked by URL
Category or User Session Restriction” global authentication setting. For more information, see
Users to Re-Authenticate, page 21-27
.
Working with Windows 7 and Windows Vista
Windows 7 and Windows Vista machines have a feature called Network Connectivity Status Indicator
(NCSI). When clients on your network use NCSI and the Web Security appliance uses NTLMSSP authentication, you should configure the appliance so it uses a relatively small timeout value for machine credentials. Do this using the advancedproxyconfig > authentication CLI command:
Enter the surrogate timeout for machine credentials.
When NCSI is running on a Windows machine, it checks for network connectivity by making HTTP requests. When the machine running NCSI is prompted to authenticate (the request is assigned an
Identity Policy that requires authentication), NCSI authenticates using the machine’s credentials instead of the user’s credentials.
When the Identity Policy uses IP based surrogates, subsequent requests from the user might be assigned an incorrect Access Policy as the user would be identified using the machine credentials instead of the user’s own credentials.
You can use the advancedproxyconfig > authentication CLI command to specify how long the IP address surrogate is used for machine credentials before requiring authentication again. The Web Proxy differentiates between user and machine credentials.
Understanding How Authentication Works
To authenticate users who access the web, the Web Security appliance connects to an external authentication server. The authentication server contains a list of users and their corresponding passwords and it organizes the users into a hierarchy. For users on the network to successfully authenticate, they must provide valid authentication credentials (user name and password as stored in the authentication server).
21-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Understanding How Authentication Works
When users access the web through a Web Security appliance that requires authentication, the Web
Proxy asks the client for authentication credentials. The Web Proxy communicates with both the client and the authentication server to authenticate the user and process the request.
Figure 21-1 shows how the Web Security appliance communicates with clients and authentication
servers.
Figure 21-1 Web Security Appliance Authentication
Basic or NTLMSSP LDAP or NTLM
Client Web Security Appliance Authentication
Server
The Web Security appliance supports the following authentication protocols:
• Lightweight Directory Access Protocol (LDAP).
The Web Proxy uses the LDAP Bind operation to query an LDAP-compatible authentication server. The appliance supports standard LDAP server authentication and secure LDAP authentication.
For more information about LDAP configuration options, see
LDAP Authentication, page 21-30
.
• NT LAN Manager (NTLM).
The Web Proxy uses NTLM, a Microsoft proprietary protocol, to authenticate users which exist in Microsoft Active Directory. The NTLM protocol uses a challenge-response sequence of messages between the client and the Active Directory server. You can use either NTLMSSP or Basic authentication schemes on client side.
For more information about NTLM configuration options, see
NTLM Authentication, page 21-35
.
In addition to the preceding protocols, the Web Security appliance supports the following client side authentication schemes:
• Basic.
Allows a client application to provide authentication credentials in the form of a user name and password when it makes a request. You can use the Basic authentication scheme with either an
LDAP or Active Directory server.
• NTLMSSP.
Allows the client application to provide authentication credentials in the form of a challenge and response. It uses a binary message format to authenticate clients that use the NTLM protocol to access network resources. You can use the NTLMSSP authentication scheme only with an Active Directory server. When the Web Proxy uses NTLMSSP, most client applications can use the Windows login credentials for authentication and users do not need to enter their credentials again. This is called “single sign-on.”
For more information, see
Basic versus NTLMSSP Authentication Schemes, page 21-6
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-5
Chapter 21 Authentication
Understanding How Authentication Works
appliance and the client and between the Web Security appliance and the authentication server.
Table 21-1 Web Security Appliance Authentication Scenarios
Client to Web Security
Appliance
Web Security Appliance to
Authentication Server Authentication Server Type
Basic LDAP LDAP
Basic
Basic
NTLMSSP
LDAP
NTLM
NTLM
Active Directory server using LDAP
Active Directory server using NTLM
Active Directory server using NTLM
Web Proxy deployment also affects how authentication works in each of the scenarios described in
Table 21-1 . For more information, see
How Web Proxy Deployment Affects Authentication, page 21-7
.
Basic versus NTLMSSP Authentication Schemes
When you configure an Identity group to use authentication, you choose the authentication scheme, either Basic or NTLMSSP. The authentication scheme affects the user experience and the security of users’ passwords.
Table 21-2 describes the differences between Basic and NTLMSSP authentication schemes.
Table 21-2 Basic versus NTLMSSP Authentication Schemes
Authentication
Scheme User Experience
Basic The client always prompts users for credentials. After the user enters credentials, browsers typically offer a check box to remember the provided credentials. Each time the user opens the browser, the client either prompts for credentials or resends the previously saved credentials.
NTLMSSP The client transparently authenticates by using its Windows login credentials. The user is not prompted for credentials.
However, the client prompts the user for credentials under the following circumstances:
•
•
The Windows credentials failed.
The client does not trust the Web
Security appliance because of browser security settings.
Security
Credentials are sent unsecured as clear text (Base64). A packet capture between the client and Web Security appliance can reveal the user name and password.
Note: You can configure the Web Security appliance so clients send authentication credentials securely. For more information, see
Credentials Securely, page 21-25
.
Credentials are sent securely using a three-way handshake (digest style authentication). The password is never sent across the connection.
For more information on the three-way handshake, see
Deployment, NTLM Authentication, page 21-9 .
21-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Understanding How Authentication Works
How Web Proxy Deployment Affects Authentication
The Web Proxy communicates with clients and authentication servers differently depending on the type of Web Proxy deployment and the authentication protocol.
lists the possible methods of authentication for the various authentication protocols and deployment type.
Table 21-3 Methods of Authentication
Web Proxy Deployment
Explicit forward
Transparent
Explicit forward
Transparent
Client to Web Security
Appliance
Basic
Basic
NTLM
NTLM
Web Security Appliance to Authentication
Server
LDAP or NTLM Basic
LDAP or NTLM Basic
NTLMSSP
NTLMSSP
The following subsections describe these methods of authentication in more detail.
Explicit Forward Deployment, Basic Authentication
When a client explicitly sends a web page request to a Web Security appliance deployed in explicit forward mode, the Web Proxy can reply to the client with a 407 HTTP response “Proxy Authentication
Required.” This status informs the client that it must supply valid authentication credentials to access web resources.
The authentication process comprises these steps:
Step 1
Step 2
Step 3
Step 4
Client sends a request to the Web Proxy to connect to a web page.
Web Proxy responds with a 407 HTTP response “Proxy Authentication Required.”
User enters credentials, and client application resends the original request with the credentials encoded in Base64 (not encrypted) in a “Proxy-Authorization” HTTP header.
Web Proxy verifies the credentials and returns the requested web page.
lists advantages and disadvantages of using explicit forward Basic authentication.
Table 21-4 Pros and Cons of Explicit Forward Basic Authentication
Advantages
• RFC-based
• Supported by all browsers and most other applications
•
•
Minimal overhead
Works for HTTPS (CONNECT) requests
Disadvantages
•
•
Password sent as clear text (Base64) for every request
No single sign-on
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-7
Chapter 21 Authentication
Understanding How Authentication Works
Transparent Deployment, Basic Authentication
The 407 HTTP response “Proxy Authentication Required” is allowed from proxy servers only. However, when the Web Proxy is deployed in transparent mode, its existence is hidden from client applications on the network. Therefore, the Web Proxy cannot return a 407 response.
To address this problem, the authentication process comprises these steps:
Step 1
Step 2
Client sends a request to a web page and the Web Proxy transparently intercepts it.
Web Proxy uses a 307 HTTP response to redirect the client to the Web Proxy which masquerades as a local web server.
Note This transaction is recorded in the access logs with “TCP_DENIED/307”.
Step 3
Step 4
Step 5
Step 6
Step 7
Client sends a request to the redirected URL.
Web Proxy sends a 401 HTTP response “Authorization required.”
User is prompted for credentials and enters them.
Client sends the request again, but this time with the credentials in an “Authorization” HTTP header.
Web Proxy confirms the credentials, tracks the user by IP address or with a cookie, and then redirects the client to the originally requested server.
Note You can configure the Web Proxy to use either IP addresses or cookies to track authenticated users.
Step 8 If the client requests the original web page again, the Web Proxy transparently intercepts the request, confirms the user by IP address or cookie, and returns the requested page.
Note If the client tries to connect to another web page and the Web Proxy tracked the user by IP address, the
Web Proxy confirms the user by IP address and returns the requested page.
Table 21-5 lists advantages and disadvantages of using transparent Basic authentication and IP-based
credential caching.
Table 21-5 Pros and Cons of Transparent Basic Authentication—IP Caching
Advantages
•
•
•
•
Works with all major browsers
With user agents that do not support authentication, users only need to authenticate first in a supported browser
Relatively low overhead
•
Disadvantages
• Authentication credentials are associated with the IP address, not the user (does not work in
Citrix and RDP environments, or if the user changes IP address)
•
No single sign-on
Password is sent as clear text (Base64)
Works for HTTPS requests if the user has previously authenticated with an HTTP request
21-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Understanding How Authentication Works
lists advantages and disadvantages of using transparent Basic authentication and cookie-based credential caching.
Table 21-6 Pros and Cons of Transparent Basic Authentication—Cookie Caching
Advantages
•
•
Works with all major browsers
Authentication is associated with the user rather than the host or IP address
•
Disadvantages
•
•
Each new web domain requires the entire authentication process because cookies are domain specific
Requires cookies to be enabled
•
Does not work for HTTPS requests
No single sign-on
• Password is sent as clear text (Base64)
Explicit Forward Deployment, NTLM Authentication
The Web Proxy uses a third party challenge and response system to authenticate users on the network.
The authentication process comprises these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Client sends a request to the Web Proxy to connect to a web page.
Web Proxy responds with a 407 HTTP response “Proxy Authentication Required.”
Clients repeats request and includes a “Proxy-Authorization” HTTP header with an NTLM “negotiate” message.
Web Proxy responds with a 407 HTTP response and an NTLM “challenge” message based on the negotiate message from the client.
Client repeats the request and includes a response to the challenge message.
Note The client uses an algorithm based on its password to modify the challenge and sends the challenge response to the Web Proxy.
Step 6
Step 7
Web Proxy passes the authentication information to the Active Directory server. The Active Directory server then verifies that the client used the correct password based on whether or not it modified the challenge string appropriately.
If the challenge response passes, the Web Proxy returns the requested web page.
Note Additional requests on the same TCP connection do not need to be authenticated again with the Active
Directory server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-9
Chapter 21 Authentication
Working with Authentication Realms
Table 21-7 lists advantages and disadvantages of using explicit forward NTLM authentication.
Table 21-7 Pros and Cons of Explicit Forward NTLM Authentication
Advantages
•
•
Because the password is not transmitted to the authentication server, it is more secure
Connection is authenticated, not the host or IP address
• Achieves true single sign-on in an Active Directory environment when the client applications are configured to trust the Web Security appliance
Disadvantages
•
•
Moderate overhead: each new connection needs to be re-authenticated
Primarily supported on Windows only and with major browsers only
Transparent Deployment, NTLM Authentication
Transparent NTLM authentication is similar to transparent Basic authentication except that the Web
Proxy communicates with clients using NTLMSSP instead of Basic. However, with transparent NTLM authentication, the authentication credentials are not sent in the clear to the authentication server.
For more information, see
Transparent Deployment, Basic Authentication, page 21-8
.
The advantages and disadvantages of using transparent NTLM authentication are the same as those of using transparent Basic authentication except that transparent NTLM authentication is better because the password is not sent to the authentication server and you can achieve single sign-on when the client applications are configured to trust the Web Security appliance. For more information on the advantages and disadvantages of transparent Basic authentication, see
Working with Authentication Realms
An authentication realm is a set of authentication servers (or a single server) supporting a single authentication protocol with a particular configuration.
You can perform any of the following tasks when configuring authentication:
• Include up to three authentication servers in a realm.
•
•
Create zero or more LDAP realms.
Create zero or one NTLM realm.
•
•
•
•
Include an authentication server in multiple realms.
Include one or more realms in an authentication sequence.
Include realms of different protocols in a single authentication sequence.
Assign a realm or a sequence to an Access Policy group.
You create, edit, and delete authentication realms on the Network > Authentication page under the
Authentication Realms section. Figure 21-2 shows where you define authentication realms.
21-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Figure 21-2 Authentication Page — Authentication Realms
Working with Authentication Realms
When you create two or more realms, you can order them in an authentication sequence. For more information, see
Working with Authentication Sequences, page 21-12 .
Creating Authentication Realms
When you first create a realm, you choose the protocol type, either LDAP or NTLM. You can only create on NTLM realm so therefore, once an NTLM realm is defined, the appliance only allows you to create
LDAP realms. After you enter the authentication settings, you can test that the parameters you entered are valid before you submit your changes. For more information about testing the authentication settings, see
Testing Authentication Settings, page 21-15
.
To create an authentication realm:
Step 1
Step 2
On the Network > Authentication page, click Add Realm . The Add Realm page appears.
Enter a name for the authentication realm in the Realm Name field.
Note All sequence and realm names must be unique and only contain alphanumeric characters or the space character. Also, if the Web Security appliance is managed by a Security Management appliance, ensure that authentication realms on different Web Security appliances with the same name have the exact same properties defined on each appliance.
Step 3
Step 4
Step 5
If no NTLM realm is defined, choose the authentication protocol and scheme in the Authentication
Protocol and Scheme(s) field.
Enter the authentication settings as necessary, depending on the protocol type.
•
•
For details on LDAP settings, see
.
For details on NTLM settings, see
.
You can test the parameters you entered by clicking Start Test in the Test Current Settings section.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-11
Chapter 21 Authentication
Working with Authentication Sequences
Step 6 Submit and commit your changes.
Editing Authentication Realms
To edit an authentication realm:
Step 1
Step 2
Step 3
Step 4
Step 5
On the Network > Authentication page, click the realm name.
Change the name of the realm if necessary.
Edit the authentication settings as necessary, depending on the protocol type.
• For details on LDAP settings, see
• For details on NTLM settings, see
You can test the parameters you entered by clicking Start Test in the Test Current Settings section.
Submit and commit your changes.
Deleting Authentication Realms
When you delete a realm, the Web Security appliance automatically deletes that realm from any sequence that used it. Also, any Identity policy group that depends on the deleted realm becomes disabled.
To delete an authentication realm:
Step 1
Step 2
Step 3
On the Network > Authentication page, click the trash can icon for the realm name.
Confirm that you want to delete the realm by clicking Delete .
Commit your changes.
Working with Authentication Sequences
When you create more than one realm, you can group the realms into an authentication sequence. An authentication sequence is a group of authentication realms listed in the order the Web Security appliance uses for authenticating clients.
You can perform any of the following tasks when configuring authentication sequences:
•
•
•
•
Create multiple authentication sequences.
Include one or more realms in an authentication sequence.
Include realms of different protocols in a single authentication sequence.
Assign a realm or a sequence to an Access Policy group.
You create authentication sequences on the Network > Authentication page under the Realm Sequences section. the Realm Sequences section only appears when you create two or more realms.
shows where you create, edit, and delete authentication sequences
21-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Figure 21-3 Authentication Page — Authentication Sequences
Working with Authentication Sequences
Click sequence name to edit.
Create authentication sequence.
All Realms default authentication sequence.
Delete authentication sequence.
After you create the second realm, the appliance automatically displays the Realm Sequences section and includes a default authentication sequence named All Realms. The All Realms sequence automatically includes each realm you define. You can change the order of the realms within the All
Realms sequence, but you cannot delete any of its realms. You cannot delete the All Realms sequence.
Creating Authentication Sequences
You can create an authentication sequence after you create multiple authentication realms.
To create an authentication sequence:
Step 1 On the Network > Authentication page, click Add Sequence .
The Add Realm Sequence page appears.
Step 2
Choose realm.
Add a realm to the sequence.
Delete the realm.
Enter a name for the sequence in the Name for Realm Sequence field.
Note All sequence and realm names must be unique and only contain alphanumeric characters or the space character. Also, if the Web Security appliance is managed by a Security Management appliance, ensure that authentication realms on different Web Security appliances with the same name have the exact same properties defined on each appliance.
Step 3
Step 4
In the first row of the Authentication Realm Sequence area, choose the realm name you want to include in the sequence from the Realms field.
If you want to include more realms, click Add Row .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-13
Chapter 21 Authentication
Appliance Behavior with Multiple Authentication Realms
Step 5 Choose the realm name for any additional row you add.
Note You can delete a realm from the sequence by clicking the trash can icon for that row.
Step 6 When you have entered all realms in the sequence, and they are in the order you want, submit and commit your changes.
Editing Authentication Sequences
To edit an authentication sequence:
Step 1
Step 2
Step 3
On the Network > Authentication page, click the sequence name.
Perform any of the following tasks as necessary:
• Change the name of the sequence.
•
•
•
Add a new realm by clicking Add Row .
Delete a realm by clicking the trash can icon.
Change the order of the realms by clicking the arrow icon in the Order column for the realm.
Submit and commit your changes.
Deleting Authentication Sequences
If you delete an authentication sequence, any Access Policy group that depends on the deleted sequence becomes disabled.
To delete an authentication sequence:
Step 1
Step 2
Step 3
On the Network > Authentication page, click the trash can icon for the sequence name.
Confirm that you want to delete the sequence by clicking Delete .
Commit your changes.
Appliance Behavior with Multiple Authentication Realms
You can configure the Web Security appliance to attempt authenticating clients against multiple authentication servers, and against authentication servers with different authentication protocols. When you configure the appliance to authenticate against multiple authentication servers, it only requests the credentials from the clients once. This is true even when you configure the appliance to authenticate against different protocols.
You might want to configure a web policy group to authenticate against different realms if your organization acquires another organization that has its own authentication server using the same or a different authentication protocol. That way, you can create one Access Policy group for all users and assign to the policy group an authentication sequence that contains a realm for each authentication server.
21-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Testing Authentication Settings
When you assign an authentication sequence with multiple realms to a policy group and a client sends a content request, the appliance performs the following actions:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
The appliance gets the credentials from the client.
The appliance attempts to authenticate the client against the authentication server(s) defined in the first realm in the sequence.
If the client credentials do not match a user in the servers defined in the first realm, it tries to authenticate against the authentication server(s) in the next realm in the sequence.
The appliance continues trying to authenticate the client against servers in the next realms until it either succeeds or runs out of authentication realms.
When authentication succeeds, the appliance passes the content response to the client.
When the appliance fails to authenticate the client against any authentication realm in the sequence, the appliance does not allow the client to connect to the destination server. Instead, it displays an error message to the client.
Tip: For optimal performance, configure clients on a subnet to be authenticated in a single realm.
Testing Authentication Settings
When you create or edit an authentication realm, you enter a lot of configuration settings to connect to the authentication server. You can test the settings you enter before submitting the changes to verify you entered the connection information correctly.
You can test authentication setting from either the CLI or the web interface:
• Web interface.
Use Start Test when you create or edit an authentication realm. For more information, see
Testing Authentication Settings in the Web Interface, page 21-16
.
• CLI command.
Use the testauthconfig command. For more information, see
Authentication Settings in the CLI, page 21-17 .
Testing Process
When you test authentication settings, the Web Security appliance first verifies that the settings you entered for the realm are in valid formats. For example, if a field requires a string and it currently contains a numeric value, the appliance informs you of that error.
If all fields contain valid values, the appliance performs different steps, depending on the authentication protocol. If the realm contains multiple authentication servers, the appliance goes through the testing process for each server in turn.
The appliance continues testing all servers in the realm and determines as many failures as possible for each server. It reports the testing outcome of each server in the realm.
LDAP Testing
The appliance performs the following steps when you test LDAP authentication settings:
Step 1 It ensures that the LDAP server is listening on the specified LDAP port.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-15
Chapter 21 Authentication
Testing Authentication Settings
Step 2
Step 3
Step 4
Step 5
If Secure LDAP is selected, the appliance ensures the LDAP server supports secure LDAP.
It performs an LDAP query using the supplied Base DN, User Name Attribute, and User Filter Query.
If the realm includes Bind Parameters, the appliance validates them by forming an LDAP query with the
Bind Parameters.
If Group Authorization is provided, the appliance ensures that the specified group attributes are valid by fetching the groups from the server.
NTLM Testing
The appliance performs the following steps when you test NTLM authentication settings:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
It ensures that the specified Active Directory server is reachable and responds to queries.
It ensures that a DNS lookup on the Active Directory domain is successful since the Active Directory domain must be a DNS domain name and not a WINS domain name.
It ensures the system time of the appliance and the system time of the Active Directory server are within three minutes of each other.
It validates the user credentials by generating a kerberos ticket.
It validates whether the user has the proper privileges to add the Web Security appliance to the Active
Directory domain.
It validates whether you can fetch the groups within the domain.
Testing Authentication Settings in the Web Interface
You verify the authentication settings in the Test Current Settings section when you create or edit an authentication realm.
shows where you verify the authentication settings in the web interface.
Figure 21-4 Network > Authentication Page — Test Current Settings Section
After you enter all settings, click Start Test . The appliance uses the connection information entered to attempt to connect to the authentication server. It displays the status of the test below Start Test .
Start Test changes to Stop Test while the appliance tests the settings against the authentication servers.
If the testing takes too much time and you already know it is going to fail, you can click Stop Test to stop the testing process and edit the settings.
shows the testing results for an LDAP authentication realm.
21-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Figure 21-5 Authentication Testing Results
Configuring Global Authentication Settings
Testing Authentication Settings in the CLI
You can use the testauthconfig CLI command to test authentication settings defined for a given realm.
The command syntax is: testauthconfig [-d level] [realm name]
Running the command without any option causes the appliance to list the configured authentication realms from which you can make a selection.
The debug flag (
-d
) controls the level of debug information. The levels can range between 0-10. If unspecified, the appliance uses a level of 0. With level 0, the command will return success or failure. If the test settings fail, the command will list the cause of the failure.
Note Cisco recommends you use level 0. Only use a different debug level when you need more detailed information to troubleshoot.
For more information about the testauthconfig
command, see Web Security Appliance CLI
.
Configuring Global Authentication Settings
Some authentication settings are independent of any realm you define. For example, you can configure whether or not clients send authentication credentials to the Web Security appliance securely, even when using Basic authentication scheme. For more information, see
Sending Authentication Credentials
.
Figure 21-6 shows the global authentication settings on the Network > Authentication page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-17
Configuring Global Authentication Settings
Figure 21-6 Network > Authentication Page
Chapter 21 Authentication
Note The global authentication settings you can configure changes according to the Web Proxy deployment.
You can configure more settings when it is deployed in transparent mode than in explicit forward mode.
To configure global authentication settings:
Step 1 On the Network > Authentication page, click Edit Global Settings .
The Edit Global Authentication Settings page appears with two main sections, one labeled Global
Authentication Settings and the other labeled for the proxy deployment type, either transparent or forward.
Figure 21-7 on page 21-18 shows the Global Authentication Settings section.
Figure 21-7 Global Authentication Settings
21-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Configuring Global Authentication Settings
Step 2 Edit the settings in the Global Authentication Settings section as defined in
.
Table 21-8 Global Authentication Settings
Setting
Action if Authentication
Service Unavailable
Failed Authentication
Handling
Re-authentication
(Enable Re-Authentication
Prompt If End User Blocked by URL Category or User
Session Restriction)
Basic Authentication Token
TTL
Description
Choose one of the following values:
• Permit traffic to proceed without authentication.
Processing continues as if the user was authenticated.
• Block all traffic if user authentication fails.
Processing is discontinued and all traffic is blocked.
When you grant users guest access in an Identity policy, this setting determines how the Web Proxy identifies and logs the user as a guest in the access logs.
For more information on granting users guest access, see
Guest Access to Users Who Fail Authentication, page 9-8 .
This setting allows users to authenticate again if the user is blocked from a website due to a restrictive URL filtering policy or due to being restricted from logging into another IP address.
The user sees a block page that includes a link that allows them to enter new authentication credentials. If the user enters credentials that allow greater access, the requested page appears in the browser.
Note: This setting only applies to authenticated users who are blocked due to restrictive URL filtering policies or User Session Restrictions.
It does not apply to blocked transactions by subnet with no authentication.
For more information, see
Allowing Users to Re-Authenticate, page 21-27 .
Controls the length of time that user credentials are stored in the cache before revalidating them with the authentication server. The default value is the recommended setting. When the Surrogate Timeout setting is configured and is greater than the Basic Authentication Token TTL, then the Surrogate Timeout value takes precedence and the Web Proxy contacts the authentication server after surrogate timeout expires.
The remaining authentication settings you can configure depends on how the Web Proxy is deployed, in transparent or explicit forward mode.
Figure 21-8 on page 21-20 shows where you configure the global authentication settings when the Web
Proxy is deployed in transparent mode.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-19
Configuring Global Authentication Settings
Figure 21-8 Transparent Proxy Mode Authentication Settings
Chapter 21 Authentication
Step 3 If the Web Proxy is deployed in transparent mode, edit the settings in
.
Table 21-9 Transparent Proxy Mode Authentication Settings
Setting Description
Credential Encryption This setting specifies whether or not the client sends the login credentials to the Web Proxy through an encrypted HTTPS connection.
HTTPS Redirect Port
This setting applies to both Basic and NTLMSSP authentication schemes, but it is particularly useful for Basic authentication scheme because user credentials are sent as plain text.
For more information, see
Sending Authentication Credentials Securely, page 21-25
.
Specify a TCP port to use for redirecting requests for authenticating users over an HTTPS connection.
This specifies through which port the client will open a connection to the
Web Proxy using HTTPS. This occurs when credential encryption is enabled or when using SaaS Access Control and SaaS users are prompted to authenticate.
21-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Configuring Global Authentication Settings
Table 21-9
Options:
Credential Cache
Options:
Cache Size
Transparent Proxy Mode Authentication Settings (continued)
Setting
Redirect Hostname
Credential Cache
Surrogate Timeout
Credential Cache
Options:
Client IP Idle Timeout
Description
Enter the short hostname of the network interface on which the Web Proxy listens for incoming connections.
When you configure authentication on an appliance deployed in transparent mode, the Web Proxy uses this hostname in the redirection URL sent to clients for authenticating users.
You can enter either the following values:
• Single word hostname.
You can enter the single word hostname that is
DNS resolvable by the client and the Web Security appliance. This allows clients to achieve true single sign-on with Internet Explorer without additional browser side setup.
Be sure to enter the single word hostname that is DNS resolvable by the client and the Web Security appliance.
For example, if your clients are in domain mycompany.com
and the interface on which the Web Proxy is listening has a full hostname of proxy.mycompany.com
, then you should enter proxy
in this field.
Clients perform a lookup on proxy
and they should be able to resolve proxy.mycompany.com
.
• Fully qualified domain name (FQDN).
You can also enter the FQDN or IP address in this field. However, if you do that and want true single sign-on for Internet Explorer and Firefox browsers, you must ensure that the FQDN or IP address is added to the client’s Trusted Sites list in the client browsers.
The default value is the FQDN of the M1 or P1 interface, depending on which interface is used for proxy traffic.
This setting specifies how long the Web Proxy waits before asking the client for authentication credentials again. Until the Web Proxy asks for credentials again, it uses the value stored in the surrogate (IP address or cookie).
It is common for user agents, such as browsers, to cache the authentication credentials so the user will not be prompted to enter credentials each time.
When IP address is used as the authentication surrogate, this setting specifies how long the Web Proxy waits before asking the client for authentication credentials again when the client has been idle.
When this value is greater than the Surrogate Timeout value, this setting has no effect and clients are prompted for authentication after the Surrogate
Timeout is reached.
You might want to use this setting to reduce the vulnerability of users who leave their computers.
Specifies the number of entries that are stored in the authentication cache.
Set this value to safely accommodate the number of users that are actually using this device. The default value is the recommended setting.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-21
Chapter 21 Authentication
Configuring Global Authentication Settings
Table 21-9
Setting
User Session
Restrictions
Advanced
Transparent Proxy Mode Authentication Settings (continued)
Description
This setting specifies whether or not authenticated users are allowed to access the Internet from multiple IP addresses simultaneously.
You might want to restrict access to one machine to prevent users from sharing their authentication credentials with non-authorized users. When a user is prevented from logging in at a different machine, an end-user notification page appears. You can choose whether or not users can click a button to login as a different username using the Re-authentication setting on this page.
When you enable this setting, enter the restriction timeout value, which determines how long users must wait before being able to log into a machine with a different IP address. The restriction timeout value must be greater than the surrogate timeout value.
You can remove a specific user or all users from the authentication cache using the authcache
CLI command.
When using Credential Encryption or SaaS Access Control, you can choose whether the appliance uses the digital certificate and key shipped with the appliance (the Cisco IronPort Web Security Appliance Demo Certificate) or a digital certificate and key you upload here.
To upload a digital certificate and key, click Browse and navigate to the necessary file on your local machine. Then click Upload Files after you select the files you want.
For more information, see
Uploading Certificates and Keys to Use with
Credential Encryption and SaaS Access Control, page 21-26 .
shows where you configure the global authentication settings when the Web
Proxy is deployed in explicit forward mode.
21-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Figure 21-9
Configuring Global Authentication Settings
Explicit Forward Proxy Mode Authentication Settings
Step 4 If the Web Proxy is deployed in explicit forward mode, edit the settings in
.
Table 21-10 Explicit Forward Proxy Mode Authentication Settings
Setting Description
Credential Encryption This setting specifies whether or not the client sends the login credentials to
enable credential encryption, additional fields appear to configure how to redirect clients to the Web Proxy for authentication.
This setting applies to both Basic and NTLMSSP authentication schemes, but it is particularly useful for Basic authentication scheme because user credentials are sent as plain text.
HTTPS Redirect Port
For more information, see
Sending Authentication Credentials Securely, page 21-25
.
Specify a TCP port to use for redirecting requests for authenticating users over an HTTPS connection.
This specifies through which port the client will open a connection to the
Web Proxy using HTTPS. This occurs when credential encryption is enabled or when using SaaS Access Control and SaaS users are prompted to authenticate.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-23
Chapter 21 Authentication
Configuring Global Authentication Settings
Table 21-10
Options:
Credential Cache
Options:
Cache Size
Explicit Forward Proxy Mode Authentication Settings (continued)
Setting
Redirect Hostname
Credential Cache
Surrogate Timeout
Credential Cache
Options:
Client IP Idle Timeout
Description
Enter the short hostname of the network interface on which the Web Proxy listens for incoming connections.
When you enable Authentication Mode above, the Web Proxy uses this hostname in the redirection URL sent to clients for authenticating users.
You can enter either the following values:
• Single word hostname.
You can enter the single word hostname that is
DNS resolvable by the client and the Web Security appliance. This allows clients to achieve true single sign-on with Internet Explorer without additional browser side setup.
Be sure to enter the single word hostname that is DNS resolvable by the client and the Web Security appliance.
For example, if your clients are in domain mycompany.com
and the interface on which the Web Proxy is listening has a full hostname of proxy.mycompany.com
, then you should enter proxy
in this field. Clients perform a lookup on proxy
and they should be able to resolve proxy.mycompany.com
.
• Fully qualified domain name (FQDN).
You can also enter the FQDN or IP address in this field. However, if you do that and want true single sign-on for Internet Explorer and Firefox browsers, you must ensure that the FQDN or IP address is added to the client’s Trusted Sites list in the client browsers.
The default value is the FQDN of the M1 or P1 interface, depending on which interface is used for proxy traffic.
This setting specifies how long the Web Proxy waits before asking the client for authentication credentials again. Until the Web Proxy asks for credentials again, it uses the value stored in the surrogate (IP address or cookie).
Note that it is common for user agents, such as browsers, to cache the authentication credentials so the user will not be prompted to enter credentials each time.
When IP address is used as the authentication surrogate, this setting specifies how long the Web Proxy waits before asking the client for authentication credentials again when the client has been idle.
When this value is greater than the Surrogate Timeout value, this setting has no effect and clients are prompted for authentication after the Surrogate
Timeout is reached.
You might want to use this setting to reduce the vulnerability of users who leave their computers.
Specifies the number of entries that are stored in the authentication cache.
Set this value to safely accommodate the number of users that are actually using this device. The default value is the recommended setting.
21-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Sending Authentication Credentials Securely
Table 21-10
Setting
User Session
Restrictions
Advanced
Explicit Forward Proxy Mode Authentication Settings (continued)
Description
This setting specifies whether or not authenticated users are allowed to access the Internet from multiple IP addresses simultaneously.
You might want to restrict access to one machine to prevent users from sharing their authentication credentials with non-authorized users. When a user is prevented from logging at a different machine, an end-user notification page appears. You can choose whether or not users can click a button to login as a different username using the Re-authentication setting on this page.
When you enable this setting, enter the restriction timeout value, which determines how long users must wait before being able to log into a machine with a different IP address. The restriction timeout value must be greater than the surrogate timeout value.
You can remove a specific user or all users from the authentication cache using the authcache
CLI command.
When using Credential Encryption or SaaS Access Control, you can choose whether the appliance uses the digital certificate and key shipped with the appliance (the Cisco IronPort Web Security Appliance Demo Certificate) or a digital certificate and key you upload here.
To upload a digital certificate and key, click Browse and navigate to the necessary file on your local machine. Then click Upload Files after you select the files you want.
For more information, see
Uploading Certificates and Keys to Use with
Credential Encryption and SaaS Access Control, page 21-26 .
Step 5 Submit and commit your changes.
Sending Authentication Credentials Securely
When authentication is used to identify clients using the Web, the client applications send the authentication credentials to the Web Proxy, which in turn passes them to the authentication server. How the credentials are passed from the clients to the Web Proxy depends on the authentication scheme used:
•
•
NTLMSSP.
The credentials are always passed to the Web Proxy securely. They are encrypted using a key specified by the Active Directory server and sent over HTTP.
Basic.
By default, the credentials are passed to the Web Proxy insecurely. They are encoded, but not encrypted, and sent over HTTP. However, you can configure the Web Security appliance so clients send authentication credentials securely. This works for both LDAP and NTLM Basic authentication.
When you configure the appliance to use credential encryption for Basic authentication, the Web Proxy redirects the client back to the Web Proxy, but this time using an encrypted connection using HTTPS.
The client application makes either a GET or a CONNECT request depending on how the requests are forwarded to the appliance (explicitly or transparently) and how the client application is configured to forward HTTPS requests, either using the Web Proxy or not.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-25
Chapter 21 Authentication
Sending Authentication Credentials Securely
Then, using the secure HTTPS connection, the clients send the authentication credentials. The appliance uses its own certificate and private key to create an HTTPS connection with the client by default. Most browsers will warn users that the certificate is not valid. To prevent users from seeing the invalid certificate message, you can upload a certificate and key pair your organization uses. When you upload a certificate and key, the private key must be unencrypted . For information about uploading a certificate
and key, see Uploading Certificates and Keys to Use with Credential Encryption and SaaS Access
.
To configure the appliance to use credential encryption, enable the Credential Encryption setting in the global authentication settings. For more information, see
Configuring Global Authentication Settings, page 21-17
. You can also use the advancedproxyconfig > authentication CLI command. For more information, see
Advanced Proxy Configuration, page 6-21 .
Uploading Certificates and Keys to Use with Credential Encryption and SaaS
Access Control
When credential encryption is enabled or when using SaaS Access Control, the appliance uses a digital certificate to securely establish a connection with the client application. By default, the Web Security appliance uses the “Cisco IronPort Web Security Appliance Demo Certificate” that comes installed.
However, client applications are not programmed to recognize this certificate, so you can upload a digital certificate to the appliance that your applications recognize automatically.
Use the Advanced section on the Network > Authentication page to upload the certificate and key.
Note When AsyncOS for Web runs on a FIPS-compliant Web Security appliance, you must use the FIPS management console to generate or upload the root certificate and key pair. When you generate or upload certificates and keys using the FIPS management console, the keys are protected by the HSM card. For more information on using the FIPS management console, see
For more information on obtaining a certificate and private key pair to upload, see
Note Any certificate and key you upload on the Network > Authentication page is only used for establishing secure connections with clients for credential encryption and authenticating SaaS users using SaaS
Access Control. The certificate and key are not used for establishing secure HTTPS sessions when connecting to the Web Security appliance web interface. For more information on uploading a certificate and key pair for HTTPS connections to the web interface, see
Installing a Server Digital Certificate, page 27-29
.
For more information on SaaS Access Control, see Authenticating SaaS Users, page 16-2
.
Accessing HTTPS and FTP Sites with Credential Encryption Enabled
Credential encryption works because the Web Proxy redirects clients to the Web Proxy itself for authentication using an HTTPS connection. After successful authentication, the Web Proxy redirects clients back to the original website. In order to continue to identify the user, the Web Proxy must use a surrogate (either the IP address or a cookie).
21-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Allowing Users to Re-Authenticate
However, using a cookie to track users when the client accesses HTTPS sites or FTP servers using FTP over HTTP does not work.
•
•
HTTPS.
The Web Proxy must resolve the user identity before assigning a Decryption Policy (and therefore, decrypt the transaction), but it cannot obtain the cookie to identify the user unless it decrypts the transaction.
FTP over HTTP.
The dilemma with accessing FTP servers using FTP over HTTP is similar to accessing HTTPS sites. The Web Proxy must resolve the user identity before assigning an Access
Policy, but it cannot set the cookie from the FTP transaction.
Because of this, you should configure the appliance to use IP addresses as the surrogate when credential encryption is enabled.
Note Authentication does not work with HTTPS and FTP over HTTP requests when credential encryption is enabled and configured to use cookies as the surrogate type. Therefore, with this configuration setup,
HTTPS and FTP over HTTP requests only match Access Policies that do not require authentication.
Typically, they often match the global Access Policy since it never requires authentication.
Allowing Users to Re-Authenticate
AsyncOS for Web can block users from accessing different categories of websites depending on who is trying to access a website. In these cases, users successfully authenticate, but they are not authorized to access certain websites due to configured URL filtering in the applicable Access Policy. You can allow these authenticated users another opportunity to access the web if they fail authorization.
Note Only authenticated users are allowed to re-authenticate, not unauthenticated users.
filtering, the user can enter different authentication credentials that allow broader, more privileged access.
To do this, enable the “Enable Re-Authentication Prompt If End User Blocked by URL Category or User
Session Restriction” global authentication setting. The user sees a block page that includes a link that allows them to enter new authentication credentials. The Web Proxy evaluates those credentials against the authentication realms defined in the applicable Identity group, and if the new credentials allow greater access, the requested page appears in the browser. For more information, see
Authentication Settings, page 21-17
.
Note The Web Proxy evaluates the new credentials against the authentication realms defined in the applicable
Identity group only. It does not compare them against all other Identity groups.
When a more privileged user authenticates and gets access, the Web Proxy caches the privileged user identity for different amounts of time depending on the authentication surrogates configured:
• Session cookie.
The privileged user identity is used until the browser is closed or the session times out.
•
•
Persistent cookie.
The privileged user identity is used until the surrogate times out.
IP address.
The privileged user identity is used until the surrogate times out.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-27
Chapter 21 Authentication
Allowing Users to Re-Authenticate
• No surrogate.
By default, the Web Proxy requests authentication for every new connection, but when re-authentication is enabled, the Web Proxy requests authentication for every new request , so there is an increased load on the authentication server when using NTLMSSP. Most browsers will cache the privileged user credentials and authenticate without prompting the user until the browser is closed. When the Web Proxy is deployed in transparent mode, and the “Apply same surrogate settings to explicit forward requests” option is not enabled, no authentication surrogates are used for explicit forward requests.
Note To use the re-authentication feature with user defined end-user notification pages, the CGI script that parses the redirect URL must parse and use the Reauth_URL parameter. For more information, see
Defining End-User Notification Pages Off-Box, page 17-9 .
Using Re-Authentication with Internet Explorer
When you enable re-authentication and clients use Microsoft Internet Explorer, you need to verify certain settings to ensure re-authentication works properly with Internet Explorer. Due to a known issue with Internet Explorer, re-authentication does not work properly under the following circumstances:
• Internet Explorer is configured to use the Web Security appliance as a proxy.
•
•
•
The Web Security appliance uses NTLMSSP authentication.
The Web Security appliance uses cookies for authentication surrogates, but is not configured for credential encryption.
The Web Proxy is deployed in explicit forward mode, or it is deployed in transparent mode and the
“Apply same surrogate settings to explicit forward requests” option is enabled in the applicable
Identity group.
Problems occur when authentication is required to access the site, and may occur either when initially requesting the site or when re-authenticating to try to access the site.
To work around these problems, enable credential encryption on the Network > Authentication page.
Using Re-Authentication with PAC Files
When you enable re-authentication and configure client applications to use a PAC file, you may need to verify certain settings to ensure re-authentication works properly with the PAC file.
Re-authentication does not work properly under the following circumstances:
• Client browsers are configured to use a PAC file, and the PAC file is designed to bypass the Web
Proxy for internal web servers. Instead of instructing the browser to explicitly send requests to the
Web Proxy, it instructs the browser to directly send the request to the destination server.
•
•
The Web Security appliance uses IP addresses for authentication surrogates or no surrogates, and credential encryption is not enabled.
The Web Proxy is deployed in explicit forward mode, or it is deployed in transparent mode and the
“Apply same surrogate settings to explicit forward requests” option is enabled for the applicable
Identity group.
Problems occur because re-authentication requires clients to be redirected to the Web Proxy for authentication, but the PAC file bypasses all requests to internal web servers, including the Web Security appliance.
21-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Tracking Authenticated Users
To work around these problems, edit the PAC file so that the function FindProxyForURL() returns
“PROXY x.x.x.x:80” when the host IP address is x.x.x.x. The port number you specify in the return should the same port configured for other destinations.
Note If the Web Security appliance uses cookies for authentication surrogates, Cisco recommends enabling credential encryption. For more information, see
Using Re-Authentication with Internet Explorer, page 21-28
.
Tracking Authenticated Users
Table 21-11 describes which authentication surrogates are supported with other configurations and
different types of requests (explicitly forwarded and transparently redirected).
Table 21-11 Supported Authentication Surrogates
Surrogate
Types
Credential
Encryption:
Explicit Requests
Protocol:
No Surrogate
IP-based
Cookie-based
Disabled
HTTP
Yes
Yes
Yes
HTTPS &
FTP over
HTTP
Yes
Yes
Yes***
Transparent Requests
Enabled
HTTP
NA
Yes
Yes
Disabled Enabled
HTTPS &
FTP over
HTTP
NA
Yes
HTTP HTTPS
NA
Yes
No/Yes** Yes
NA
No/Yes*
HTTP
NA
Yes
No/Yes** Yes
HTTPS
NA
No/Yes*
No/Yes**
* Works after the client makes a request to an HTTP site and is authenticated, or when the client makes a request to an HTTPS site and the HTTPS Proxy is configured to decrypt the first HTTPS request for authentication purposes. When the HTTPS Proxy is configured to deny the first HTTPS request, all requests to HTTPS sites before authentication happens for a previous request are dropped.
** When cookie-based authentication is used, the Web Proxy cannot authenticate the user for HTTPS and FTP over HTTP transactions. Due to this limitation, all HTTPS and FTP over HTTP requests bypass authentication, so authentication is not requested at all. For more information on how HTTPS requests are assigned Identity and non-Identity policy groups, see
Understanding How Authentication Affects
HTTPS and FTP over HTTP Requests, page 9-4 .
*** No surrogate is used in this case even though cookie-based surrogate is configured.
Bypassing Authentication
Some client applications, such as some instant messaging applications or applets, and servers do not handle authentication well. For example, some clients do not handle NTLMSSP at all, while others might not strictly follow the authentication standard. When the Web Proxy processes transactions between these applications or servers, authentication might fail.
You can work around these limitations by bypassing authentication for the affected clients and servers.
To bypass authentication for some client applications and websites:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-29
Chapter 21 Authentication
LDAP Authentication
Step 1
Step 2
Step 3
Step 4
Step 5
Create a custom URL category that contains the affected websites by configuring the Advanced properties.
Create an Identity group that only applies to the affected client applications and the custom URL category created in
Place the Identity before all other Identities that require authentication.
Configure the Identity so it does not require authentication.
Use the Identity in other policy groups as needed.
LDAP Authentication
The Lightweight Directory Access Protocol (LDAP) server database is a repository for employee directories. These directories include the names of employees along with various types of personal data such as a phone number, email address, and other information that is exclusive to the individual employee. The LDAP database is composed of objects containing attributes and values. Each object name is referred to as a distinguished name (DN). The location on the LDAP server where a search begins is called the Base Distinguished Name or base DN.
The appliance supports standard LDAP server authentication and Secure LDAP authentication. Support for LDAP allows established installations to continue using their LDAP server database to authenticate users.
For Secure LDAP, the appliance supports LDAP connections over SSL. The SSL protocol is an industry standard for ensuring confidentiality. SSL uses key encryption algorithms along with Certificate
Authority (CA) signed certificates to provide the LDAP servers a way to verify the identity of the appliance.
Note AsyncOS for Web only supports 7-bit ASCII characters for passwords when using the Basic authentication scheme. Basic authentication fails when the password contains characters that are not
7-bit ASCII.
Changing Active Directory Passwords
After Active Directory LDAP users change their account passwords, the Active Directory LDAP server authenticates them with their current or previous password, depending on the Active Directory server configuration.
If you want users to only be able to authenticate with their new password, you can reboot the Active
Directory server or, you can wait for the Active Directory server to time out the old passwords.
21-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
LDAP Authentication
LDAP Authentication Settings
Table 21-12 describes the authentication settings you define when you choose LDAP authentication.
Table 21-12 LDAP Authentication Settings
Setting
LDAP Version
LDAP Server
Description
Choose the version of LDAP, and choose whether or not to use Secure LDAP.
The appliance supports LDAP version 2, and LDAP version 3 software. Secure
LDAP requires LDAP version 3.
Choose whether or not this LDAP server support Novell eDirectory to use with transparent user identification. For more information, see
.
Enter the LDAP server IP address or hostname and its port number. You can specify up to three servers.
The hostname must be a fully-qualified domain name. For example, ldap.example.com
. An IP address is required only if the DNS servers configured on the appliance cannot resolve the LDAP server hostname.
The default port number for Standard LDAP is 389. The default number for
Secure LDAP is 636.
If the LDAP server is an Active Directory server, enter the hostname or IP address and the port of the domain controller here. Whenever possible, enter the name of the Global Catalog Server and use port 3268. However, you might want to use a local domain controller when the global catalog server is physically far away and you know you only need to authenticate users on the local domain controller.
Note: When you configure multiple authentication servers in the realm, the appliance attempts to authorize with up to three authentication servers before failing to authenticate the transaction within that realm.
LDAP Persistent
Connections
(under the Advanced section)
Choose one of the following values:
•
•
Use persistent connections (unlimited) . Use existing connections. If no connections are available a new connection is opened.
Use persistent connections.
Use existing connections to service the number of requests specified. When the maximum is reached, establish a new connection to the LDAP server.
• Do not use persistent connections.
Always create a new connection to the
LDAP server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-31
LDAP Authentication
Chapter 21 Authentication
Table 21-12 LDAP Authentication Settings (continued)
Setting Description
User Authentication Enter values for the following fields:
Base Distinguished Name (Base DN)
The LDAP database is a tree-type directory structure and the appliance uses the
Base DN to navigate to the correct location in the LDAP directory tree to begin a search. A valid Base DN filter string is composed of one or more components of the form object-value.
For example dc=companyname, dc=com
.
User Name Attribute
Choose one of the following values:
•
• uid , cn , and sAMAccountName.
Unique identifiers in the LDAP directory that specify a username.
custom.
A custom identifier such as
UserAccount
.
Query Credentials
User Filter Query
The User Filter Query is an LDAP search filter that locates the users Base DN.
This is required if the user directory is in a hierarchy below the Base DN, or if the login name is not included in the user-specific component of that users Base
DN.
Choose one of the following values:
• none.
Filters any user.
• custom.
Filters a particular group of users.
Choose whether or not the authentication server accepts anonymous queries.
If the authentication server does accept anonymous queries, choose Server
Accepts Anonymous Queries.
If the authentication server does not accept anonymous queries, choose Use
Bind DN and then enter the following information:
• Bind DN.
The user on the external LDAP server permitted to search the
LDAP directory. Typically, the bind DN should be permitted to search the entire directory.
• Password.
The password associated with the user you enter in the Bind DN field.
The following text lists some example users for the Bind DN field: cn=administrator,cn=Users,dc=domain,dc=com sAMAccountName=jdoe,cn=Users,dc=domain,dc=com.
If the Active Directory server is used as an LDAP server, you may also enter the Bind DN username as “DOMAIN\username.”
Group Authorization Choose whether or not to enable LDAP group authorization. When you enable
LDAP group authorization, you can group users by group object or user object.
For more information on configuring this section, see
.
21-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
LDAP Authentication
LDAP Group Authorization
You can use the user group membership information stored in an LDAP directory to apply a policy group to a group of users. To do this, enable group authorization in an LDAP authentication realm and group users by one of the following LDAP object types:
• Group object.
Sometimes, group membership information is stored in the group object, which has an attribute (such as “member”) to list all users that belong to the group. Define authorized users by group object when the group object contains all users you need to define. For more information on how to define authorized users by group object, see
• User object.
Sometimes, group membership information is stored in the user object, which has an attribute (such as “memberOf”) that lists all groups to which a user belongs. You might want to define authorized users by user object when the authentication server does not store the member information in the group object or if it does not have a group object. For more information on how to define authorized users by user object, see
Note The user object must not contain any special character.
When you configure group authorization in an LDAP authentication realm, be sure you uniquely identify a group object in the LDAP server. If the search for a group DN returns multiple entries, the Web Security appliance only uses the first entry returned. You uniquely identify a group object using the following fields:
• Base DN
•
•
Attribute that contains the group name
Query string to determine if object is a group
When you create an LDAP authentication realm with user object based group authorization against an
Active Directory server, the user object does not contain the primary group that the user is a member of, for example “Domain Users.” It only contains the other defined groups. Therefore, policy groups might not match these users under the following conditions:
• An Identity policy group specifies an LDAP realm with user attribute based group authentication.
• A non-Identity policy group uses the Identity policy group and the primary group is configured as an authorized group in the Active Directory server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-33
LDAP Authentication
Chapter 21 Authentication
describes the group object settings.
Table 21-13 LDAP Group Authorization—Group Object Settings
Group Object Setting Description
Group Membership
Attribute Within
Group Object
Choose the LDAP attribute which lists all users that belong to this group.
Choose one of the following values:
Attribute that
Contains the Group
Name
• member and uniquemember.
Unique identifiers in the LDAP directory that specify group members.
custom.
A custom identifier such as
UserInGroup
.
•
Choose the LDAP attribute which specifies the group name that can be used in the policy group configuration.
Choose one of the following values:
• cn.
A unique identifier in the LDAP directory that specifies the name of a group.
Query String to
Determine if Object is a Group
• custom.
A custom identifier such as FinanceGroup .
Choose an LDAP search filter that determines if an
LDAP object represents a user group.
Choose one of the following values:
• objectclass=groupofnames
•
• objectclass=groupofuniquenames objectclass=group
• custom.
A custom filter such as objectclass=person
.
Note: The query defines the set of authentication groups which can be used in policy groups.
describes the user object settings.
Table 21-14 LDAP Group Authorization—User Object Settings
User Object Setting
Group Membership
Attribute Within User
Object
Group Membership
Attribute is a DN
Description
Choose the attribute which list all the groups that this user belongs to.
Choose one of the following values:
• memberOf.
Unique identifiers in the LDAP directory that specify user members.
custom.
A custom identifier such as
UserInGroup
.
•
Specify whether the group membership attribute is a distinguished name
(DN) which refers to an LDAP object. For Active Directory servers, enable this option.
When this is enabled, you must configure the subsequent settings.
21-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
NTLM Authentication
Table 21-14 LDAP Group Authorization—User Object Settings (continued)
User Object Setting
Attribute that Contains the Group Name
Description
When the group membership attribute is a DN, this specifies the attribute that can be used as group name in policy group configurations.
Query String to
Determine if Object is a Group
Choose one of the following values:
• cn.
A unique identifier in the LDAP directory that specifies the name of a group.
• custom.
A custom identifier such as
FinanceGroup
.
Choose an LDAP search filter that determines if an LDAP object represents a user group.
Choose one of the following values:
•
•
•
• objectclass=groupofnames objectclass=groupofuniquenames objectclass=group custom.
A custom filter such as objectclass=person
.
Note: The query defines the set of authentication groups which can be used in Web Security Manager policies.
NTLM Authentication
The NT Lan Manager (NTLM) authenticates users with an encrypted challenge-response sequence that occurs between the appliance and a Microsoft Windows domain controller. The NTLM challenge-response handshake occurs when a web browser attempts to connect to the appliance and before data is delivered.
When you configure an NTLM authentication realm, you do not specify the authentication scheme.
Instead, you choose the scheme at the Access Policy group level when you configure the policy member definition. This allows you to choose different schemes for different policy groups. When you create or edit the policy group, you can choose one of the following schemes:
• Use NTLMSSP
•
•
Use Basic or NTLMSSP
Use Basic
Note AsyncOS for Web only supports 7-bit ASCII characters for passwords when using the Basic authentication scheme. Basic authentication fails when the password contains characters that are not
7-bit ASCII.
Working with Multiple Active Directory Domains
AsyncOS allows you to create only one NTLM authentication realm. If your organization has multiple
Active Directory domains, you can authenticate users in all domains if the following conditions exist:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-35
Chapter 21 Authentication
NTLM Authentication
• When all Active Directory domains exist in the same forest, there must be a trust relationship among all domains in the forest.
• When an Active Directory domain exists in a different forest, the domain that the WSA joins must have at least a one way trust with the domain where the users belong.
When you define policy group membership by group name, the web interface only displays Active
Directory groups in the domain where AsyncOS created a computer account when joining the domain.
To create a policy group for users in a different domain, manually enter the domain and group name in the web interface.
NTLM Authentication Settings
describes the authentication settings you define when you choose NTLM authentication.
Table 21-15 NTLM Authentication Settings
Setting
Active Directory
Server
Active Directory
Account
Join Domain button
(Active Directory
User)
Description
Enter the Active Directory server IP address or hostname. You can specify up to three servers.
The hostname must be a fully-qualified domain name. For example, ntlm.example.com
. An IP address is required only if the DNS servers configured on the appliance cannot resolve the Active Directory server hostname.
Note: When multiple authentication servers are configured in the realm, the appliance attempts to authorize with up to three authentication servers before failing to authorize the transaction within this realm.
Enter the following Active Directory account information:
•
•
Active Directory server domain name.
NetBIOS domain name. You only need to enter the NetBIOS domain name if the network uses NetBIOS. This field only appears when the NTLM security mode is set to “domain” using the setntlmsecuritymode
CLI command.
• Computer account location.
Note: You must click Join Domain to enter an Active Directory username and password.
For more information about entering the Active Directory account information,
see Joining the Active Directory Domain, page 21-37 .
When you click Join Domain , enter the name and password for the Active
Directory user.
If the appliance and the Active Directory server are in the same domain, any valid user that is a member of User Domain is allowed.
However, depending on the Active Directory server configuration, this user might need Domain Admin Group or Enterprise Admin Group credentials. For example:
•
•
If the appliance and the Active Directory server are not in the same domain, the Active Directory user must be a member of the Domain Admin Group.
If the Active Directory server configuration is a forest, the Active Directory user must be a member of the Enterprise Admin Group.
21-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
NTLM Authentication
Table 21-15 NTLM Authentication Settings (continued)
Setting
Active Directory
Agent
Network Security
Description
Choose whether or not to identify users transparently without prompting users.
When you enable transparent user identification, you must install the Cisco
Active Directory agent on at least one computer that can access the Active
Directory server. Enter the server name for the machine where the primary
Active Directory agent is installed and the shared secret used to access it.
Optionally, enter the server name for the machine where a backup Active
Directory agent is installed and its shared secret.
For more information, see
Identifying Users Transparently, page 9-10 .
Configure whether or not the Active Directory server is configured to require signing. When you enable this check box, the appliance uses Transport Layer
Security (TLS) when communicating with the Active Directory server.
Joining the Active Directory Domain
When you configure an NTLM realm, you must enter information to join the Active Directory domain to set up a computer account in the domain. An Active Directory computer account is an account that uniquely identifies the computer on the domain. It is also referred to as a machine trust account.
After you enter the Active Directory account information in the authentication realm, click the Join
Domain button to set up a computer account. Use the Location field to define the organizational directory where AsyncOS should create the computer account in the Active Directory domain.
shows where you join an Active Directory domain.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-37
NTLM Authentication
Figure 21-10 Joining an Active Directory Domain
Chapter 21 Authentication
Status tells you whether or not AsyncOS has created the computer account.
Click to join the Active
Directory domain.
When you click Join Domain , you are prompted to enter login credentials for the Active Directory server. The login information is used only to create the Active Directory computer account and is not saved. Enter the login information and click Create Account .
Note You must enter the sAMAccountName user name for the Active Directory user. Also, verify that users enter their sAMAccountName user name when they log in to their computers.
Once an account is created, the status of the account creation is displayed below the Join Domain button.
If the account creation fails, the status and reason for error is displayed.
Also, when you view all realms on the Network > Authentication page, the appliance displays warning text in red saying that the domain was not joined for any realm that did not create a computer account.
Red text indicates that the domain was not joined and no computer account was created.
21-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Supported Authentication Characters
AsyncOS only creates an Active Directory computer account when you edit the authentication realm
Active Directory information or when the appliance reboots.
Note To successfully join the Active Directory domain, the time difference between the Web Security appliance and the Active Directory server should be less than the time specified in the “Maximum tolerance for computer clock synchronization” option on the Active Directory server. When you use
Network Time Protocol (NTP) to specify the current time on the Web Security appliance, remember that the default time server is time.ironport.com. This may affect the time difference between the appliance and the Active Directory server.
Some Active Directory environments automatically delete computer objects at particular intervals for accounts that appear in active in order to clean up old computer objects. However, AsyncOS does not automatically change the password for the computer account it creates in an Active Directory server, so the computer account may appear inactive over time. Therefore, if the Active Directory environment automatically deletes computer objects at particular intervals, make sure the Web Security appliance computer account is created in a container that is exempt from this cleanup process.
Supported Authentication Characters
This section lists the characters the Web Security appliance supports when it communicates with LDAP and Active Directory servers. For authentication to work properly, verify that your authentication servers only use the supported characters listed in this section.
For example, according to Table 21-16
, the appliance can validate users with the following Active
Directory user name: jsmith#123
And according to
Table 21-16 , the appliance cannot validate users with the following Active Directory
user name: jsmith+
Active Directory Server Supported Characters
Directory servers.
Table 21-16 Supported Active Directory Server Characters — User Name Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } ' . @ space
Characters Not Supported
/ \ [ ] : ; | = , + * ? < > "
Note The Web Security appliance supports the percent ( % ) character for end users browsing the web.
However, you cannot use a user name with the percent ( %) character to join the Active Directory domain when you create an NTLM authentication realm.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-39
Chapter 21 Authentication
Supported Authentication Characters
lists the characters the Web Security appliance supports for the Password field for Active
Directory servers.
Table 21-17 Supported Active Directory Server Characters — Password Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ ^ & ( ) _ - { } ' . / [ ] : | * ? @ + \ , ; " = < > space
Characters Not Supported
N/A
lists the characters the Web Security appliance supports for the Location field for Active
Directory servers. You enter the location string in the Location field when you configure an NTLM authentication realm.
Table 21-18 Supported Active Directory Server Characters — Location Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ ^ & ( ) _ - { } ' . / [ ] : | * ? @ space
Characters Not Supported
+ \ , ; " = < >
Note The appliance does not support these characters even when they are escaped with a backslash ( \ ) character.
lists the characters the Web Security appliance supports for the Group field for Active
Directory servers.
Table 21-19 Supported Active Directory Server Characters — Group Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } ' . @ space
Characters Not Supported
/ \ [ ] : ; | = , + * ? < > "
Note You can only use the backslash ( \ ) character as a separator between the domain name and a user or group name, or as a separator between organizational units (OU) in the location string for an Active Directory server. You cannot use it as part of a domain name, user name, group name, or location name.
21-40
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Supported Authentication Characters
LDAP Server Supported Characters
servers.
Table 21-20 Supported LDAP Server Characters — User Name Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } ' . @
Characters Not Supported
/ \ [ ] : ; | = , + * ? < > "
Note The appliance only supports the ‘(’ and ‘)’ characters when they are escaped with a backslash (
\ ) character.
Table 21-21 lists the characters the Web Security appliance supports for the Password field for LDAP
servers.
Table 21-21 Supported LDAP Server Characters — Password Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } @ ' . / \ [ ] : | = * ? < > " , ; + space
Characters Not Supported
N/A
Table 21-22 lists the characters the Web Security appliance supports for the Group field for LDAP
servers.
Table 21-22 Supported LDAP Server Characters — Group Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } @ ' . / \ [ ] : | = * ? < > " space
Characters Not Supported
, ; +
Note The appliance only supports the ‘(’ and ‘)’ characters when they are escaped with a backslash ( \ ) character.
Field field for LDAP servers.
Table 21-23 Supported LDAP Server Characters — Custom User Filter Query Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } ' .
space
Characters Not Supported
@ / \ [ ] : | = * ? < > " , ; +
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-41
Chapter 21 Authentication
Supported Authentication Characters
lists the characters the Web Security appliance supports for the Custom Group Filter Query
Field field for LDAP servers.
Table 21-24 Supported LDAP Server Characters — Custom Group Filter Query Field
Supported Characters
A...Z a...z
0 1 2 3 4 5 6 7 8 9
` ~ ! # $ % ^ & ( ) _ - { } @ ' . / \ [ ] : | = * ? < > " space
Characters Not Supported
, ; +
21-42
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Supported Authentication Characters
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-43
Supported Authentication Characters
Chapter 21 Authentication
21-44
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 21 Authentication
Supported Authentication Characters
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
21-45
Supported Authentication Characters
Chapter 21 Authentication
21-46
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
22
L4 Traffic Monitor
This chapter contains the following information:
•
About L4 Traffic Monitor, page 22-1
•
•
•
Understanding How the L4 Traffic Monitor Works, page 22-1
Configuring the L4 Traffic Monitor, page 22-2
Viewing L4 Traffic Monitor Activity, page 22-6
About L4 Traffic Monitor
The Web Security appliance has an integrated Layer-4 Traffic Monitor that detects rogue traffic across all network ports and stops malware attempts to bypass port 80. Additionally, when internal clients are infected with malware and attempt to phone-home across non-standard ports and protocols, the L4
Traffic Monitor prevents phone-home activity from going outside the corporate network.
Understanding How the L4 Traffic Monitor Works
The L4 Traffic Monitor listens to network traffic that comes in over all ports on the appliance and matches domain names, and IP addresses against entries in its own database tables to determine whether to allow incoming and outgoing traffic.
All web destinations fall under one of the following categories:
•
•
Known allowed address.
Any IP address or hostname listed in the Allow List property. These addresses appear in the log files as “whitelist” addresses.
Unlisted address.
Any IP address that is not known to be a malware site nor is a known allowed address. They are not listed on the Allow List or Additional Suspected Malware Addresses properties, nor are they listed in the L4 Traffic Monitor Database as a known malware site. These addresses do not appear in the log files.
• Ambiguous address.
These addresses appear in the log files as “greylist” addresses. They include any of the following addresses:
– Any IP address that is associated with both an unlisted hostname and a known malware hostname .
– Any IP address that is associated with both an unlisted hostname and a hostname from the
Additional Suspected Malware Addresses property.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
22-1
Chapter 22 L4 Traffic Monitor
Configuring the L4 Traffic Monitor
• Known malware address.
These addresses appear in the log files as “blacklist” addresses. They include any of the following addresses:
–
–
Any IP address or hostname that the L4 Traffic Monitor Database determines to be a known malware site and not listed in the Allow List.
Any IP address that is listed in the Additional Suspected Malware Addresses property and not listed in the Allow List and not determined to be ambiguous.
Note You can define the Allow List and the Additional Suspected Malware Addresses properties on the Web
Security Manager > L4 Traffic Monitor Policies page.
The L4 Traffic Monitor listens to and monitors network ports for rogue activity. It performs one of the following actions on all traffic on your network:
•
•
Allow.
It always allows traffic to and from known allowed and unlisted addresses.
Monitor.
It monitors traffic under the following circumstances:
– When the Action for Suspected Malware Addresses option is set to Monitor, it always monitors all traffic that is not to or from a known allowed address.
•
– When the Action for Suspected Malware Addresses option is set to Block, it monitors traffic to and from ambiguous addresses.
Block.
When the Action for Suspected Malware Addresses option is set to Block, it blocks traffic to and from known malware addresses.
The L4 Traffic Monitor Database
The L4 Traffic Monitor uses and maintains its own internal database. This database is continuously updated with matched results for IP addresses and domain names. Additionally, the database table receives periodic updates from the Cisco IronPort update server at the following location: https://update-manifests.ironport.com
For information about update intervals and the Cisco IronPort update server, see
Security Service Components, page 27-41 .
Configuring the L4 Traffic Monitor
The L4 Traffic Monitor can be enabled as part of an initial system setup using the System Setup Wizard.
By default, the L4 Traffic Monitor is enabled and set to monitor traffic on all ports. This includes DNS and other services.
Note To monitor true client IP addresses, the L4 Traffic Monitor should always be configured inside the firewall and before network address translation (NAT). For more information about deploying the L4
Traffic Monitor, see
Deploying the L4 Traffic Monitor, page 3-11 .
You can configure the following settings:
22-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 22 L4 Traffic Monitor
Configuring the L4 Traffic Monitor
•
•
Global L4 Traffic Monitor settings.
You can enable or disable the L4 Traffic Monitor after an initial configuration and configure which TCP ports to monitor. Use the Security Services > L4
Traffic Monitor page. For more information see
Configuring L4 Traffic Monitor Global Settings, page 22-3
.
L4 Traffic Monitor policies.
When the L4 Traffic Monitor is enabled, you configure specific policies for managing traffic. Use the Web Security Manager > L4 Traffic Monitor Policies page.
For more information see
Configuring L4 Traffic Monitor Policies, page 22-4 .
Configuring L4 Traffic Monitor Global Settings
On the Security Services > L4 Traffic Monitor page, you can configure the L4 Traffic Monitor global settings and update the L4 Traffic Monitor anti-malware rules.
Figure 22-1 Security Services > L4 Traffic Monitor Page
To configure L4 Traffic Monitor global settings:
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to the Security Services > L4 Traffic Monitor page.
Click Edit Global Settings .
Choose whether or not to enable the L4 Traffic Monitor.
When you enable the L4 Traffic Monitor, choose which ports it should monitor:
• All ports.
Monitors all 65535 TCP ports for rogue activity.
• All ports except proxy ports.
Monitors all TCP ports except the following ports for rogue activity.
– Ports configured in the “HTTP Ports to Proxy” property on the Security Services > Web Proxy page (usually port 80).
– Ports configured in the “Transparent HTTPS Ports to Proxy” property on the Security Services
> HTTPS Proxy page (usually port 443).
Submit and commit the changes.
Updating L4 Traffic Monitor Anti-Malware Rules
To update the L4 Traffic Monitor anti-malware rules:
Step 1
Step 2
Navigate to the Security Services > L4 Traffic Monitor page.
Click Update Now .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
22-3
Chapter 22 L4 Traffic Monitor
Configuring the L4 Traffic Monitor
The Web Security appliance contacts the component update server and updates the L4 Traffic Monitor
anti-malware rules. For more information about the component update server, see Manually Updating
Security Service Components, page 27-41 .
Configuring L4 Traffic Monitor Policies
When the L4 Traffic Monitor is enabled, you can configure how it should manage traffic over the configured TCP ports. It can perform the following actions on traffic over the TCP ports:
• Allow
•
•
Monitor
Block
For more information about how the L4 Traffic Monitor handles traffic, see
Traffic Monitor Works, page 22-1 .
The actions the L4 Traffic Monitor takes depends on the L4 Traffic Monitor policies you configure.
To configure L4 Traffic Monitor policies:
Step 1
Step 2
Step 3
Navigate to the Web Security Manager > L4 Traffic Monitor page.
Click Edit Settings .
On the Edit L4 Traffic Monitor Policies page, configure the L4 Traffic Monitor policies described in
Table 22-1 L4 Traffic Monitor Policies
Property
Allow List
Description
Enter zero or more address to which the L4 Traffic Monitor should always allow clients to connect.
Separate multiple entries with a space or comma. For a list of valid address formats you can use, see
Note Entering a domain name such as example.com also matches www.example.com and hostname.example.com.
Connections to all destinations in this list are always allowed and the traffic is not logged. The appliance does not check the destinations against the L4 Traffic
Monitor anti-malware rules or the additional suspected malware addresses listed on the same page.
For example, if IP address 10.1.1.1 appears in both the Allow List and the
Additional Suspected Malware Addresses fields, then the L4 Traffic Monitor always allows requests for 10.1.1.1.
Note Do not include the Web Security appliance IP address or hostname to the
Allow List otherwise the L4 Traffic Monitor does not block any traffic.
22-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 22 L4 Traffic Monitor
Configuring the L4 Traffic Monitor
Table 22-1 L4 Traffic Monitor Policies (continued)
Property
Actions for
Suspected Malware
Addresses
Description
Choose whether to monitor or block traffic destined for a known malware address. For a definition of known malware address, see
L4 Traffic Monitor Works, page 22-1
.
•
•
Monitor.
Scans all traffic for domains and IP addresses that match entries in the L4 Traffic Monitor database. The Monitor option does not block suspicious traffic. This setting is useful for identifying infected clients without affecting the user experience.
Block.
Scans all traffic for domains and IP addresses that match entries in the appliance administrative lists and the block list database and then blocks any traffic it finds. This setting is useful for identifying infected clients and stopping malware attempts through non-standard ports.
When you choose to block suspected malware traffic, you can also choose whether or not to always block ambiguous addresses. By default, ambiguous addresses are monitored.
For a definition of ambiguous address, see
Understanding How the L4 Traffic
.
Additional
Suspected Malware
Addresses
(optional)
Enter zero or more known addresses that the L4 Traffic Monitor should consider
as a possible malware. For a list of valid address formats you can use, see Valid
If you choose to block suspected malware addresses, the L4 Traffic Monitor will either block or monitor these addresses depending on whether it determines them to be known malware addresses or ambiguous addresses. For definitions of ambiguous and known malware addresses, see
Understanding How the L4 Traffic
.
If you choose to monitor suspected malware addresses, it will monitor these addresses.
Note Adding internal IP addresses to the Additional Suspected Malware
Addresses list causes legitimate destination URLs to show up as malware in L4 Traffic Monitor reports. To avoid this type of erroneous reporting, do not enter internal IP addresses in the “Additional Suspected Malware
Addresses” field on the Web Security Manager > L4 Traffic Monitor
Policies page.
Note If the L4 Traffic Monitor is configured to block, the L4 Traffic Monitor and the Web Proxy must be configured on the same network. Use the Network > Routes page to confirm that all clients are accessible on routes that are configured for data traffic.
Step 4 Submit and commit your changes.
Valid Formats
When you add addresses to the Allow List or Additional Suspected Malware Addresses properties, separate multiple entries with whitespace or commas. You can enter addresses in any of the following formats:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
22-5
Chapter 22 L4 Traffic Monitor
Viewing L4 Traffic Monitor Activity
•
•
•
•
IP address.
For example, 10.1.1.0.
CIDR address.
For example, 10.1.1.0/24.
Domain name.
For example, example.com. Entering a domain name such as example.com will also match www.example.com and hostname.example.com.
Hostname.
For example, crm.example.com.
Viewing L4 Traffic Monitor Activity
The S-Series appliance supports several options for generating feature specific reports and interactive displays of summary statistics.
Monitoring Activity and Viewing Summary Statistics
The Reporting > L4 Traffic Monitor page provides statistical summaries of monitoring activity. You can interactively update these displays by specifying a time range of hour, day, week or month. Additionally, you have the option to print these display pages and export the raw data to a file.
You can use the following displays and reporting tools to view the results of L4 Traffic Monitor activity:
Table 22-2 L4 Traffic Monitor Scanning Data
To view...
Client statistics
Malware statistics
Port statistics
L4 Traffic Monitor log files
See...
Reporting > Client Activity
Reporting > L4 Traffic Monitor
System Administration > Log Subscriptions
•
• trafmon_errlogs trafmonlogs
Note If the Web Proxy is configured as a forward proxy and L4 Traffic Monitor is set to monitor all ports, the
IP address of the proxy’s data port is recorded and displayed as a client IP address in the client activity report on the Reporting > Client Activity page. If the Web Proxy is configured as a transparent proxy, enable IP spoofing to correctly record and display the client IP addresses.
L4 Traffic Monitor Log File Entries
The L4 Traffic Monitor log file provides a detailed record of monitoring activity. For more information about the L4 Traffic Monitor log, see
Traffic Monitor Log, page 25-38 .
22-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 22 L4 Traffic Monitor
Viewing L4 Traffic Monitor Activity
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
22-7
Viewing L4 Traffic Monitor Activity
Chapter 22 L4 Traffic Monitor
22-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
23
Reporting
This chapter contains the following information:
•
•
•
•
•
•
•
Using the Reporting Tab, page 23-2
Enabling Centralized Reporting, page 23-8
Reporting Overview
Reporting functionality aggregates information from individual security features and records data that can be used to monitor your web traffic patterns and security risks. You can run reports in real-time to view an interactive display of system activity over a specific period of time, or you can schedule reports and run them at regular intervals.
The Web Security appliance not only generates high-level reports, allowing you to understand what is happening on the network, but it also allows you to drill down and see traffic details for a particular domain, user, or category.
Reporting functionality also allows you to export raw data to a file. For more information see,
Printing and Exporting Reports from Report Pages, page 23-7 .
Working with Usernames in Reports
When you enable authentication, reports list users by their usernames when they authenticate with the
Web Proxy. By default, usernames are written as they appear in the authentication server, such as jsmith.
However, you can choose to make usernames unrecognizable in all reports.
Note Administrators always see usernames in reports.
To make usernames unrecognizable in reports:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-1
Using the Reporting Tab
Step 1 Navigate to the Security Services > Reporting page, and click Edit Settings .
Chapter 23 Reporting
Step 2
Step 3
Under Local Reporting, select Anonymize usernames in reports .
Submit and commit your changes.
Report Pages
The Web Security appliance offers the following reports:
• Overview
•
•
•
•
•
•
•
•
•
•
•
•
Users
Web Sites
URL Categories
Application Visibility
Anti-Malware
Client Malware Risk
Web Reputation Filters
L4 Traffic Monitor
Reports by User Location
Web Tracking
System Capacity
System Status
For detailed descriptions of each of these reports, see
Web Security Appliance Reports, page 24-1
.
Using the Reporting Tab
The Reporting tab provides several options for viewing system data. This section describes those options and explains the information displayed on each report page.
The report pages provide a colorful overview of system activity and support multiple options for viewing system data. For example, you can update and sort data to provide real-time visibility into resource utilization and web traffic activity. You can also search each page for website and client-specific data.
You can perform the following tasks on most reports on the Reporting tab:
• Change the time range displayed in a report.
For more information, see
•
•
Search for specific clients and domains.
For more information, see
.
Choose which data to display in charts. See
Choosing Which Data to Chart, page 23-4 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-2
Chapter 23 Reporting
Using the Reporting Tab
•
•
Choose and sort columns.
For more information, see
Working with Columns on Report Pages, page 23-4
.
Export reports to external files.
For more information, see
Printing and Exporting Reports from
.
Changing the Time Range
You can update the data displayed for each security component using the Time Range field. This option allows you to generate updates for predefined time ranges, such as the last hour or week, and it allows you to define custom time ranges from a specific start time to a specific end time.
Note The time range you select is used throughout all of the report pages until you select a different value in the Time Range menu.
Figure 23-1 shows the Time Range field for the URL Categories report.
Figure 23-1 Selecting Data Time Range
You can choose any of the time ranges described in
Table 23-1 Configurable Time Ranges
Time Range
Hour
Data is returned in...
Sixty (60) complete minutes plus up to 5 additional minutes.
Day One hour intervals for the last 24 hours and including the current partial hour.
Week One day intervals for the last 7 days plus the current partial day.
Month (30 days) One day intervals for the last 30 days plus the current partial day.
Yesterday
Custom Range
The last 24 hours (00:00 to 23:59) using the Web Security appliance defined time zone.
The custom time range defined by the user.
When you choose Custom Range, a dialog box appears where you can enter the start and end times.
Note All reports display date and time information based on the systems configured time zone, shown as a
Greenwich Mean Time (GMT) offset. However, data exports display the time in GMT to accommodate multiple systems in multiple time zones around the world.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-3
Chapter 23 Reporting
Using the Reporting Tab
Searching Data
Some reports include a field that allow you to search for a particular data points. For example, on the
URL Categories report, you can search for a particular URL category, and on the Users report, you can search for a particular user by user name or IP address. When you search for data, the report refines the report data for the particular data set you are searching.
You can search for values that exactly match of the string you enter, or for values that start with the string you enter.
The following report pages include search fields:
• Users.
Search for a user by user name or client IP address.
•
•
•
•
Web Sites.
Search for a server by domain or server IP address.
URL Categories.
Search for a URL category.
Application Visibility.
Search for an application name that the AVC engine monitors and blocks.
Client Malware Risk.
Search for a user by user name or client IP address.
Note You need to configure authentication to view client user IDs as well as client IP addresses.
shows the search field for the URL Categories report.
Figure 23-2 Searching for URL Categories
Choosing Which Data to Chart
The default charts on each Web Reporting page display commonly-referenced data, but you can choose to chart different data instead. If a page has multiple charts, you can change each chart.
Generally, the chart options are the same as the columns headings of the table(s) in the report. For explanations of these headings, see
Working with Columns on Report Pages, page 23-4
.
Charts reflect all available data in a table column, regardless of the number of items (rows) you choose to display in the associated table.
To choose the data to chart:
Step 1
Step 2
Step 3
Click the Chart Options link below a chart.
Choose the data to display.
Click Done .
Working with Columns on Report Pages
Each page has interactive column headings that can be configured to sort the data in each column specific to your needs for viewing data on that page.
23-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
Using the Reporting Tab
Note Not every column is available for every report page. Click the Columns link for each report page to view the available columns.
describes the columns available when working with reports.
Table 23-2 Report Column Descriptions
Column Name
Domain or Realm
User ID or Client IP
Bandwidth Used
Bandwidth Saved by
Blocking
Time Spent
Description
The domain or realm of the user displayed in text format.
The username or client IP address of the user displayed in text format.
The amount of bandwidth that is used by a particular user or action.
Bandwidth units are displayed in Bytes or percentage.
The amount of bandwidth that has been saved due to blocking certain transactions. Bandwidth units are displayed in Bytes
The amount of time spent on a web page. For purposes of investigating a user, the time spent by the user on each URL category. When tracking a
URL, the time spent by each user on that specific URL.
To calculate the time spent, AsyncOS assigns each active user with 60 seconds of time for activity during a minute. At the end of the minute, the time spent by each user is evenly distributed among the different domains the user visited. For example, if a user goes to four different domains in an active minute, the user is considered to have spent 15 seconds at each domain.
For the purposes of the time spent value, considering the following notes:
•
•
An active user is defined as a username or IP address that sends HTTP traffic through the appliance and has gone to a website that AsyncOS considers to be a “page view.”
AsyncOS defines a page view as an HTTP request initiated by the user, as opposed to a request initiated by the client application. AsyncOS uses a heuristic algorithm to make a best effort guess to identify user page views.
Units displayed in Hours:Minutes format.
Allowed URL Category The number and type of categories that have been allowed. Units displayed in transaction type.
Monitored URL
Category
The number and type of categories that are being monitored. Units displayed in transaction type.
Warned URL Category The number and type of categories that have initiated a warning. Units displayed in transaction type.
Blocked by URL
Category
Blocked by Application or Application Type
Blocked by Web
Reputation
The transaction that has been blocked due to URL Category. Units displayed in transaction type.
The application that has been blocked due to application type. Units displayed in transaction type.
The transaction that has been blocked due to web reputation. Units displayed in transaction type.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-5
Chapter 23 Reporting
Using the Reporting Tab
Table 23-2 Report Column Descriptions (continued)
Column Name
Blocked by
Anti-Malware
Other Blocked
Transactions
Transactions with
Bandwidth Limit
Description
The transactions blocked by Anti-Malware. Units displayed in transaction type.
All other transactions that have been blocked. Units displayed in transaction type.
The number of transactions that have a bandwidth limit.
Transactions without
Bandwidth Limit
Transactions Blocked by
Application
The number of transactions that do not have a bandwidth limit.
The number of transactions blocked by a specific application type.
Warned Transactions All transactions that rendered a warning to the user. Units displayed in transaction type.
Transactions Completed The transactions completed by a user. Units displayed in transaction type.
Transactions Blocked
Total Transactions
All transactions that have been blocked. Units displayed in transaction type.
The total number of transactions that have occurred.
Configuring Columns on Report Pages
To configure the columns that appear in a report, perform the following steps:
Step 1
Step 2
Choose Reporting > Report_Name .
Click the Columns link that appears in the lower right corner of a report.
For example,
shows the Columns link for the URL Categories report.
Figure 23-3 Columns Link, URL Categories Report
A pop-up window appears that allows you to select the columns you want to appear in the report. For example,
Figure 23-4 shows the columns you can select for the URL Categories report.
23-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
Figure 23-4 Displaying Columns, URL Categories Report
Using the Reporting Tab
Step 3 Select each column to display by clicking the checkbox next to each column in the pop-up window, and click Done .
Printing and Exporting Reports from Report Pages
You can generate a printer-friendly formatted PDF version of any of the report pages by clicking the
Printable (PDF) link at the top-right corner of the page.
Additionally, you can export raw data as a comma-separated value (CSV) file by clicking the Export link. You can also save this data as CSV for most scheduled reports.
Note You can only print to PDF and export data from the Web Tracking page after the Web Tracking page returns search results. Do this using the Printable Download link. From this link you can choose to create a PDF that includes data displayed on the current page or up to 1,000 transactions, or you can export all data to a CSV file.
Exporting Report Data
Most reports include an Export link that allows you to export raw data to a comma-separated values
(CSV) file. After exporting the data to a CSV file, you can access and manipulate the data in it using applications such as Microsoft Excel.
The exported CSV data displays all message tracking and reporting data in Greenwich Mean Time
(GMT) regardless of what is set on the Web Security appliance. The purpose of the GMT time conversion is to allow data to be used independently from the appliance or when referencing data from appliances in multiple time zones.
The following example is an entry from a raw data export of the Anti-Malware category report, where
Pacific Daylight Time (PDT) is displayed as GMT - 7 hours:
Begin Timestamp, End Timestamp, Begin Date, End Date, Name, Transactions Monitored,
Transactions Blocked, Transactions Detected
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-7
Chapter 23 Reporting
Enabling Centralized Reporting
1159772400.0, 1159858799.0, 2006-10-02 07:00 GMT, 2006-10-03 06:59 GMT, Adware, 525,
2100, 2625
Table 23-3 Viewing Raw Data Entries
Category Header
Begin Timestamp
End Timestamp
Begin Date
End Date
Name
Transactions Monitored
Transactions Blocked
Transactions Detected
Value
1159772400.0
Description
Query start time in number of seconds from epoch.
1159858799.0
2006-10-02 07:00
GMT
Query end time in number of seconds from epoch.
Date the query began.
2006-10-03 06:59
GMT
Date the query ended.
Adware
525
2100
2625
Name of the malware category.
Number of transactions monitored.
Number of transactions blocked.
Total number of transactions:
Number of transactions detected + Number of transactions blocked.
Note Category headers are different for each type of report.
Note If you export localized CSV data, the headings may not be rendered properly in some browsers. This occurs because some browsers may not use the proper character set for the localized text. To work around this problem, you can save the file to your local machine, and open the file in any web browser using
File > Open . When you open the file, select the character set to display the localized text.
Enabling Centralized Reporting
When the Web Security appliance is managed by a Security Management appliance, you can choose which appliance displays reports on the web traffic that is processed by the Web Security appliance. By default, the Web Security appliance maintains the reports (Local Reporting). However, you can configure the Web Security appliance so that the Security Management appliance maintains the reports by enabling Centralized Reporting. You might want to enable Centralized Reporting when the Security
Management appliance manages multiple Web Security appliances. This gives you a centralized view of web traffic across all Web Security appliances.
Note When you enable Centralized Reporting, only the System Capacity and System Status reports are available on the Web Security appliance. To view the other reports, connect to the Security Management appliance. The Web Security appliance no longer stores data for the other reports.
To enable Centralized Reporting:
Step 1 Navigate to the Security Services > Reporting page, and click Edit Settings .
23-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
Scheduling Reports
Step 2
Step 3
Choose Centralized Reporting .
Submit and commit your changes.
Scheduling Reports
You can schedule reports to run on a daily, weekly, or monthly basis. Scheduled reports can be configured to include data for the previous day, previous seven days, or previous month. Alternatively, you can include data for a custom number of days (from 2 days to 100 days) or a custom number of months (from 2 months to 12 months).
Regardless of when you run a report, the data is returned from the previous time interval (hour, day, week, or month). For example, if you schedule a daily report to run at 1AM, the report will contain data from the previous day, midnight to midnight (00:00 to 23:59).
You can schedule reports for the following types of reports:
• Overview
•
•
•
•
•
•
•
•
•
•
Users
Web Sites
URL Categories
Application Visibility
Anti-Malware
Client Malware Risk
Web Reputation Filters
L4 Traffic Monitor
Reports by User Location
System Capacity
For more information on the data displayed in each report, see
Web Security Appliance Reports, page 24-1
.
Adding a Scheduled Report
Use the Reporting > Scheduled Reports page to schedule reporting for different reports.
To create a scheduled report:
Step 1 Navigate to the Reporting > Scheduled Reports page, and click Add Scheduled Report .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-9
Chapter 23 Reporting
On-Demand Reports
Figure 23-5 Adding a Scheduled Report
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Select a report type.
Enter a title for the report. To avoid creating multiple reports with the same name, consider using a descriptive title.
Select a time range for the data included in the report.
Choose the format for the generated report.
The default format is PDF. Most reports also allow you to save raw data as a CSV file.
Depending on the type of report you configure, you can specify different report options, such as the number of rows to include and by which column to sort the data. Configure these options as necessary.
In the Schedule section, choose whether to run the report daily, weekly, or monthly and at what time.
In the Email field, enter the email address to where to send the generated report.
If you do not specify an email address, the report is archived only.
Submit and commit your changes.
Editing Scheduled Reports
To edit reports, select the report title from the list on the Reporting > Scheduled Reports page, modify settings then submit and commit your changes.
Deleting Scheduled Reports
To delete reports, go to the Reporting > Scheduled Reports page and select the check boxes corresponding to the reports that you want to delete. To remove all scheduled reports, select the All check box, Delete and Commit your changes. Note that archived versions of deleted reports are not deleted.
On-Demand Reports
The Generate Report Now option on the Reporting > Archived Reports page allows you to generate on-demand data displays for each report type. To generate a report:
Step 1 Navigate to the Reporting > Archived Reports page.
23-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
Step 2 Click Generate Report Now
Figure 23-6 Generating an On-Demand Report
Archived Reports
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Select a report type and edit the title, if necessary. To avoid creating multiple reports with the same name, consider using a descriptive title.
Select a time range for the data included in the report.
Choose the format for the generated report.
The default format is PDF. Most reports also allow you to save raw data as a CSV file.
Depending on the type of report you configure, you can specify different report options, such as the number of rows to include and by which column to sort the data. Configure these options as necessary.
Select whether to archive the report (if so, the report will appear on the Archived Reports page).
Specify whether to email the report, and list the email addresses of the recipients.
Click Deliver this Report to generate the report.
Commit your changes.
Archived Reports
The Reporting > Archived Reports page lists available archived reports. Report names in the Report Title column are interactive and link to a view of each report. The Show menu filters the types of reports that are listed. Additionally, interactive column headings can be used to sort the data in each column.
The appliance stores up to 12 instances of each scheduled report (up to 1000 reports). Archived reports are stored in the
/periodic_reports
directory on the appliance. Archived reports are deleted automatically. As new reports are added, older reports are removed to keep the number at 1000. The limit of 12 instances applies to each scheduled report with the same name and time range.
SNMP Monitoring
The AsyncOS operating system supports system status monitoring via SNMP (Simple Network
Management Protocol). This includes Cisco’s Enterprise MIB, asyncoswebsecurityappliance-mib.txt.
The asyncoswebsecurityappliance-mib helps administrators better monitor system health. In addition, this release implements a read-only subset of MIB-II as defined in RFCs 1213 and 1907. (For more information about SNMP, see RFCs 1065, 1066, and 1067.) Please note:
• SNMP requests are serviced on the P1 interface.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-11
SNMP Monitoring
Chapter 23 Reporting
•
•
•
•
•
SNMP is off by default.
SNMP SET operations (configuration) are not implemented.
AsyncOS supports SNMPv1, v2, and v3.
The use of SNMPv3 with password authentication and DES Encryption is mandatory to enable this service. (For more information on SNMPv3, see RFCs 2571-2575.) You are required to set a
SNMPv3 passphrase of at least 8 characters to enable SNMP system status monitoring. The first time you enter a SNMPv3 passphrase, you must re-enter it to confirm. The snmpconfig command
“remembers” this phrase the next time you run the command.
The SNMPv3 username is: v3get.
> snmpwalk -v 3 -l AuthNoPriv -u v3get -a MD5 ironport serv.example.com
•
•
If you use only SNMPv1 or SNMPv2, you must set a community string. The community string does not default to public .
For SNMPv1 and SNMPv2, you must specify a network from which SNMP GET requests are accepted.
• To use traps, an SNMP manager (not included in AsyncOS) must be running and its IP address entered as the trap target. (You can use a hostname, but if you do, traps will only work if DNS is working.)
Use the snmpconfig
command to configure SNMP system status for the appliance. After you choose and configure values for an interface, the appliance responds to SNMPv3 GET requests. These version 3 requests must include a matching password. By default, version 1 and 2 requests are rejected. If enabled, version 1 and 2 requests must have a matching community string.
MIB Files
Cisco provides “enterprise” MIBs for Email and Web Security appliances as well as a “Structure of
Management Information” (SMI) file:
• asyncoswebsecurityappliance-mib.txt — an SNMPv2 compatible description of the Enterprise MIB for Web Security appliances.
• ASYNCOS-MAIL-MIB.txt — an SNMPv2 compatible description of the Enterprise MIB for Email
Security appliances.
IRONPORT-SMI.txt — defines the role of the asyncoswebsecurityappliance-mib.
•
These files are available on the documentation CD included with your IronPort appliance. You can also find these files here: http://www.cisco.com/en/US/customer/products/ps10164/tsd_products_support_series_home.h
tml
Hardware Objects
Hardware sensors conforming to the Intelligent Platform Management Interface Specification (IPMI) report temperature, fan speed, and power supply status.
23-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
SNMP Monitoring
shows what hardware derived objects are available for monitoring on what models. The number displayed is the number of instances of that object that can be monitored. For example, you can query the RPMs for 4 fans in the S350 appliance.
Table 23-4 Number of Hardware Objects per Appliance
Model Ambient Temp Fans Power Supply Disk Status NIC Link
S160 1 2 1 2 6
S350
S360
1
1
4
4
2
2
6
4
6
6
S650
S660
1
1
4
4
2
2
6
6
6
6
Hardware Traps
lists the temperature and hardware conditions that cause a hardware trap to be sent:
Table 23-5 Hardware Traps: Temperature and Hardware Conditions
Model
S160/S350/S360/S650
/S660
High Temp
(Ambient)
47C
Fan Failure Power Supply
0 RPMs Status Change
RAID
Status Change
Link
Status Change
Status change traps are sent when the status changes. Fan Failure and high temperature traps are sent every 5 seconds. The other traps are failure condition alarm traps — they are sent once when the state changes (healthy to failure). It is a good idea to poll for the hardware status tables and identify possible hardware failures before they become critical. Temperatures within 10 per cent of the critical value may be a cause for concern.
Note that failure condition alarm traps represent a critical failure of the individual component, but may not cause a total system failure. For example, a single fan or power supply can fail on a S650 appliance and the appliance will continue to operate.
SNMP Traps
SNMP provides the ability to send traps, or notifications, to advise an administration application (an
SNMP management console, typically) when one or more conditions have been met. Traps are network packets that contain data relating to a component of the system sending the trap. Traps are generated when a condition has been met on the SNMP agent (in this case, the IronPort appliance). After the condition has been met, the SNMP agent then forms an SNMP packet and sends it over port 162, the standard SNMP trap port. In the example below, the trap target of
10.1.1.29
and the Trap Community string are entered. This is the host running the SNMP management console software that will receive the
SNMP traps from the appliance.
You can configure SNMP traps (enable or disable specific traps) when you enable SNMP for an interface. To specify multiple trap targets: when prompted for the trap target, you may enter up to 10 comma separated IP addresses.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-13
Chapter 23 Reporting
SNMP Monitoring
CLI Example
In the following example, the snmpconfig
command is used to enable SNMP on the “PublicNet” interface on port 161. A passphrase for version 3 is entered and then re-entered for confirmation. The system is configured to service version 1 and 2 requests, and the community string public
is entered for
GET requests from those versions 1 and 2. The trap target of
10.1.1.29
is entered. Finally, system location and contact information is entered.
example.com> snmpconfig
Current SNMP settings:
SNMP Disabled.
Choose the operation you want to perform:
- SETUP - Configure SNMP.
[]> setup
Do you want to enable SNMP? [N]> y
Please choose an IP interface for SNMP requests.
1. Management (192.168.1.1/24: wsa01-vmw1-tpub.qa)
[1]>
Enter the SNMPv3 passphrase.
>
Please enter the SNMPv3 passphrase again to confirm.
>
Which port shall the SNMP daemon listen on?
[161]>
Service SNMP V1/V2c requests? [N]> y
Enter the SNMP V1/V2c community string.
23-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
[]> public
From which network shall SNMP V1/V2c requests be allowed?
[192.168.1.1]>
SNMP Monitoring
Enter the Trap target as a host name, IP address or list of IP addresses separated by commas (IP address preferred). Enter “None” to disable traps.
[None]> 10.1.1.29
Enter the Trap Community string.
[]> tcomm
Enterprise Trap Status
1. CPUUtilizationExceeded Disabled
2. RAIDStatusChange Enabled
3. connectivityFailure Disabled
4. fanFailure Enabled
5. highTemperature Enabled
6. keyExpiration Enabled
7. linkDown Enabled
8. linkUp Enabled
9. memoryUtilizationExceeded Disabled
10. powerSupplyStatusChange Enabled
11. resourceConservationMode Enabled
12. updateFailure Enabled
13. upstream_proxy_failure Enabled
Do you want to change any of these settings? [N]> y
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-15
Chapter 23 Reporting
SNMP Monitoring
Do you want to disable any of these traps? [Y]> n
Do you want to enable any of these traps? [Y]> y
Enter number or numbers of traps to enable. Separate multiple numbers with commas.
[]> 1,3
What threshold would you like to set for CPU utilization?
[95]>
What URL would you like to check for connectivity failure?
[http://downloads.ironport.com]>
Enterprise Trap Status
1. CPUUtilizationExceeded Enabled
2. RAIDStatusChange Enabled
3. connectivityFailure Enabled
4. fanFailure Enabled
5. highTemperature Enabled
6. keyExpiration Enabled
7. linkDown Enabled
8. linkUp Enabled
9. memoryUtilizationExceeded Disabled
10. powerSupplyStatusChange Enabled
11. resourceConservationMode Enabled
12. updateFailure Enabled
13. upstream_proxy_failure Enabled
Do you want to change any of these settings? [N]>
23-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 23 Reporting
SNMP Monitoring
Enter the System Location string.
[Unknown: Not Yet Configured]> Network Operations Center - west; rack #30, position 3
Enter the System Contact string.
[snmp@localhost]> Joe Administrator, x8888
Current SNMP settings:
Listening on interface “Management” 192.168.1.1 port 161.
SNMP v3: Enabled.
SNMP v1/v2: Enabled, accepting requests from subnet 192.168.1.1.
SNMP v1/v2 Community String: public
Trap target: 10.1.1.29
Location: Network Operations Center - west; rack #30, position 3
System Contact: Joe Administrator, x8888
Choose the operation you want to perform:
- SETUP - Configure SNMP.
[]> example.com>
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
23-17
SNMP Monitoring
Chapter 23 Reporting
23-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
24
Web Security Appliance Reports
This chapter contains the following sections:
•
Web Security Appliance Reports Overview, page 24-1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
URL Categories Page, page 24-13
Application Visibility Page, page 24-16
Client Malware Risk Page, page 24-22
Web Reputation Filters Page, page 24-25
L4 Traffic Monitor Page, page 24-27
Reports by User Location Page, page 24-31
System Capacity Page, page 24-37
System Status Page, page 24-40
Web Security Appliance Reports Overview
This chapter discusses the report pages available in the Web Security appliance. For more information on working with reports, such as choosing report columns, exporting reports to an external file, or scheduling reports, see
This chapter describes the following reports:
•
•
•
•
•
URL Categories Page, page 24-13
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-1
Chapter 24 Web Security Appliance Reports
Overview Page
•
•
•
•
•
•
•
•
Application Visibility Page, page 24-16
Client Malware Risk Page, page 24-22
Web Reputation Filters Page, page 24-25
L4 Traffic Monitor Page, page 24-27
Reports by User Location Page, page 24-31
System Capacity Page, page 24-37
Overview Page
The Reporting > Overview page provides a synopsis of the activity on the Web Security appliance. It includes graphs and summary tables for web traffic processed by the Web Security appliance.
shows the Overview page.
24-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-1 The Overview Page
Overview Page
(Illustration continues on next page.)
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-3
Overview Page
(Illustration continued from previous page.)
Chapter 24 Web Security Appliance Reports
At a high level the Overview page shows you statistics about the URL and User usage, Web Proxy activity, and various transaction summaries. The transaction summaries gives you further trending details on, for example suspect transactions, and right across from this graph, how many of those suspect transactions are blocked and in what manner they are being blocked.
The lower half of the Overview page is about usage. That is, the top URL categories being viewed, the top application types and categories that are being blocked, and the top users that are generating these blocks or warnings.
24-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Overview Page
describes the information on the Overview page.
Table 24-1 Overview Report Page Components
Section
Time Range (drop-down list)
Total Web Proxy Activity
Web Proxy Summary
L4 Traffic Monitor Summary
Suspect Transactions
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
“Changing the Time Range” section on page 23-3
.
This section displays the Web Proxy activity. This section displays the actual number of transactions (vertical scale) as well as the approximate date that the activity occurred
(horizontal timeline).
This section allows you to view the percentage of Web Proxy activity that are suspect, or clean Web Proxy activity, including the total number of transactions.
This section reports on traffic monitored and blocked by the
L4 Traffic Monitor.
This section allows you to view the web transactions that have been labeled as suspect by the various security components.
Suspect Transactions Summary
Top URL Categories by Total Transactions
This section displays the actual number of transactions
(vertical scale) as well as the approximate date that the activity occurred (horizontal timeline).
This section allows you to view the percentage of blocked or warned transactions that are suspect. Additionally, you can see the type of transactions that have been detected and blocked, and the actual number of times that this transaction was blocked.
This section displays the top 10 URL categories that have been blocked. (URL category on the vertical scale by the number of times requests in that category were blocked on the horizontal scale.)
The set of predefined URL categories is occasionally updated.
For more information about the impact of these updates on report results, see
URL Category Set Updates and Reports, page 24-15 .
Top Application Types by Total Transactions
Top Malware Categories Detected
This section displays the top application types that have been blocked by the AVC engine. (The application type on the vertical scale by the number of times requests for applications in that type were blocked on the horizontal scale.)
This section displays all malware categories that have been detected.
Top Users Blocked or Warned Transactions This section displays the users that are generating the blocked or warned transactions. Authenticated users are displayed username and unauthenticated users are displayed by IP address.
You can choose to make usernames unrecognizable in reports.
For more information on how to do this, see the
“Working with Usernames in Reports” section on page 23-1 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-5
Chapter 24 Web Security Appliance Reports
Users Page
Users Page
The Reporting > Users page provides several links that allows you to view web traffic information for individual users. You can view how much time users on the network have spent on the Internet or on a particular website or URL, and how much bandwidth users have used.
shows the Users page.
Figure 24-2 The Users Page
24-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Users Page
describes the information on the Users page.
Table 24-2 Users Report Page Components
Section
Time Range (drop-down list)
Top Users by Transactions Blocked
Top Users by Bandwidth Used
Users Table
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section lists the users (vertical scale) that have the greatest number of blocked transactions (horizontal scale).
Authenticated users are displayed username and unauthenticated users are displayed by IP address. You can choose to make usernames unrecognizable in reports. For more information on
how to do this, see the “Working with Usernames in Reports” section on page 23-1
.
This sections displays the users (vertical scale) that are using the most bandwidth on the system (horizontal scale represented in gigabyte usage).
The Users Table lists individual users and displays multiple statistics on each user. You can sort the table by clicking the column headers, and choose which columns of data to display.
For more information, see
Working with Columns on Report
.
When the section contains more than 10 users, you can use the
Items Displayed menu to configure the number of users to display.
You can search for data on a specific user in the Find User ID or
Client IP Address
field. For more information, see Searching
You can click on a user in the table to find more specific information. This information appears on the User Details page.
For more information, see the
“User Details Page” section on page 24-7
.
User Details Page
The User Details page displays information about a specific user selected in the Users Table on the
Reporting > Users page.
The User Details page allows you to investigate individual user’s activity on the network. You might want to view this information if you need to run user-level investigations and need to find out, for example, what sites users are visiting, what malware threats they are encountering, what URL categories they are accessing, and how much time each user spends at these sites.
To display the User Details page for a user, click on the user from the User Table on the Reporting >
Users page and the following page appears:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-7
Users Page
Figure 24-3 User Details Page
Chapter 24 Web Security Appliance Reports
(Illustration continues on next page.)
24-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
(Illustration continued from previous page.)
Users Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-9
Users Page
Chapter 24 Web Security Appliance Reports
Table 24-3 describes the information on the User Details page.
Table 24-3 User > User Details Report Page Components
Section
Time Range (drop-down list)
URL Categories by Total Transactions
Trend by Total Transaction
URL Categories Matched
Domains Matched
Applications Matched
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section lists the specific URL categories that a specific user is using.
The set of predefined URL categories is occasionally updated.
For more information about the impact of these updates on report results, see
URL Category Set Updates and Reports, page 24-15 .
This graph displays at what times the user accessed the web.
For example, this graph will indicate if there is a large spike in web traffic during certain hours of the day, and when those spikes occur. Using the Time Range drop-down list, you can expand this graph to see a more or less granular span of time that this user was on the web.
This section shows all matched URL categories during a specified time range for both completed and blocked transactions. You can use column headings to sort data. When the section contains more than 10 categories, you can use the Items
Displayed menu to configure the number of URL categories to display.
The set of predefined URL categories is occasionally updated.
For more information about the impact of these updates on report results, see
URL Category Set Updates and Reports, page 24-15 .
From this section you can also search for data that applies to a specific URL category in the Find URL Category field. For more information, see
.
From this section you can find out about a specific Domain or IP address that this user has accessed. You can also see the time spent on those categories, and various other information that you have set from the column view. In the text field at the bottom of the section enter the Domain or IP address and click Find
Domain or IP . The domain or IP address does not need to be an exact match.
From this section you can find a specific application that a specific user is using as detected by the AVC engine. For example, if a user is accessing a site that requires use of a lot of
Flash video, you will see the application type in the Application column.
In the text field at the bottom of the section enter the application name and click Find Application . The name of the application does not need to be an exact match.
24-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Web Sites Page
Table 24-3
Policies Matched
User > User Details Report Page Components (continued)
Section
Malware Threats Detected
Description
From this table you can see the top malware threats that a specific user is triggering. In the text field at the bottom of the Malware
Threats section, enter the malware threat name and click Find
Malware Threat . The name of the malware threat does not need to be an exact match.
From this section you can find a specific policy that is being enforced on this particular user.
From this section you can also search for data that applies to a specific policy in the Find Policy field. For more information, see
.
Note The client reports sometimes show a user with an asterisk (*) at the end of the username. For example, the Client report might show an entry for both “jsmith” and “jsmith*”. Usernames listed with an asterisk
(*) indicate the username provided by the user, but not confirmed by the authentication server. This happens when the authentication server was not available at the time and the appliance is configured to permit traffic when authentication service is unavailable.
Web Sites Page
The Reporting > Web Sites page is an overall aggregation of the activity that is happening on the Web
Security appliance. From this page you can monitor high-risk web sites accessed during a specific time range.
Figure 24-4 shows the Web Sites page:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-11
Web Sites Page
Figure 24-4 Web Sites Page
Chapter 24 Web Security Appliance Reports
Table 24-4 describes the information on the
Web Sites page:
Table 24-4 Web Sites Report Page Components
Section
Time Range (drop-down list)
Top Domains by Total Transactions
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section lists the top domains that are being visited on the site in a graph format.
24-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
URL Categories Page
Table 24-4 Web Sites Report Page Components (continued)
Section
Top Domains by Transactions Blocked
Domains Matched
Description
This section lists the top domains that triggered a block action to occur per transaction in a graph format. For example, a user went to a certain domain and because of a specific policy that I have in place, this triggered a block action. This domain then gets listed in this graph as a transaction blocked, and the domain site that triggered the block action is listed.
This section lists the domains that are that are being visited on the site in an interactive table. From this table you can access more granular information about a specific domain by clicking on the specific domain. The Proxy Services tab on the Web Tracking page appears and you can see tracking information and why certain domains were blocked.
You can use column headings to sort data, and you can choose which columns to display. For more information, see the
“Working with Columns on Report Pages” section on page 23-4
.
When the section contains more than 10 domains, you can use the
Items Displayed menu to configure the number of domains to display.
When you click on a specific domain you can see the top users of that domain, the top transactions on that domain, the URL categories matched and the malware threats that have been detected. This table can be modified using the Time Range drop-down list so you can see a specific time range, such as hour, day or week for that domain use.
URL Categories Page
The Reporting > URL Categories page can be used to view the URL categories that are being visited by users on the network.
Note The set of predefined URL categories is occasionally updated. For more information about the impact of these updates on report results, see
URL Category Set Updates and Reports, page 24-15
.
Figure 24-5 shows the URL Categories page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-13
URL Categories Page
Figure 24-5 URL Categories Page
Chapter 24 Web Security Appliance Reports
Table 24-5 describes the information on the URL Categories page.
Table 24-5 URL Categories Report Page Components
Section
Time Range (drop-down list)
Top URL Categories by Total
Transactions
Description
Choose the time range for your report. For more information, see
the “Changing the Time Range” section on page 23-3
.
This section lists the top URL categories that are being visited on the site in a graph format.
24-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
URL Categories Page
Table 24-5 URL Categories Report Page Components (continued)
Section
Top URL Categories by Blocked and
Warned Transactions
URL Categories Matched
Description
This section lists the top URL that triggered a block or warning action to occur per transaction in a graph format. For example, a user went to a certain URL and because of a specific policy that is in place, this triggered a block action or a warning. This URL then gets listed in this graph as a transaction blocked or warning.
The URL Categories Matched section shows the disposition of transactions by URL category during the specified time range, plus bandwidth used and time spent in each category.
If the percentage of uncategorized URLs is higher than 15-20%, consider the following options:
• For specific localized URLs, you can create custom URL categories and apply them to specific users or group policies.
For more information, see the
“Custom URL Categories” section on page 18-16
.
•
•
You can report uncategorized and misclassified and URLs to the Cisco for evaluation and database update. See
Uncategorized and Misclassified URLs, page 18-3
.
Verify that Web Reputation Filtering and Anti-Malware
Filtering are enabled. Often times, the correlation between malware and URLs with suspect content is high and it is likely that they may get caught by subsequent filters. The system pipeline is set up to catch malicious traffic with other downstream filters if URL filtering does not have a verdict.
URL Category Set Updates and Reports
The set of predefined URL categories may periodically be updated automatically on your Web Security appliance, as described in
Managing Updates to the Set of URL Categories, page 18-5
.
When these updates occur, old category names will continue to appear in reports until the data associated with the older categories is too old to be included in reports. Report data generated after a URL category set update will use the new categories, so you may see both old and new categories in the same report.
If there is overlap between the contents of old and new categories, you may need to examine report results more carefully to obtain valid statistics. For example, if the “Instant Messaging” and “Web-based
Chat” categories have been merged into a single “Chat and Instant Messaging” category during the time frame that you are looking at, visits before the merge to sites covered by the “Instant Messaging” and
“Web-based Chat” categories are not counted in the total for “Chat and Instant Messaging”. Likewise, visits to instant messaging or Web-based chat sites after the merge would not be included in the totals for the “Instant Messaging” or “Web-based Chat” categories.
Using The URL Categories Page in Conjunction with Other Reporting Pages
One of the advantages of the URL Categories page is that it can be used in conjunction with the
and the
Users Page to investigate a particular user, but also what types of
applications or websites that a particular user is trying to access.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-15
Chapter 24 Web Security Appliance Reports
Application Visibility Page
For example, from the
you can generate a high level report for Human Resources which details all the URL categories that are visited by the site. From the same page, you can gather further details in the URL Categories interactive table about the URL category ‘Streaming Media’. By clicking on the Streaming Media category link, you can view the specific URL Categories report page.
This page not only displays the top users that are visiting streaming media sites (in the Top Users by
Category for Total Transactions section), but also displays the domains that are visited (in the Domains
Matched interactive table) such as YouTube.com or QuickPlay.com.
At this point, you are getting more and more granular information for a particular user. Now, let’s say this particular user stands out because of their usage, and you want to find out exactly what they are accessing. From here you can click on the user in the Users table. This action takes you to the
doing on the web.
If you wanted to go further, you can now view web tracking details by clicking on Transactions
Completed link in the interactive table. This brings up the
on the Web Tracking Page where you can see the actual details about what dates the user accessed the sites, the full URL, the time spent on that URL, etc.
Application Visibility Page
The Reporting > Application Visibilit y page shows the applications and application types used and blocked as detected by the Application Visibility and Control engine.
shows the Application Visibility page.
24-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-6 Application Visibility Page
Application Visibility Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-17
Anti-Malware Page
Chapter 24 Web Security Appliance Reports
Table 24-6 describes the information on the Application Visibility
page.
Table 24-6 Application Visibility Report Page Components
Section
Time Range (drop-down list)
Top Application Types by Total
Transactions
Top Applications by Blocked
Transactions
Application Types Matched
Applications Matched
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section lists the top application types that are being visited on the site in a graph format. For example, Instant Messenging tools such as Yahoo Instant Messenger, and Presentation application types.
This section lists the top application types that triggered a block action to occur per transaction in a graph format. For example, a user has tried to start a certain application, such as Google Talk, and because of a configured policy, this triggered a block action.
This application then gets listed in this graph as a transaction blocked or warning.
The Application Types Matched table allows you to view granular details about the application types listed in the Top
Applications Type by Total Transactions graph. From the
Applications column you can click on an application to view details.
The Applications Matched section shows all the application during a specified time range.
You can sort the table by clicking the column headers, and choose which columns of data to display. For more information, see
Working with Columns on Report Pages, page 23-4
.
When the section contains more than 10 applications, you can use the Items Displayed menu to configure the number of applications to display.
You can search for data on a specific application in the Find
Application field. For more information, see
.
Anti-Malware Page
The Reporting > Anti-Malware page allows you to monitor and identify malware detected by the Cisco
IronPort DVS engine.
shows the Anti-Malware page.
24-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-7 Anti-Malware Page
Anti-Malware Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-19
Anti-Malware Page
Chapter 24 Web Security Appliance Reports
Table 24-7 describes the information on the Anti-Malware page.
Table 24-7 Anti-Malware Report Page Components
Section
Time Range (drop-down list)
Top Malware Categories Detected
Top Malware Threats Detected
Malware Categories
Malware Threats
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section displays the top malware categories detected by the
DVS engine. This information is displayed in graph format.
This section displays the top malware threats detected by the
DVS engine. This information is displayed in graph format.
The Malware Categories table shows detailed information about particular malware categories that are displayed in the Top
Malware Categories Detected section.
Clicking on any of the links in this table allows you to view more granular details about individual malware categories and where they are on the network.
The Malware Threats table shows detailed information about particular malware threats that are displayed in the Top Malware
Threats section.
Malware Category Report Page
The Malware Category Report page allows you to view detailed information on an individual Malware
Category and what it is doing on your network.
To access the Malware Category report page, perform the following:
Step 1
Step 2
Navigate to the Reporting > Anti-Malware page.
The Anti-Malware page appears.
In the Malware Categories interactive table, click on a category in the Malware Category column.
The Malware Category report page appears.
24-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-8 Malware Category Report Page
Anti-Malware Page
Malware Threat Report Page
The Malware Threat Report page report shows clients at risk for a particular threat, displays a list of potentially infected clients, and links to the Client Detail page. The trend graph at the top of the report shows monitored and blocked transactions for a threat during the specified time range. The table at the bottom shows the actual number of monitored and blocked transactions for a threat during the specified time range.
To access the Malware Threat report page, perform the following:
Step 1
Step 2
Navigate to the Reporting > Anti-Malware page.
The Anti-Malware page appears.
In the Malware Threat table, click on a category in the Malware Category column.
The Malware Threat report page appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-21
Client Malware Risk Page
Figure 24-9 Malware Threats Report Page
Chapter 24 Web Security Appliance Reports
Client Malware Risk Page
The Reporting > Client Malware Risk page is a security-related reporting page that can be used to monitor client malware risk activity.
From the Client Malware Risk page, a system administrator can see which of their users are encountering the most blocks or warnings. Given the information gathered from this page, the administrator can click on the user link to view what this user doing on the web that makes them run into so many blocks or warnings and setting off more detections than the rest of the users on the network.
Additionally, the Client Malware Risk page lists client IP addresses involved in frequent malware connections, as identified by the L4 Traffic Monitor (L4TM). A computer that connects frequently to malware sites may be infected with malware that is trying to connect to a central command and control server and should be disinfected.
Figure 24-10 shows the Client Malware Risk page.
24-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-10 Client Malware Risk Page
Client Malware Risk Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-23
Chapter 24 Web Security Appliance Reports
Client Malware Risk Page
Table 24-8 describes the information on the Client Malware Risk
page.
Table 24-8 Client Malware Risk Report Page Components
Section
Time Range (drop-down list)
Web Proxy: Top Clients by Malware
Risk
L4 Traffic Monitor: Malware
Connections Detected
Web Proxy: Clients by Malware Risk
L4 Traffic Monitor: Clients by Malware
Risk
Description
A menu that allows you to choose the time range of the data contained in the report. For more information, see the
“Changing the Time Range” section on page 23-3
.
This chart displays the top ten users that have encountered a malware risk.
This chart displays the IP addresses of the computers in your organization that most frequently connect to malware sites.
This chart is the same as the “Top Client IPs” chart on the
Traffic Monitor Page, page 24-27
. See that section for more information and chart options.
The Web Proxy: Clients by Malware Risk table shows detailed information about particular clients that are displayed in the Web
Proxy: Top Clients by Malware Risk section.
You can click each user in this table to open the
Page for Web Proxy - Clients by Malware Risk
that provides detailed information for each user. For more information, see the
“Client Detail Page for Web Proxy - Clients by Malware Risk” section on page 24-24
.
Clicking on any of the links in the table allows you to view more granular details about individual users and what activity they are performing that is triggering the malware risk. For example, clicking on the link in the “User ID / Client IP Address” column takes you to a User page for that user.
This table displays IP addresses of computers in your organization that frequently connect to malware sites.
This table is the same as the “Client Source IPs” table on the
Traffic Monitor Page, page 24-27
. For information about working with this table, see that section.
Client Detail Page for Web Proxy - Clients by Malware Risk
The Client Details page shows all the web activity and malware risk data for a particular client during the specified time range, for entries in the Web Proxy - Client Malware Risk table on the Client Malware
Risk page.
To access the Client Details page, perform the following:
Step 1
Step 2
Navigate to the Reporting > Client Malware Risk page.
The Client Malware Risk page appears.
In the Web Proxy - Client Malware Risk section, click on a user in the “User ID / Client IP Address” column.
24-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Web Reputation Filters Page
The Users page for this user appears. For information about the items on this page, see
Web Reputation Filters Page
The Reporting > Web Reputation Filters page is a security-related reporting page that allows you to view the results of your set Web Reputation Filters for transactions during a specified time range.
shows the Web Reputation Filters page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-25
Web Reputation Filters Page
Figure 24-11 Web Reputation Filters Page
Chapter 24 Web Security Appliance Reports
24-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
L4 Traffic Monitor Page
describes the information on the Web Reputation Filters page.
Table 24-9 Web Reputation Filters Report Page Components
Section
Time Range (drop-down list)
Web Reputation Actions (Trend)
Web Reputation Actions (Volume)
Web Reputation Threat Types by
Blocked Transactions
Web Reputation Threat Types by
Scanned Further Transactions
Web Reputation Actions
(Breakdown by Score)
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
This section, in graph format, displays the total number of web reputation actions (vertical) against the time specified (horizontal timeline). From this you can see potential trends over time for web reputation actions.
This section displays the web reputation action volume in percentages by transactions.
This section displays the threat types that were blocked due to a low reputation score.
This section displays the threat types that resulted in a reputation score that indicated to scan the transaction. It shows both monitored and blocked transactions.
This interactive table displays the web reputation scores broken down for each action.
L4 Traffic Monitor Page
The Reporting > L4 Traffic Monitor page is a security-related reporting page that displays information about malware ports and malware sites that the L4 Traffic Monitor has detected during the specified time range. It also displays IP addresses of clients that frequently encounter malware sites.
The L4 Traffic Monitor listens to network traffic that comes in over all ports on the appliance and matches domain names and IP addresses against entries in its own database tables to determine whether to allow incoming and outgoing traffic.
You can use data in this report to determine whether to block a port or a site, or to investigate why a particular client IP address is connecting unusually frequently to a malware site (for example, this could be because the computer associated with that IP address is infected with malware that is trying to connect to a central command and control server.)
shows the L4 Traffic Monitor page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-27
L4 Traffic Monitor Page
Figure 24-12 L4 Traffic Monitor Page
Chapter 24 Web Security Appliance Reports
(Illustration continues on next page.)
24-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
(Illustration continued from previous page.)
L4 Traffic Monitor Page
Table 24-10 describes the information on the L4 Traffic Monitor
page.
Table 24-10 L4 Traffic Monitor Report Page Components
Section
Time Range (drop-down list)
Top Client IPs
Description
A menu that allows you to choose a time range on which to report.
For more information, see the
“Changing the Time Range” section on page 23-3
.
This section displays, in graph format, the IP addresses of computers in your organization that most frequently connect to malware sites.
Click the Chart Options link below the chart to change the display from total Malware Connections Detected to Malware
Connections Monitored or Malware Connections Blocked.
This chart is the same as the “L4 Traffic Monitor: Malware
Connections Detected” chart on the
Client Malware Risk Page, page 24-22 .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-29
Chapter 24 Web Security Appliance Reports
L4 Traffic Monitor Page
Table 24-10
Section
Top Malware Sites
Client Source IPs
Malware Ports
L4 Traffic Monitor Report Page Components (continued)
Malware Sites Detected
Description
This section displays, in graph format, the top malware domains detected by the L4 Traffic Monitor.
Click the Chart Options link below the chart to change the display from total Malware Connections Detected to Malware
Connections Monitored or Malware Connections Blocked.
This table displays the IP addresses of computers in your organization that frequently connect to malware sites.
To include only data for a particular port, enter a port number into the box at the bottom of the table and click Filter by Port. You can use this feature to help determine which ports are used by malware that “calls home” to malware sites.
To view details such as the port and destination domain of each connection, click an entry in the table. For example, if one particular client IP address has a high number of Malware
Connections Blocked, click the number in that column to view a list of each blocked connection. The list is displayed as search results in the L4 Traffic Monitor tab on the Reporting > Web
Tracking page. For more information about this list, see
Traffic Monitor Tab, page 24-37
.
This table is the same as the “L4 Traffic Monitor - Clients by
Malware Risk” table on the
Client Malware Risk Page, page 24-22
.
This table displays the ports on which the L4 Traffic Monitor has most frequently detected malware.
To view details, click an entry in the table. For example, click the number of Total Malware Connections Detected to view details of each connection on that port. The list is displayed as search results in the L4 Traffic Monitor tab on the Reporting > Web
Tracking page. For more information about this list, see
Traffic Monitor Tab, page 24-37
.
This table displays the domains on which the L4 Traffic Monitor most frequently detects malware.
To include only data for a particular port, enter a port number into the box at the bottom of the table and click Filter by Port. You can use this feature to help determine whether to block a site or a port.
To view details, click an entry in the table. For example, click the number of Malware Connections Blocked to view the list of each blocked connection for a particular site. The list is displayed as search results in the L4 Traffic Monitor tab on the Reporting >
Web Tracking page. For more information about this list, see
Traffic Monitor Tab, page 24-37
.
24-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Reports by User Location Page
Reports by User Location Page
The Reporting > Reports by User Location page allows you to find out what activities your local and remote users are conducting. For more information on remote and local users, see
Activities include:
•
•
•
•
•
•
URL categories that are being accessed by the local and remote users.
Anti-Malware activity that is being triggered by sites the local and remote users are accessing.
Web Reputation of the sites being accessed by the local and remote users.
Applications that are being accessed by the local and remote users.
Users (local and remote).
Domains accessed by local and remote users.
shows the Reports by User Location page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-31
Reports by User Location Page
Figure 24-13 Reports by User Location Page
Chapter 24 Web Security Appliance Reports
24-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Web Tracking Page
Table 24-11 describes the information on the Reports by User Location
page.
Table 24-11 Reports by User Location Report Page Components
Section
Time Range (drop-down list)
Description
A menu that allows to choose the time range of the data contained in the report. For more information, see the
.
Total Web Proxy Activity: Remote Users
Web Proxy Summary
This section displays, in graph format, the activity of your remote users (vertical) over the specified time (horizontal).
This section displays a summary of the activities of the local and remote users on the network.
Total Web Proxy Activity: Local Users
Suspect Transactions Detected: Remote
Users
This section displays, in graph format, the activity of your remote users (vertical) over the specified time (horizontal).
This section displays, in graph format, the suspect transactions that have been detected due to Access Policies defined for remote users (vertical) over the specified time (horizontal).
Suspect Transactions Summary
Suspect Transactions Detected: Local
Users
This section displays a summary of suspected transactions of the remote users on the network.
This section displays, in graph format, the suspect transactions that have been detected due to Access Policies defined for your remote users (vertical) over the specified time (horizontal).
Suspect Transactions Summary This section displays a summary of suspected transactions of the local users on the network.
From the Reports by User Location page you can generate reports showing the activity of local and remote users. This allows you to easily compare local and remote activities of your users.
Web Tracking Page
Use the Web Tracking page to search for and get details about individual transactions or patterns of transactions that may be of concern. Depending on your needs, search in one or both of the following tabs:
•
Proxy Services Tab, page 24-33
•
L4 Traffic Monitor Tab, page 24-37
Proxy Services Tab
You can use the Proxy Services tab on the Reporting > Web Tracking page to track and report on web usage for a particular user or for all users. This tab aggregates web tracking information from individual security components as well as acceptable use enforcement components and records data that can be used to monitor your web traffic patterns and security risks.
The Proxy Services tab shows results for individual transactions and the results include the hostname and domain in the URL (such as mail.google.com) instead of just the domain name (such as google.com).
You might want to use it to assist the following roles:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-33
Web Tracking Page
Chapter 24 Web Security Appliance Reports
• HR or Legal manager.
Run an investigative report for an employee during a specific time period.
• Network security administrator.
Examine whether the company network is being exposed to malware threats through employees’ smartphones.
You can view search results for the type of transactions logged (blocked, monitored, warned, and completed) during a particular time period. You can also filter the data results using several criteria, such as URL category, malware threat, and application.
After you search for a set of transactions, you can choose which columns to display, and you can sort the data by a column. For more information, see the
“Working with Columns on Report Pages” section on page 23-4 .
Figure 24-14 shows the Proxy Services tab on the Web Tracking page.
Figure 24-14 Proxy Services Tab on the Web Tracking Page
24-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Web Tracking Page
To track web usage for one user or all users, perform the following steps:
Step 1
Step 2
Step 3
Navigate to the Reporting > Web Tracking page.
The Web Tracking page appears.
Click the Proxy Services tab.
Configure the fields defined in Table 24-12
.
Table 24-12 Basic Settings in the Proxy Services Tab on the Web Tracking Page
Setting
Time Range
User/Client IP
Website
Transaction Type
Description
Choose the time range on which to report. For more information, see the
“Changing the Time Range” section on page 23-3 .
Optionally, enter an authentication username as it appears in reports or a client IP address that you want to track. You can also enter an IP range in CIDR format, such as 172.16.0.0/16.
When you leave this field empty, the search returns results for all users.
Optionally, enter a website that you want to track. When you leave this field empty, the search returns results for all websites.
Choose the type of transactions that you want to track, either All Transactions,
Completed, Blocked, Monitored, or Warned.
Step 4 Optionally, expand the Advanced section and configure the fields defined in
to filter the web tracking results with more advanced criteria.
Table 24-13 Advanced Settings in the Proxy Services tab on the Web Tracking Page
Setting
URL Category
Application
Policy
Malware Threat
Description
To filter by a URL category, select Filter by URL Category and type the first letter of a URL category by which to filter. Choose the category from the list that appears.
If the set of URL categories has been updated, some categories may be labeled
“Deprecated”. These categories are no longer being used for new transactions, but you can use them to search for transactions that occurred before the category set update. For more information about updates to the URL Category set, see
Category Set Updates and Reports, page 24-15
.
To filter by an application, select Filter by Application and choose an application by which to filter.
To filter by an application type, select Filter by Application Type and choose an application type by which to filter.
To filter by a policy group, select Filter by Policy and enter a policy group name by which to filter.
To filter by a particular malware threat, select Filter by Malware Threat and enter a malware threat name by which to filter.
To filter by a malware category, select Filter by Malware Category and choose a malware category by which to filter.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-35
Chapter 24 Web Security Appliance Reports
Web Tracking Page
Table 24-13
Setting
WBRS
AnyConnect
Secure Mobility
User Request
Advanced Settings in the Proxy Services tab on the Web Tracking Page (continued)
Description
In the WBRS section, you can filter by web reputation score and by a particular web reputation threat.
• To filter by web reputation score, select Score Range and select the upper and lower values by which to filter. Or, you can filter for websites that have no score by selecting No Score .
• To filter by web reputation threat, select Filter by Reputation Threat and enter a web reputation threat by which to filter.
To filter by the location of users (either remote or local), select Filter by User
Location and choose a user type by which to filter.
To filter by transactions that were initiated by the client, select Filter by
User-Requested Transactions .
Note: When you enable this filter, the search results include some “best guess” transactions.
Step 5 Click Search .
Results are sorted by time stamp, with the most recent result at the top.
Figure 24-15 Web Tracking Search Results in the Proxy Services Tab
Step 6
The number in parentheses below the “Display Details” link is the number of related transactions spawned by the user-initiated transaction, such as images loaded, javascripts run, and secondary sites accessed.
Optionally, click Display Details in the Transactions column to view more detailed information about each transaction.
Note If you need to view more than 1000 results, click the Printable Download link to obtain a CSV file that includes the complete set of raw data, excluding details of related transactions.
Tip If a URL in the results is truncated, you can find the full URL in the access log.
24-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
System Capacity Page
To view details for up to 500 related transactions, click the Related Transactions link.
L4 Traffic Monitor Tab
The L4 Traffic Monitor tab on the Reporting > Web Tracking page provides details about connections to malware sites and ports. You can search for connections to malware sites by the following types of information:
• Time range
•
•
•
•
Site, using IP address or domain
Port
IP address associated with a computer in your organization
Connection type
The first 1000 matching search results are displayed.
Figure 24-16 L4 Traffic Monitor Tab on the Web Tracking Page
To view the hostname at the questionable site, click the Display Details link in the Destination IP
Address column heading.
System Capacity Page
The Reporting > System Capacity page displays current and historical information about resource usage on the Web Security appliance.
You might want to use the System Capacity report to accomplish any of the following tasks:
•
•
Learn when the Web Security appliance is exceeding the recommended capacity to help determine when to upgrade or obtain additional appliances.
Identify historical trends in system behavior which point to upcoming capacity issues which require planning.
• Identify which part of the system is using the most resources to assist with troubleshooting.
shows the first four graphs on the System Capacity page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-37
System Capacity Page
Figure 24-17 System Capacity Page—Upper Graphs
Chapter 24 Web Security Appliance Reports
Figure 24-18 shows the last three graphs on the
System Capacity page.
24-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Figure 24-18 System Capacity Page—Lower Graphs
System Capacity Page
The System Capacity report includes graphs that show the overall CPU usage on the appliance. AsyncOS for Web is optimized to use idle CPU resources to improve transaction throughput. High CPU usage may not indicate a system capacity problem. The CPU Usage by Function graph that displays the percentage of CPU cycles used by different functions, such as the Web Proxy and Logging. The CPU Usage by
Function graph can indicate which appliance components use the most resources. If you need to optimize your appliance, this graph can help you determine which functions may need to be tuned.
The Response Time/Latency and Transactions Per Second graphs shows the overall response time (in milliseconds), and transactions per second for the date range specified in the Time Range drop-down menu.
The lower three graphs on the System Capacity report show the outgoing connections, the bandwidth the appliance uses connecting out to upstream servers, and the size of the Web Proxy memory buffer.
The Proxy Buffer Memory may indicate spikes in network traffic, but if the graph climbs steadily to the maximum, the appliance may be reaching its maximum capacity and you should consider adding capacity.
Interpreting the Data You See on System Capacity Page
When choosing time ranges for viewing data on the System Capacity page, the following is important to remember:
• Hour Report.
The Hour report queries the minute table and displays the exact number of items, such as bytes and connection, that have been recorded by the appliance on an minute by minute basis over a 60 minute period. This information is gathered from the hour table.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-39
System Status Page
Chapter 24 Web Security Appliance Reports
• Day Report.
The Day report queries the hour table and displays the exact number of items, such as bytes and connection, that have been recorded by the appliance on an hourly basis over a 24 hour period. This information is gathered from the hour table.
The Week Report and 30 Days Report work similarly to the Hour and Day Reports.
The “Maximum” value indicator on the System Capacity page is the highest value seen for the specified period. The “Average” value is the average of all values for the specified period. The period of aggregation depends on the interval selected for that report. For example, you can choose to see the
Average and Maximum values for each day if the chart is for a month period.
System Status Page
Use the Reporting > System Status page to monitor the System Status. This page displays the current status and configuration of the Web Security appliance.
describes each section.
Table 24-14 System Status Report Page Components
This Section...
Web Security Appliance
Status
Displays
• System uptime
• System resource utilization — CPU usage, RAM usage, and percentage of disk space used for reporting and logging.
Note
RAM usage for a system that is working efficiently may be above 90%, because RAM that is not otherwise in use by the system is used by the web object cache. If your system is not experiencing serious performance issues and this value is not stuck at 100%, the system is operating normally.
Proxy Buffer Memory is one component that uses this RAM. For more information about this, see the
System Capacity Page, page 24-37
.
24-40
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
Table 24-14
This Section...
Proxy Traffic
Characteristics
System Status Report Page Components (continued)
Current Configuration
Displays
• Transactions per second
•
•
•
•
Cache hit rate
Connections
Web Proxy settings:
•
•
•
•
Bandwidth
Response time
Web Proxy Status — enabled or disabled.
Deployment Topology.
Web Proxy Mode — forward or transparent.
IP Spoofing — enabled or disabled.
L4 Traffic Monitor settings:
• L4 Traffic Monitor Status — enabled or disabled.
•
•
L4 Traffic Monitor Wiring.
L4 Traffic Monitor Action — monitor or block.
Web Security Appliance Version Information
Hardware information
System Status Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-41
System Status Page
Chapter 24 Web Security Appliance Reports
24-42
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 24 Web Security Appliance Reports
System Status Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
24-43
System Status Page
Chapter 24 Web Security Appliance Reports
24-44
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
25
Logging
This chapter contains the following information:
•
•
•
•
•
•
•
•
•
Working with Log Subscriptions, page 25-7
W3C Compliant Access Logs, page 25-26
Custom Formatting in Access Logs and W3C Logs, page 25-28
Including HTTP/HTTPS Headers in Log Files, page 25-36
Malware Scanning Verdict Values, page 25-37
Traffic Monitor Log, page 25-38
Logging Overview
You can use log files to monitor web traffic. To configure the appliance to create log files, you create log subscriptions. A log subscription is an appliance configuration that associates a log file type with a name, logging level, and other parameters, such as size and destination information. You can subscribe to a variety of log file types. For more information about log subscriptions, see
In typical appliance monitoring, the appliance administrator usually reads the following log files:
• Access log.
Records all Web Proxy filtering and scanning activity. For more information about the
access log, see Access Log File, page 25-15
.
• Traffic Monitor log.
Records all L4 Traffic Monitor activity. For more information about the traffic monitor log, see
Traffic Monitor Log, page 25-38 .
The appliance also creates other log file types, such as the system log file. You might want to read other
log files to troubleshoot appliance errors. For a list of each type, see Log File Types, page 25-2
.
The appliance provides several options for customizing the type of information recorded in the access log. For more information, see
Custom Formatting in Access Logs and W3C Logs, page 25-28
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-1
Chapter 25 Logging
Logging Overview
Log File Types
The log file type indicates what information is recorded in the generated log, such as web traffic or system data. By default, the Web Security appliance has log subscriptions for most log file types already created. However, there are some log file types that specific to troubleshooting the Web Proxy. Those
Table 25-1 lists the Web Security appliance log file types created by default.
Table 25-1 Default Log File Types
Log File Type
Access Control
Engine Logs
Access Logs
Authentication
Framework Logs
Description
Records messages related to the Web Proxy ACL
(access control list) evaluation engine.
Records Web Proxy client history.
Records authentication history and messages.
AVC Engine
Framework Logs
Records messages related to communication between the Web Proxy and the AVC engine.
AVC Engine Logs Records debug messages from the AVC engine.
CLI Audit Logs Records a historical audit of command line interface activity.
Configuration Logs Records messages related to the Web Proxy configuration management system.
Supports
Syslog Push?
No
Yes
No
No
Yes
Yes
No
Connection
Management Logs
Records messages related to the Web Proxy connection management system.
Data Security Logs Records client history for upload requests that are evaluated by the Cisco IronPort Data Security
Filters.
For more information on the data security log, see
.
Records messages related to the Cisco IronPort
Data Security Filters.
Data Security
Module Logs
DCA Engine
Framework Logs
(Dynamic Content
Analysis)
DCA Engine Logs
(Dynamic Content
Analysis)
Records messages related to communication between the Web Proxy and the Cisco IronPort Web
Usage Controls Dynamic Content Analysis engine.
Records messages related to the Cisco IronPort
Web Usage Controls Dynamic Content Analysis engine.
No
Yes
No
No
Yes
Enabled by
Default?
No
Yes
Yes
No
Yes
Yes
No
No
Yes
No
No
Yes
25-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Logging Overview
Table 25-1 Default Log File Types (continued)
Log File Type Description
Default Proxy Logs Records errors related to the Web Proxy.
Supports
Syslog Push?
Yes
For more information about Web Proxy logging, see
.
Disk Manager Logs Records Web Proxy messages related to writing to the cache on disk.
No
External
Authentication
Logs
This is the most basic of all Web Proxy related logs.
To troubleshoot more specific aspects related to the
Web Proxy, create a log subscription for the applicable Web Proxy module.
Records messages related to using the external authentication feature, such as communication success or failure with the external authentication server.
Even with external authentication is disabled, this log contains messages about local users successfully or failing logging in.
No
Feedback Logs
FTP Proxy Logs
FTP Server Logs
For more information on external authentication, see
Using External Authentication, page 27-12 .
Records the web users reporting misclassified pages.
Records error and warning messages related to the
FTP Proxy.
Yes
No
Records all files uploaded to and downloaded from the Web Security appliance using FTP.
Yes
Records history of page refreshes in the web interface.
Yes GUI Logs
(Graphical User
Interface)
Haystack Logs
HTTPS Logs
License Module
Logs
Logging
Framework Logs
Logging Logs
McAfee Integration
Framework Logs
McAfee Logs
Haystack logs record web transaction tracking data processing.
Yes
Records Web Proxy messages specific to the
HTTPS Proxy (when the HTTPS Proxy is enabled).
No
Records messages related to the Web Proxy’s license and feature key handling system.
Records messages related to the Web Proxy’s logging system.
No
No
Records errors related to log management.
Records messages related to communication between the Web Proxy and the McAfee scanning engine.
Records the status of anti-malware scanning activity from the McAfee scanning engine.
Yes
No
Yes
Enabled by
Default?
Yes
No
Yes
Yes
No
Yes
Yes
Yes
No
No
No
Yes
No
Yes
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-3
Logging Overview
Chapter 25 Logging
Table 25-1 Default Log File Types (continued)
Log File Type
Memory Manager
Logs
Miscellaneous
Proxy Modules
Logs
AnyConnect Secure
Mobility Daemon
Logs
NTP Logs
(Network Time
Protocol)
Description
Records Web Proxy messages related to managing all memory including the in-memory cache for the
Web Proxy process.
Supports
Syslog Push?
No
Records Web Proxy messages that are mostly used by developers or customer support.
No
Records the interaction between the Web Security appliance and the AnyConnect client, including the status check.
Records changes to the system time made by the
Network Time Protocol.
Yes
Yes
PAC File Hosting
Daemon Logs
Records proxy auto-config (PAC) file usage by clients.
Proxy Bypass Logs Records transactions that bypass the Web Proxy.
Reporting Logs Records a history of report generation.
Records errors related to report generation.
Reporting Query
Logs
Request Debug
Logs
Records very detailed debug information on a specific HTTP transaction from all Web Proxy module log types. You might want to create this log subscription to troubleshoot a proxy issue with a particular transaction without creating all other proxy log subscriptions.
Yes
No
Yes
Yes
No
SaaS Auth Logs
SHD Logs
(System Health
Daemon)
SNMP Logs
Note: You can create this log subscription in the
CLI only.
Records messages related to the SaaS Access
Control feature.
Records a history of the health of system services and a history of unexpected daemon restarts.
Yes
Yes
SNMP Module
Logs
Sophos Integration
Framework Logs
Sophos Logs
Records debug messages related to the SNMP network management engine.
Records Web Proxy messages related to interacting with the SNMP monitoring system.
Yes
No
Records messages related to communication between the Web Proxy and the Sophos scanning engine.
Records the status of anti-malware scanning activity from the Sophos scanning engine.
No
Yes
Status Logs Records information related to the system, such as feature key downloads.
Yes
Enabled by
Default?
No
No
Yes
Yes
Yes
Yes
Yes
Yes
No
Yes
Yes
Yes
No
No
Yes
Yes
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-4
Chapter 25 Logging
Logging Overview
Table 25-1 Default Log File Types (continued)
Log File Type
System Logs
Traffic Monitor
Error Logs
Traffic Monitor
Logs
UDS Logs
(User Discovery
Service)
Description
Records DNS, error, and commit activity.
Records L4TM interface and capture errors.
Records sites added to the L4TM block and allow lists.
Records data about how the Web Proxy discovers the user name without doing actual authentication.
It includes information about interacting with the
Cisco adaptive security appliance for the Secure
Mobility Solution as well as integrating with the
Novell eDirectory server for transparent user identification.
For more information, see
Mobility Overview, page 15-1 and
Users Transparently, page 9-10
.
No
Yes
Yes
Yes
Updater Logs
W3C Logs
Records a history of WBRS and other updates.
Records Web Proxy client history in a W3C compliant format.
For more information, see
.
Records a history of Cisco SensorBase Network participation uploads to the SensorBase network.
WBNP Logs
(SensorBase
Network
Participation)
WBRS Framework
Logs
Records messages related to communication between the Web Proxy and the Web Reputation
Filters.
(Web Reputation
Score)
WCCP Module
Logs
Webcat Integration
Framework Logs
Welcome Page
Acknowledgement
Logs
Records Web Proxy messages related to implementing WCCP.
Records messages related to communication between the Web Proxy and the URL filtering engine associated with Cisco IronPort Web Usage
Controls.
Webroot Integration
Framework Logs
Records messages related to communication between the Web Proxy and the Webroot scanning engine.
Webroot Logs Records the status of anti-malware scanning activity from the Webroot scanning engine.
Records a history of web clients who click the
Accept button on the end-user acknowledgement page.
No
No
No
No
No
Yes
Yes
Supports
Syslog Push?
Yes
Yes
Enabled by
Default?
Yes
Yes
Yes
Yes
Yes
No
Yes
No
No
No
No
Yes
Yes
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-5
Chapter 25 Logging
Logging Overview
Web Proxy Logging
By default, the Web Security appliance has one log subscription created for Web Proxy logging messages, the “Default Proxy Logs.” The Web Proxy information stored in this log covers all aspects, or modules, of the Web Proxy. The appliance also includes log file types for each Web Proxy module so you can read more specific debug information for each module without cluttering up the Default Proxy
Logs.
If a user or administrator encounters an issue with the Web Proxy behavior, read the Default Proxy Logs first. If you see a log entry that you suspect might be the symptom of an issue, then you can create a log subscription for the relevant specific Web Proxy module. Then read that proxy log to help troubleshoot the problem.
You can create log subscriptions of these proxy module logs in web interface or in the CLI. However, you can only create the Request Debug Logs in the CLI.
The following list includes all Web Proxy module log types:
•
•
•
Access Control Engine Logs
AVC Engine Framework Logs
Configuration Logs
Connection Management Logs •
•
•
•
Data Security Module Logs
DCA Engine Framework Logs
Disk Manager Logs
FTP Proxy Logs •
•
•
•
HTTPS Logs
License Module Logs
Logging Framework Logs
McAfee Integration Framework Logs •
•
•
•
Memory Manager Logs
Miscellaneous Proxy Modules Logs
Request Debug Logs
SNMP Module Logs •
•
•
•
Sophos Integration Framework Logs
WBRS Framework Logs
WCCP Module Logs
Webcat Integration Framework Logs •
• Webroot Integration Framework Logs
For a description of each log type, see Table 25-1, `Default Log File Types,' on page 2.
25-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Working with Log Subscriptions
Working with Log Subscriptions
A log subscription is an appliance configuration that specifies the type of log file to create and other factors, such as the log file name and method of retrieving the log file. Use the System Administration
> Log Subscriptions page to configure log file subscriptions.
Figure 25-1 shows the Log Subscriptions page where you work with log subscriptions.
Figure 25-1 Log File Subscriptions
By default, the appliance is configured with one log subscription for most log types. You can add, edit, or delete log subscriptions. You can retrieve log files from the appliance using SCP, FTP, or Syslog. You can create multiple log subscriptions for each type of log file.
The appliance includes more options when configuring the access log:
•
•
Include additional information in each log entry.
For more information about customizing the
access log, see Custom Formatting in Access Logs and W3C Logs, page 25-28 .
Choose the format of the information.
You can choose among the following format options:
–
–
Apache
Squid
– Squid Details
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-7
Chapter 25 Logging
Working with Log Subscriptions
• Exclude entries based on HTTP status codes.
You can configure the access log to not include transactions based on particular HTTP status codes to filter out certain transactions. For example, you might want to filter out authentication failure requests that have codes of 407 or 401.
Log File Name and Appliance Directory Structure
The appliance creates a directory for each log subscription based on the log subscription name. The name of the log file in the directory is composed of the following information:
• Log file name specified in the log subscription
•
•
Timestamp when the log file was started
A single-character status code, either
.c
(signifying current) or
.s
(signifying saved)
The filename of logs are made using the following formula:
/LogSubscriptionName/[email protected]
Note You should only transfer log files with the saved status.
Rolling Over Log Subscriptions
To prevent log files on the appliance from becoming too large, AsyncOS performs a “rollover” and archives a log file when it reaches a user-specified maximum file size or time interval and creates a new file for incoming log data. Based on the retrieval method defined for the log subscription, AsyncOS stores the older log file on the appliance for retrieval or delivers it to an external computer. See
for more information on how to retrieve log files from the appliance.
When AsyncOS rolls over a log file, it performs the following actions:
• Renames the current log file with the timestamp of the rollover and a letter
.s
extension signifying saved.
•
•
•
Creates a new log file with the timestamp of the rollover and designates the file as current with the letter
.c
extension.
Transfers the newly saved log file to a remote host if the log retrieval method is push-based. For a list of the log retrieval methods, see
.
Transfers any existing log files from the same subscription that were not transferred successfully during an earlier attempt (if using the push-based retrieval method).
• Deletes the oldest file in the log subscription if the total number of files to keep on the appliance has been exceeded if using the poll-based retrieval method.
AsyncOS rolls over log subscriptions in the following ways:
•
•
Manually.
The appliance administrator can manually roll over log subscriptions on demand from either the web interface or the CLI. Use the Rollover Now button on the System Administration >
Log Subscriptions page, or the rollovernow CLI command. The rollovernow command allows you to roll over all log files at once or select a specific log file from a list.
Automatically.
AsyncOS rolls over log subscriptions based on the first user-specified limit reached: maximum file size or maximum time. Log subscriptions based on the FTP poll retrieval method create files and store them in the FTP directory on the appliance until they are retrieved from a remote FTP client, or until the system needs to create more space for log files.
25-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Working with Log Subscriptions
Manually Rolling Over Log Subscriptions
To manually roll over log subscriptions using the GUI:
Step 1
Step 2
Step 3
On the System Administration > Log Subscriptions page, mark the checkbox to the right of the log subscriptions you wish to roll over.
Optionally, you can select all log subscriptions for rollover by marking the All checkbox.
Click Rollover Now to roll over the selected logs.
Automatically Rolling Over Log Subscriptions
You define a log subscription’s rollover settings when creating or editing the subscription using the
System Administration > Log Subscriptions page in the GUI or the logconfig command in the CLI. The two settings available for triggering a log file rollover are:
• Maximum file size.
For more information, see
Rollover By File Size, page 25-9 .
• Time interval.
For more information, see
Figure 25-2 shows the rollover settings available for log subscriptions.
Figure 25-2 Log File Rollover Settings for Log Subscriptions
Rollover By File Size
AsyncOS rolls over log files when they reach a maximum file size to prevent them from using too much disk space. When defining a maximum file size for rollovers, use the suffix m
for megabytes and k
for kilobytes. For example, enter
10m
if you want AsyncOS to roll over the log file when it reaches 10 megabytes.
Rollover By Time
If you want to schedule rollovers to occur on a regular basis, you can select one of the following time intervals:
• None. AsyncOS only performs a rollover when the log file reaches the maximum file size.
•
•
Custom Time Interval.
AsyncOS performs a rollover after a specified amount of time has passed since the previous rollover. To create a custom time interval for scheduled rollovers, enter the number of days, hours, and minutes between rollovers using d
, h
, and m
as suffixes.
Daily Rollover.
AsyncOS performs a rollover every day at a specified time. If you choose a daily rollover, enter the time of day you want AsyncOS to perform the rollover using the 24-hour format
(HH:MM). Separate multiple times a day using a comma. Use an asterisk (*) for the hour to specify that AsyncOS should perform the rollover every hour during the day. You can also use an asterisk to rollover every minute of an hour.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-9
Chapter 25 Logging
Working with Log Subscriptions
• Weekly Rollover.
AsyncOS performs a rollover on one or more days of the week at a specified time.
For example, you can set up AsyncOS to rollover the log file every Wednesday and Friday at midnight. To configure a weekly rollover, choose the days of the week to perform the rollover and the time of day in the 24-hour format (HH:MM).
If you are using the CLI, you can use a dash ( ) to specify a range of days, an asterisk ( * ) to specify every day of the week, or a comma ( , ) to separate multiple days and times.
shows the settings available for the Weekly Rollover option.
Figure 25-3 Weekly Rollover Settings
Working with Compressed Log Files
To save disk space on the Web Security appliance, log subscriptions can compress rolled over log files before storing them on the disk. Only rolled over logs are compressed. The current active log file is not compressed.
Each log subscription has its own log compression setting, so you can choose which log subscriptions to compress. AsyncOS compresses log files using the gzip compression format.
Viewing the Most Recent Log Files
You can view a the most recent version of a log file from the following locations:
• Web interface.
On the System Administration > Log Subscriptions page, click the name of the log subscription in the Log Files column of the list of log subscriptions. When you click the link to the log subscription, AsyncOS prompts you to enter your password. Then it lists the available log files for that subscription. Click one of the log files to view it in your browser or to save it to disk.
• Command line interface.
Use the tail CLI command. AsyncOS displays the configured log subscriptions and prompts you to select the log subscription to view. Use Ctrl+C to exit from the tail command at any time.
Note If a log subscription is compressed, you must download it before you can decompress and open it.
Configuring Host Keys
Use the logconfig -> hostkeyconfig
subcommand to manage host keys for use with SSH when pushing log files to other servers from the Web Security appliance. SSH servers must have a pair of host keys, one private and one public. The private host key resides on the SSH server and cannot be read by remote machines. The public host key is distributed to any client machine that needs to interact with the
SSH server.
25-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Working with Log Subscriptions
The hostkeyconfig
subcommand performs the following functions:
Table 25-2 Managing Host Keys—List of Subcommands
Command
New
Scan
Host
Fingerprint
User
Description
Add a new key.
Automatically download a host key.
Display system host keys. This is the value to place in the remote system’s
‘known_hosts’ file.
Display system host key fingerprints.
Displays the public key of the system account that pushes the logs to the remote machine. This is the same key that is displayed when setting up an SCP push subscription. This is the value to place in the remote system’s ‘authorized_keys’ file.
Adding and Editing Log Subscriptions
To add or edit a log subscription:
Step 1
Step 2
Step 3
Step 4
Step 5
Navigate to the System Administration > Log Subscriptions page.
To add a log subscription, click Add Log Subscription . Or, to edit a log subscription, click the name of the log file in the Log Name field.
The New Log Subscription page or Edit Log Subscription page appears.
Select the type of log to associate with this subscription from the Log Type field.
Enter a name for the log subscription in the Log Name field.
The appliance uses this name for the directory on the appliance that will contain the log file.
If you are creating an access log, configure the following options:
Access Log Option Description
Log Style Choose the log format to use, either Squid, Apache, or Squid Details.
Custom Fields Optionally, enter the other type of information to include in each access log entry. For more information, see
Custom Formatting in Access Logs and W3C
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-11
Chapter 25 Logging
Working with Log Subscriptions
Step 6 If you are creating a W3C access log, configure the following options:
Access Log Option Description
Log Fields Choose the fields you want to include in the W3C access log.
Select a field in the Available Fields list, or type a field in the Custom Field box, and click Add . The order the fields appear in the Selected Log Fields list determines the order of fields in the W3C access log file. You can change the order of fields using the Move Up and Move Down buttons. You can remove a field by selecting it in the Selected Log Fields list and clicking Remove .
You can enter multiple user defined fields in the Custom Fields box and add them simultaneously as long as each entry is separated by a new line (click
Enter) before clicking Add .
For more information, see
W3C Compliant Access Logs, page 25-26
.
Note When you change the log fields included in a W3C log subscription, the log subscription automatically rolls over. This allows the latest version of the log file to include the correct new field headers.
Step 7
Step 8
Step 9
Step 10
Step 11
Enter a name for the log file in the File Name field.
Enter the maximum file size in bytes the log file can be in the Maximum File Size field. After the number, enter “G” to specify Gigabytes, “M” for Megabytes, or “K” for Kilobytes.
Choose whether or not to compress log files after they have been rolled over using the Log Compression field.
For more information, see
Working with Compressed Log Files, page 25-10
.
If you are creating an access log or a W3C access log, you can optionally choose to exclude certain transactions based on particular HTTP status codes in the Log Exclusions field. For example, you might want to filter out authentication failure requests that have codes of 407 or 401.
Choose the amount of detail to include in the log file in the Log Level field.
The Log Level field does not appear for access and W3C access logs subscriptions
More detailed settings create larger log files and have a greater impact on system performance. More detailed settings include all the messages contained in less detailed settings, plus additional messages.
As the level of detail increases, system performance decreases.
Table 25-3 describes the levels of detail you can choose in the Log Level field.
Table 25-3 Logging Levels
Log Level
Critical
Warning
Description
This is the least detailed setting. This level only includes errors. Using this setting will not allow you to monitor performance and other important activities. However, the log files will not reach their maximum size as quickly. This log level is equivalent to the syslog level “Alert.”
This level includes all errors and warnings created by the system. Using this setting will not allow you to monitor performance and other important activities. This log level is equivalent to the syslog level “Warning.”
25-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Working with Log Subscriptions
Table 25-3
Log Level
Information
Debug
Trace
Logging Levels (continued)
Description
This level includes the detailed system operations. This is the default. This log level is equivalent to the syslog level “Info.”
This level includes data useful for debugging system problems. Use the Debug log level when you are trying to discover the cause of an error. Use this setting temporarily, and then return to the default level. This log level is equivalent to the syslog level “Debug.”
This is the most detailed setting. This level includes a complete record of system operations and activity. The Trace log level is recommended only for developers.
Using this level causes a serious degradation of system performance and is not recommended. This log level is equivalent to the syslog level “Debug.”
Step 12 Choose how to retrieve the log file from the appliance in the Retrieval Method field.
describes the different ways you can retrieve log files:
Table 25-4 Log Transfer Protocols
Retrieval Method
FTP on Appliance
(FTP Poll)
FTP on Remote
Server
(FTP Push)
Description
This method requires a remote FTP client accessing the appliance to retrieve log files using an admin or operator user’s username and password.
When you choose this method, you must enter the maximum number of log files to store on the appliance. When the maximum number is reached, the system deletes the oldest file.
This is the default.
This method periodically pushes log files to an FTP server on a remote computer.
When you choose this method, you must enter the following information:
•
•
•
Maximum time between file transfers
FTP server hostname
•
Directory on FTP server to store the log file
Username and password of a user that has permission to connect to the FTP server
Note: AsyncOS for Web only supports passive mode for remote FTP servers. It cannot push log files to an FTP server in active mode.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-13
Chapter 25 Logging
Working with Log Subscriptions
Table 25-4
Syslog Push
Log Transfer Protocols (continued)
Retrieval Method
SCP on Remote
Server
(SCP Push)
Description
This method periodically pushes log files using the secure copy protocol to an
SCP server on a remote computer. This method requires an SSH SCP server on a remote computer using the SSH1 or SSH2 protocol. The subscription requires a user name, SSH key, and destination directory on the remote computer. Log files are transferred based on a rollover schedule set by you.
When you choose this method, you must enter the following information:
• Maximum time between file transfers
•
•
•
•
Protocol to use for transmission, either SSH1 or SSH2
SCP server hostname
Directory on SCP server to store the log file
Username of a user that has permission to connect to the SCP server
Choose whether or not to enable host key checking.
This method sends log messages to a remote syslog server. This method conforms to RFC 3164. The appliance uses port 514.
When you choose this method, you must enter the following information:
•
•
Syslog server hostname
Protocol to use for transmission, either UDP or TCP
• Facility to use with the log
You can only choose syslog for text-based logs.
Note Syslog messages greater than 1024 bytes are truncated. Access logs and
W3C access logs with many custom variables, especially of variable length, might exceed the 1024 byte limit.
Step 13
Step 14
Submit and commit your changes.
If you chose SCP as the retrieval method, the appliance displays an SSH key to you must place on the
SCP server host.
Deleting a Log Subscription
To delete a log subscription:
Step 1
Step 2
Step 3
Navigate to the System Administration > Log Subscriptions page.
Click the icon under the Delete column for the log subscription you want to delete.
Submit and commit your changes.
25-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Access Log File
The access log file provides a descriptive record of all Web Proxy filtering and scanning activity. Access log file entries display a record of how the appliance handled each transaction. You can view the access log file from the System Administration > Log Subscriptions page.
Note The W3C access log also records all Web Proxy filtering and scanning activity, but in a format that is
W3C compliant. For more information, see
W3C Compliant Access Logs, page 25-26 .
The following text is an example access log file entry for a single transaction:
1278096903.150 97 172.xx.xx.xx TCP_MISS/200 8187 GET http://my.site.com/ -
DIRECT/my.site.com text/plain
DEFAULT_CASE_11-AccessOrDecryptionPolicy-Identity-OutboundMalwareScanningPolicy-DataSecu rityPolicy-ExternalDLPPolicy-RoutingPolicy
<IW_comp,6.9,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_comp,-,"-","-","Unknown","Un known","-","-",198.34,0,-,[Local],"-","-"> -
Format Specifier
%t
%e
%a
%w
%h
%s
%2r
%A
describes the different fields in the access log file entry.
Table 25-5 Access Log File Entry Fields
Field Value
1278096903.150
97
172.xx.xx.xx
TCP_MISS
200
8187
GET http://my.site.com/
-
Field Description
Timestamp since UNIX epoch.
Elapsed time (latency) in milliseconds.
Client IP address.
Note: You can choose to mask the IP address in the access logs using the advancedproxyconfig > authentication
CLI command.
Transaction result code.
For more information, see Transaction Result Codes, page 25-17
.
HTTP response code.
Response size (headers + body).
First line of the request.
Note: When the first line of the request is for a native FTP transaction, some special characters in the file name are URL encoded in the access logs. For example, the “@” symbol is written as “%40” in the access logs.
The following characters are URL encoded:
& # % + , : ; = @ ^ { } [ ]
Authenticated username.
Note: You can choose to mask the username in the access logs using the advancedproxyconfig > authentication
CLI command.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-15
Chapter 25 Logging
Access Log File
Format Specifier
%H
%d
%c
%D
N/A (Part of the
ACL decision tag)
N/A (Part of the
ACL decision tag)
N/A (Part of the
ACL decision tag)
N/A (Part of the
ACL decision tag)
N/A (Part of the
ACL decision tag)
Table 25-5
Field Value
DIRECT my.site.com
text/plain
DEFAULT_CASE_11
OutboundMalwareScanning
Policy
Access Log File Entry Fields (continued)
AccessOrDecryptionPolicy
Identity
DataSecurityPolicy
ExternalDLPPolicy
Field Description
Code that describes which server was contacted for the retrieving the request content.
Most common values include:
• NONE.
The Web Proxy had the content, so it did not contact any other server to retrieve the content.
•
•
DIRECT.
The Web Proxy went to the server named in the request to get the content.
DEFAULT_PARENT.
The Web Proxy went to its primary parent proxy or an external DLP server to get the content.
Data source or server IP address.
Response body MIME type.
ACL decision tag.
Note: The end of the ACL decision tag includes a dynamically generated number that the Web Proxy uses internally. You can ignore this number.
For more information, see
.
Access Policy or Decryption Policy group name. When the transaction matches the global Access Policy or global Decryption
Policy, this value is “DefaultGroup.”
Any space in the policy group name is replaced with an underscore
( _ ).
Identity policy group name.
Any space in the policy group name is replaced with an underscore
( _ ).
Outbound Malware Scanning Policy group name.
Any space in the policy group name is replaced with an underscore
( _ ).
Cisco IronPort Data Security Policy group name. When the transaction matches the global Cisco IronPort Data Security
Policy, this value is “DefaultGroup.” This policy group name only appears when Cisco IronPort Data Security Filters is enabled.
“NONE” appears when no Data Security Policy was applied.
Any space in the policy group name is replaced with an underscore
( _ ).
External DLP Policy group name. When the transaction matches the global External DLP Policy, this value is “DefaultGroup.”
“NONE” appears when no External DLP Policy was applied.
Any space in the policy group name is replaced with an underscore
( _ ).
25-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Table 25-5 Access Log File Entry Fields (continued)
Format Specifier
N/A (Part of the
ACL decision tag)
%Xr
Field Value
RoutingPolicy
%?BLOCK_SUSPE
CT_USER_AGENT,
-
MONITOR_SUSPE
CT_USER_AGENT
?%<User-Agent:%!
%-%.
<IW_comp,6.9,-,"-",-,-,-,-,"
-",-,-,-,"-",-,-,"-","-",-,-
,IW_comp,-,"-","-","Unknown"
,"Unknown","-","-",198.34,0,
-,[Local],"-","-">
Field Description
Routing Policy group name as
ProxyGroupName/ProxyServerName .
When the transaction matches the global Routing Policy, this value is “DefaultRouting.” When no upstream proxy server is used, this value is “DIRECT.”
Any space in the policy group name is replaced with an underscore
( _ ).
Scanning verdict information. Inside the angled brackets, the access logs include verdict information from various scanning engines.
For more information about the values included within the angled brackets, see
Understanding Scanning Verdict Information, page 25-21 .
Suspect user agent.
Transaction Result Codes
Transaction result codes in the access log file describe how the appliance resolves client requests. For example, if a request for an object can be resolved from the cache, the result code is TCP_HIT . However, if the object is not in the cache and the appliance pulls the object from an origin server, the result code is TCP_MISS . The following table describes transaction result codes.
Table 25-6 Transaction Result Codes
Result Code
TCP_HIT
TCP_IMS_HIT
TCP_MEM_HIT
TCP_MISS
TCP_REFRESH_HIT
TCP_CLIENT_REFRESH_MISS
Description
The object requested was fetched from the disk cache.
The client sent an IMS (If-Modified-Since) request for an object and the object was found in the cache. The proxy responds with a 304 response.
The object requested was fetched from the memory cache.
The object was not found in the cache, so it was fetched from the origin server.
The object was in the cache, but had expired. The proxy sent an IMS
(If-Modified-Since) request to the origin server, and the server confirmed that the object has not been modified. Therefore, the appliance fetched the object from either the disk or memory cache.
The client sent a “don’t fetch response from cache” request by issuing the ‘Pragma: no-cache’ header. Due to this header from the client, the appliance fetched the object from the origin server.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-17
Access Log File
Chapter 25 Logging
Table 25-6
Result Code
TCP_DENIED
NONE
Transaction Result Codes (continued)
Description
The client request was denied due to Access Policies.
There was an error in the transaction. For example, a DNS failure or gateway timeout.
ACL Decision Tags
An ACL decision tag is a field in an access log entry that indicates how the Web Proxy handled the transaction. It includes information from the Web Reputation filters, URL categories, and the scanning engines.
Note The end of the ACL decision tag includes a dynamically generated number that the Web Proxy uses internally to increase performance. You can ignore this number.
Table 25-7 describes the ACL decision tag values.
Table 25-7 ACL Decision Tag Values
ACL Decision Tag
ALLOW_ADMIN
ALLOW_ADMIN_ERROR_PAGE
ALLOW_CUSTOMCAT
ALLOW_WBRS
BLOCK_ADMIN
BLOCK_ADMIN_CONNECT
BLOCK_ADMIN_CUSTOM_USER_AGENT
BLOCK_ADMIN_IDS
BLOCK_ADMIN_FILE_TYPE
BLOCK_ADMIN_PROTOCOL
Description
The Web Proxy allowed the transaction based on
Applications settings for the Access Policy group.
The Web Proxy allowed the transaction to an IronPort notification page and to any logo used on that page.
The Web Proxy allowed the transaction based on custom
URL category filtering settings for the Access Policy group.
The Web Proxy allowed the transaction based on the Web
Reputation filter settings for the Access Policy group.
The Web Proxy blocked the transaction based on
Applications or Objects settings for the Access Policy group.
The Web Proxy blocked the transaction based on the TCP port of the destination as defined in the HTTP CONNECT
Ports setting for the Access Policy group.
The Web Proxy blocked the transaction based on the user agent as defined in the Block Custom User Agents setting for the Access Policy group.
The Web Proxy blocked the transaction based on the MIME type of the request body content as defined in the Data
Security Policy group.
The Web Proxy blocked the transaction based on the file type as defined in the Access Policy group.
The Web Proxy blocked the transaction based on the protocol as defined in the Block Protocols setting for the
Access Policy group.
25-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Table 25-7 ACL Decision Tag Values (continued)
ACL Decision Tag
BLOCK_ADMIN_SIZE
BLOCK_ADMIN_SIZE_IDS
BLOCK_AMW_REQ
BLOCK_AMW_RESP
BLOCK_AMW_RESP_URL
BLOCK_AVC
BLOCK_CONTENT_UNSAFE
BLOCK_CONTINUE_CONTENT_UNSAFE
BLOCK_CONTINUE_CUSTOMCAT
BLOCK_CONTINUE_WEBCAT
BLOCK_CUSTOMCAT
BLOCK_ICAP
BLOCK_SEARCH_UNSAFE
BLOCK_SUSPECT_USER_AGENT
Description
The Web Proxy blocked the transaction based on the size of the response as defined in the Object Size settings for the
Access Policy group.
The Web Proxy blocked the transaction based on the size of the request body content as defined in the Data Security
Policy group.
The Web Proxy blocked the request based on the
Anti-Malware settings for the Outbound Malware Scanning
Policy group. The request body produced a positive malware verdict.
The Web Proxy blocked the response based on the
Anti-Malware settings for the Access Policy group.
The Web Proxy suspects the URL in the HTTP request might not be safe, so it blocked the transaction at request time based on the Anti-Malware settings for the Access
Policy group.
The Web Proxy blocked the transaction based on the configured Application settings for the Access Policy group.
The Web Proxy blocked the transaction based on the site content ratings settings for the Access Policy group. The client request was for adult content and the policy is configured to block adult content.
The Web Proxy blocked the transaction and displayed the
Warn and Continue page based on the site content ratings settings in the Access Policy group. The client request was for adult content and the policy is configured to give a warning to users accessing adult content.
The Web Proxy blocked the transaction and displayed the
Warn and Continue page based on a custom URL category in the Access Policy group configured to “Warn.”
The Web Proxy blocked the transaction and displayed the
Warn and Continue page based on a predefined URL category in the Access Policy group configured to “Warn.”
The Web Proxy blocked the transaction based on custom
URL category filtering settings for the Access Policy group.
The Web Proxy blocked the request based on the verdict of the external DLP system as defined in the External DLP
Policy group.
The client request included an unsafe search query and the
Access Policy is configured to enforce safe searches, so the original client request was blocked.
The Web Proxy blocked the transaction based on the
Suspect User Agent setting for the Access Policy group.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-19
Access Log File
Chapter 25 Logging
Table 25-7
ACL Decision Tag
BLOCK_UNSUPPORTED_SEARCH_APP
BLOCK_WBRS
BLOCK_WBRS_IDS
BLOCK_WEBCAT
DEFAULT_CASE
MONITOR_AVC
ACL Decision Tag Values (continued)
BLOCK_WEBCAT_IDS
MONITOR_AMW_RESP
MONITOR_AMW_RESP_URL
MONITOR_CONTINUE_CONTENT_UNSAFE
MONITOR_CONTINUE_CUSTOMCAT
MONITOR_CONTINUE_WEBCAT
Description
The Web Proxy blocked the transaction based on the safe search settings for the Access Policy group. The transaction was for an unsupported search engine, and the policy is configured to block unsupported search engines.
The Web Proxy blocked the transaction based on the Web
Reputation filter settings for the Access Policy group.
The Web Proxy blocked the upload request based on the
Web Reputation filter settings for the Data Security Policy group.
The Web Proxy blocked the transaction based on URL category filtering settings for the Access Policy group.
The Web Proxy blocked the upload request based on the
URL category filtering settings for the Data Security Policy group.
The Web Proxy allowed the client to access the server because none of the AsyncOS services, such as Web
Reputation or anti-malware scanning, took any action on the transaction.
The Web Proxy monitored the server response based on the
Anti-Malware settings for the Access Policy group.
The Web Proxy suspects the URL in the HTTP request might not be safe, but it monitored the transaction based on the Anti-Malware settings for the Access Policy group.
The Web Proxy monitored the transaction based on the
Application settings for the Access Policy group.
Originally, the Web Proxy blocked the transaction and displayed the Warn and Continue page based on the site content ratings settings in the Access Policy group. The client request was for adult content and the policy is configured to give a warning to users accessing adult content. The user accepted the warning and continued to the originally requested site, and no other scanning engine subsequently blocked the request.
Originally, the Web Proxy blocked the transaction and displayed the Warn and Continue page based on a custom
URL category in the Access Policy group configured to
“Warn.” The user accepted the warning and continued to the originally requested site, and no other scanning engine subsequently blocked the request.
Originally, the Web Proxy blocked the transaction and displayed the Warn and Continue page based on a predefined URL category in the Access Policy group configured to “Warn.” The user accepted the warning and continued to the originally requested site, and no other scanning engine subsequently blocked the request.
25-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Table 25-7
ACL Decision Tag
MONITOR_IDS
MONITOR_SUSPECT_USER_AGENT
MONITOR_WBRS
NO_PASSWORD
REDIRECT_CUSTOMCAT
SAAS_AUTH
OTHER
ACL Decision Tag Values (continued)
NO_AUTHORIZATION
Description
The Web Proxy scanned the upload request using either a
Data Security Policy or an External DLP Policy, but did not block the request. It evaluated the request against the
Access Policies.
The Web Proxy monitored the transaction based on the
Suspect User Agent setting for the Access Policy group.
The Web Proxy monitored the transaction based on the Web
Reputation filter settings for the Access Policy group.
The Web Proxy did not allow the user access to the SaaS application because the user was already authenticated against an authentication realm, but not against any authentication realm configured in the SaaS Application
Authentication Policy.
The user failed authentication.
The Web Proxy redirected the transaction to a different
URL based on a custom URL category in the Access Policy group configured to “Redirect.”
The Web Proxy allowed the user access to the SaaS application because the user was authenticated transparently against the authentication realm configured in the SaaS Application Authentication Policy.
The Web Proxy did not complete the request due to an error, such as an authorization failure, server disconnect, or an abort from the client.
Understanding Scanning Verdict Information
The access log file entries aggregate and display the results of the various scanning engines, such as URL filtering, Web Reputation filtering, and anti-malware scanning. The appliance displays this information in angled brackets at the end of each access log entry.
The following text is the scanning verdict information from an access log file entry. In this example, the
Webroot scanning engine found the malware:
<IW_infr,ns,24,"Trojan-Phisher-Gamec",0,354385,12559,
-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_infr,-,"Trojan
Phisher","-","Unknown","Unknown","-","-",489.73,0,[Local],"-","-">
Note For an example of a whole access log file entry, see
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-21
Chapter 25 Logging
Access Log File
Table 25-8
file entry.
Access Log File Entry — Scanning Verdict Information
Position and Format
Specifier position 1
%XC position 2
%XW position 3
%Xv position 4
“%Xn” position 5
%Xt position 6
%Xs position 7
%Xi position 8
%Xd position 9
“%Xe” position 10
%Xf position 11
%Xg position 12
%Xh
Field Value
IW_infr ns
Description
The URL category assigned to the transaction, abbreviated. This field shows
“nc” when no category is assigned.
For a list of URL category abbreviations, see
URL Category Descriptions, page 18-27 .
Web Reputation filters score. This field either shows the score as a number,
“ns” for “no score,” or “dns” when there is a DNS lookup error.
24
“Trojan-Phisher-Gamec
”
0
354385
12559
-
“-”
-
-
-
The malware scanning verdict Webroot passed to the DVS engine.
Applies to responses detected by Webroot only.
For more information, see
Malware Scanning Verdict Values, page 25-37
.
Name of the spyware that is associated with the object.
Applies to responses detected by Webroot only.
The Webroot specific value associated with the Threat Risk Ratio (TRR) value that determines the probability that malware exists.
Applies to responses detected by Webroot only.
A value that Webroot uses as a threat identifier. Cisco IronPort Customer
Support may use this value when troubleshooting an issue.
Applies to responses detected by Webroot only.
A value that Webroot uses as a trace identifier. Cisco IronPort Customer
Support may use this value when troubleshooting an issue.
Applies to responses detected by Webroot only.
The malware scanning verdict McAfee passed to the DVS engine.
Applies to responses detected by McAfee only.
For more information, see
Malware Scanning Verdict Values, page 25-37
.
The name of the file McAfee scanned.
Applies to responses detected by McAfee only.
A value that McAfee uses as a scan error. Cisco IronPort Customer Support may use this value when troubleshooting an issue.
Applies to responses detected by McAfee only.
A value that McAfee uses as a detection type. Cisco IronPort Customer
Support may use this value when troubleshooting an issue.
Applies to responses detected by McAfee only.
A value that McAfee uses as a virus type. Cisco IronPort Customer Support may use this value when troubleshooting an issue.
Applies to responses detected by McAfee only.
25-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Table 25-8 position 15
%Xx position 16
“%Xy” position 17
“%Xz” position 18
%Xl position 19
%Xp position 20
%XQ
Access Log File Entry — Scanning Verdict Information (continued)
Position and Format
Specifier position 13
“%Xj” position 14
%XY
Field Value
“-”
-
-
“-”
“-”
-
-
IW_infr
Description
The name of the virus that McAfee scanned.
Applies to responses detected by McAfee only.
The malware scanning verdict Sophos passed to the DVS engine.
Applies to responses detected by Sophos only.
For more information, see
Malware Scanning Verdict Values, page 25-37 .
A value that Sophos uses as a scan return code. Cisco IronPort Customer
Support may use this value when troubleshooting an issue.
Applies to responses detected by Sophos only.
The file location where Sophos found the objectionable content. For non-archive files, this value is the file name itself. For archive file, it is the object in the archive, such as archive.zip/virus.exe
.
Applies to responses detected by Sophos only.
A value that Sophos uses as the threat name. Cisco IronPort Customer
Support may use this value when troubleshooting an issue.
Applies to responses detected by Sophos only.
The Cisco IronPort Data Security scan verdict based on the action in the
Content column of the Cisco IronPort Data Security Policy.
The following list describes the possible values for this field:
• 0.
Allow
•
•
1.
Block
- (hyphen).
No scanning was initiated by the Cisco IronPort Data
Security Filters. This value appears when the Cisco IronPort Data
Security Filters is disabled or when the URL category action is set to
Allow.
The External DLP scan verdict based on the result given in the ICAP response.
The following list describes the possible values for this field:
•
•
0.
Allow
1.
Block
• - (hyphen).
No scanning was initiated by the external DLP server. This value appears when External DLP scanning is disabled or when the content was not scanned due to an exempt URL category on the External
DLP Policies > Destinations page.
The URL category verdict determined during request-side scanning, abbreviated.
This field lists a hyphen ( - ) when URL filtering is disabled.
For a list of URL category abbreviations, see
URL Category Descriptions, page 18-27
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-23
Chapter 25 Logging
Access Log File position 23
“%Xk” position 24
“%XO” position 25
“%Xu” position 26
“%Xb” position 27
“%XS”
Table 25-8 position 22
“%XZ”
Access Log File Entry — Scanning Verdict Information (continued)
Position and Format
Specifier position 21
%XA
Field Value
-
“Trojan Phisher”
“-”
“Unknown”
“Unknown”
“-”
“-”
489.73
Description
The URL category verdict determined by the Dynamic Content Analysis engine during response-side scanning, abbreviated. Applies to the Cisco
IronPort Web Usage Controls URL filtering engine only. Only applies when the Dynamic Content Analysis engine is enabled and when no category is assigned at request time (a value of “nc” is listed in the request-side scanning verdict).
For a list of URL category abbreviations, see
URL Category Descriptions, page 18-27 .
Unified response-side anti-malware scanning verdict that provides the malware category independent of which scanning engines are enabled.
Applies to transactions blocked or monitored due to server response scanning.
The threat type returned by the Web Reputation filters which resulted in the target website receiving a poor reputation. Typically, this field is populated for sites at reputation of -4 and below.
The application name as returned by the AVC engine, if applicable.
Only applies when the AVC engine is enabled.
The application type as returned by the AVC engine, if applicable.
Only applies when the AVC engine is enabled.
The application behavior as returned by the AVC engine, if applicable.
Only applies when the AVC engine is enabled.
Safe browsing scanning verdict. This value indicates whether or not either the safe search or site content ratings feature was applied to the transaction.
For a list of the possible values, see
Logging Adult Content Access, page 18-20 .
The average bandwidth consumed serving the request in Kb per second.
position 28
%XB position 29
%XT position 30
%l position 31
“%X3” position 32
“%X4”
0
[Local]
“-”
“-”
A value that indicates whether or not the request was throttled due to bandwidth limit control settings. “1” indicates the request was throttled, “0” indicates it was not.
The type of user making the request, either “[Local]” or “[Remote].” Only applies when AnyConnect Secure Mobility is enabled. When it is not enabled, the value is a hyphen (-).
Unified request-side anti-malware scanning verdict independent of which scanning engines are enabled. Applies to transactions blocked or monitored due to client request scanning when an Outbound Malware Scanning Policy applies.
The threat name assigned to the client request that was blocked or monitored due to an applicable Outbound Malware Scanning Policy.
This threat name is independent of which anti-malware scanning engines are enabled.
25-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Access Log File
Web Reputation Filters Example
In the following example, the URL request was allowed because the URL’s Web Reputation score was high enough to qualify to be allowed without being scanned for malware.
1278100150.818 1303 172.xx.xx.xx TCP_MISS/200 46578 GET http://www.cisco.com/ -
DIRECT/www.cisco.com - ALLOW_WBRS_11-AccessPolicy-Identity-NONE-NONE-NONE-DefaultGroup
<IW_comp,6.5,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_comp,-,"-","-","Unknown","Un known","-","-",285.97,0,-,[Local],"-","-"> -
In this example, “6.5” is the Web Reputation score. The hyphen “
-
” values indicate the request was not forwarded to the DVS engine for anti-malware scanning. The ACL decision tag “ALLOW_WBRS” indicates that the request was allowed, and therefore not forwarded for anti-malware scanning, based on this Web Reputation score.
Anti-Malware Request Example
In the following example, the Webroot scanning engine scanned the URL request and assigned a malware scanning verdict based on the URL request. Webroot is the only scanning engine that scans a
URL request. For more information about Webroot scanning, see Webroot Scanning, page 20-6
.
1278106367.381 170 172.xx.xx.xx TCP_DENIED/403 1828 GET http://www.gator.com/ - NONE/- -
BLOCK_AMW_RESP_URL_11-AccessPolicy-Identity-OMSPolicy-NONE-NONE-NONE
<IW_busi,3.4,13,"GAIN - Common
Components",95,37607,10,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_busi,-,"Adware","-",
"Unknown","Unknown","-","-",86.02,0,-,[Local],"-","-">
In this example, “3.4” is the Web Reputation score, indicating to scan the website for malware.
Therefore, the Web Proxy passed the request to the DVS engine for anti-malware scanning.
The 13 value corresponds to “Adware” which is the malware scanning verdict that Webroot passed to the
DVS engine. The “BLOCK_AMW_RESP_URL” ACL decision tag shows that Webroot’s request-side checking of the URL produced this verdict. The remainder of the fields show the malware name (“GAIN
- Common Components”), threat risk rating (“95”), threat ID (“37607”), and trace ID (“10”) values, which Webroot derived from its evaluation. All of the McAfee and Sophos-related values are empty (“-”) because neither the McAfee or Sophos scanning engine scanned the URL request.
Anti-Malware Response Example
In the following example, the McAfee scanning engine scanned the server response, assigned a malware scanning verdict based on the server response, and blocked it from the user.
1278097193.276 51 172.xx.xx.xx TCP_DENIED/403 3122 GET http://badsite.com/malware.exe -
DIRECT/badsite.com application/x-dosexec
BLOCK_AMW_RESP_11-AccessPol-Identity-NONE-NONE-NONE-DefaultGroup
<IW_infr,3.0,24,"Trojan-Phisher-Gamec",0,354385,12559,
-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_infr,-,"Trojan
Phisher","-","Unknown","Unknown","-","-",489.73,0,[Local],"-","-"> -
The following list explains the values in this access log entry that show that this transaction was blocked based on the result of the Webroot scanning engine:
• TCP_DENIED.
The website was denied due to Access Policies.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-25
Chapter 25 Logging
W3C Compliant Access Logs
•
•
•
•
BLOCK_AMW_RESP_11-AccessPol.
This transaction matched the “AccessPol” Access Policy group, and the due to the settings defined in that policy group, the server response was blocked due to detected malware.
3.0 in the angled brackets.
The URL received a Web Reputation Score of 3.0, which fell in the score range to scan further.
24 in the angled brackets.
The malware scanning verdict Webroot passed to the DVS engine which corresponds to Trojan Phisher.
“Trojan-Phisher-Gamec”.
The name of the malware that Webroot scanned.
W3C Compliant Access Logs
The Web Security appliance provides two different log types for recording Web Proxy transaction information, the access logs and the W3C access logs. The W3C access logs are W3C compliant, and record transaction history in the W3C Extended Log File (ELF) Format.
You can create multiple W3C access log subscriptions and define the data to include in each. You might want to create one W3C access log that includes all information your organization typically needs, and other, specialized W3C access logs that can be used for troubleshooting purposes or special analysis. For example, you might want to create a W3C access log for an HR manager that only needs access to certain information.
Consider the following rules and guidelines when working with W3C access logs:
• You define what data is recorded in each W3C access log subscription.
•
•
•
The W3C logs are self-describing. The file format (list of fields) is defined in a header at the start of each log file.
Fields in the W3C access logs are separated by a white space.
•
If a field contains no data for a particular entry, a hyphen ( - ) is included in the log file instead.
Each line in the W3C access log file relates to one transaction, and each line is terminated by a LF sequence.
•
•
•
When defining a W3C access log subscription, you can choose from a list of predefined log fields or enter a custom log field. For more information, see
Working with Log Fields in W3C Access
If you want to use a third party log analyzer tool to read and parse the W3C access logs, you might need to include the “timestamp” field. The timestamp W3C field displays time since the UNIX epoch, and most log analyzers only understand time in this format.
If you want to copy the log fields included in a W3C access log in their order, use the logconfig > edit CLI command. The CLI displays the log fields in order, from which you can copy and then paste them into a separate Web Security appliance web interface.
W3C Log File Headers
Each W3C log file contains header text at the beginning of the file. Each line starts with the # character and provides information about the Web Security appliance that created the log file. The W3C log file headers also include the file format (list of fields), making the log file self-describing.
25-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
W3C Compliant Access Logs
describes the header fields listed at the beginning of each W3C log file.
Table 25-9 W3C Log File Header Fields
Header Field Description
Version The version of the W3C ELF format used.
Date
System
The date and time at which the entry was added.
The Web Security appliance that generated the log file in the format “Management_IP
- Management_hostname.”
Software
Fields
The Software which generated these logs
The fields recorded in the log
For example, a W3C log file might contain the following header information:
#Version: 1.0
#Date: 2009-06-15 13:55:20
#System: 10.1.1.1 - wsa.qa
#Software: AsyncOS for Web 6.3.0
#Fields: timestamp x-elapsed-time c-ip x-resultcode-httpstatus sc-bytes cs-method cs-url cs-username x-hierarchy-origin cs-mime-type x-acltag x-result-code x-suspect-user-agent
Working with Log Fields in W3C Access Logs
When defining a W3C access log subscription, you must choose which log fields to include, such as the
ACL decision tag or the client IP address. You can include one of the following types of log fields:
• Predefined.
The web interface includes a list of fields from which you can choose. For more information, see
Custom Formatting in Access Logs and W3C Logs, page 25-28 .
• User defined.
You can type a log field that is not included in the predefined list. For more information, see
Including HTTP/HTTPS Headers in Log Files, page 25-36
.
Most W3C log field names include a prefix that identifies from which header a value comes, such as the client or server. Log fields without a prefix reference values that are independent of the computers involved in the transaction.
describes the W3C log fields prefixes.
Table 25-10 W3C Log Field Prefixes
Prefix Header Description c Client s Server x Application specific identifier.
For example, the W3C log field “cs-method” refers to the method in the request sent by the client to the server, and “c-ip” refers to the client’s IP address.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-27
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Custom Formatting in Access Logs and W3C Logs
You can customize access logs and W3C access logs to include many different fields to capture comprehensive information about web traffic within the network. Access logs use format specifiers, and the W3C access logs use W3C log fields.
describes the W3C log fields you can include in the W3C access logs and the custom format specifiers (for the access logs) they correspond with.
Table 25-11 Log Fields in W3C Logs and Format Specifiers in Access Logs
W3C Log Field bytes
Format Specifier in
Access Logs
%B c-ip c-port
CMF cs(Cookie) cs(Referer) cs(User-Agent) cs(X-Forwarded-For) cs-auth-group cs-auth-mechanism
%a
%F
%M
%C
%<Referer:
%u
%f
%g
%m
Description
Total bytes used (request size + response size, which is %q + %s)
Client IP Address
Client source port
Cache miss flags, CMF flags
Cookie header. This field is written with double-quotes in the access logs.
Referer
User agent. This field is written with double-quotes in the access logs.
X-Forwarded-For header
Authorized group names. This field is written with double-quotes in the access logs.
The authentication mechanism used on the transaction. Possible values are:
• BASIC.
The user name was authenticated using the Basic authentication scheme.
•
•
•
•
•
NTLMSSP.
The user name was authenticated using the NTLMSSP authentication scheme.
SSO_TUI.
The user name was obtained by matching the client IP address to an authenticated user name using transparent user identification.
SSO_ASA.
The user is a remote user and the user name was obtained from a Cisco
ASA using the Secure Mobility Solution.
FORM_AUTH. The user entered authentication credentials in a form in the web browser when accessing a SaaS application.
GUEST.
The user failed authentication and instead was granted guest access.
25-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field cs-bytes cs-method cs-mime-type x-req-first-line cs-uri cs-url cs-username cs-version date
DCF s-computerName s-hierarchy s-hostname s-ip s-port sc(Server) sc-body-size sc-bytes sc-http-status sc-result-code time timestamp
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) sc-result-code-denial
Format Specifier in
Access Logs
%q
%y
%c
%r
%U
%Y
%A
%P
%v
%j
%N
%H
%d
%k
%p
%>Server:
%b
%s
%h
%w
%W
%V
%t
Description
Request size (headers + body)
Method
Response body MIME type. This field is written with double-quotes in the access logs.
Request first line - request method, URI,
HTTP version
Request URI
The entire URL
Authenticated user name. This field is written with double-quotes in the access logs.
Protocol, including the version number when applicable
Date in YYYY-MM-DD
Do not cache response code; DCF flags
Server name or destination hostname. This field is written with double-quotes in the access logs.
Hierarchy retrieval
Data source or server IP address
Data source IP address (server IP address)
Destination port number
Server header in the response
Bytes sent to the client from the Web Proxy for the body content.
Response size (header + body)
HTTP response code
Result code
For example: TCP_MISS, TCP_HIT
Result code denial
Time in HH:MM:SS
Timestamp in UNIX epoch
Note: If you want to use a third party log analyzer tool to read and parse the W3C access logs, you might need to include the
“timestamp” field. Most log analyzers only understand time in the format provided by this field.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-29
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field user-type x-acltag
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) x-as-malware-threat-name x-avc-app x-avc-behavior x-avc-reqbody-scanverdict x-avc-reqbody-scanverdict x-avc-type x-avg-bw x-bw-throttled x-elapsed-time x-error-code x-hierarchy-origin x-icap-server x-icap-verdict
Format Specifier in
Access Logs
%l
%D
%X6
%XO
%Xb
%XH
%XN x-avc-reqhead-scanverdict %XG x-avc-resphead-scanverdict %XM
%Xu
%XB
%XT
%e
%E
N/A
%i
%Xp
Description
Type of user, either local or remote. For more information, see
ACL decision tag
Indicates whether or not Adaptive Scanning blocked the transaction without invoke any anti-malware scanning engine. The possible values are:
• 1.
Transaction was blocked.
• 0.
Transaction was not blocked.
This variable is included in the scanning verdict information (in the angled brackets at the end of each access log entry).
The web application identified by the AVC engine.
The web application behavior identified by the AVC engine.
AVC request body verdict
AVC response body verdict
AVC request header verdict
AVC response header verdict
The web application type identified by the
AVC engine.
Average bandwidth of the user if bandwidth limits are defined by the AVC engine.
Flag that indicates whether or not bandwidth limits were applied to the transaction.
Elapsed time
Error code number that may help Customer
Support troubleshoot the reason for a failed transaction.
Code that describes which server was contacted for the retrieving the request content. (e.g. DIRECT/www.example.com)
IP address of the last ICAP server contacted while processing the request
External DLP server scanning verdict
25-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field x-ids-verdict x-latency x-local_time x-request-rewrite
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) x-mcafee-av-detecttype x-mcafee-av-scanerror x-mcafee-av-virustype x-mcafee-filename x-mcafee-scanverdict x-mcafee-virus-name x-req-dvs-scanverdict x-req-dvs-threat-name x-req-dvs-verdictname x-request-source-ip x-resp-dvs-scanverdict
Format Specifier in
Access Logs
%Xl
%x
%L
%Xg
%Xf
%Xh
%Xe
%Xd
%Xj
%X2
%X4
%X3
%XV
%XS
%X0
Description
Cisco IronPort Data Security Policy scanning verdict. If this field is included, it will display the IDS verdict, or “0” if IDS was active but the document scanned clean, or "-" if no IDS policy was active for the request.
Latency
Request local time in human readable format:
DD/MMM/YYYY : hh:mm:ss +nnnn. This field is written with double-quotes in the access logs.
McAfee specific identifier: (detect type)
McAfee specific identifier: (scan error)
McAfee specific identifier: (virus type)
McAfee specific identifier: (File name yielding verdict) This field is written with double-quotes in the access logs.
McAfee specific identifier: (scan verdict)
McAfee specific identifier: (virus name).
This field is written with double-quotes in the access logs.
Request side DVS Scan verdict
Request side DVS threat name
Request side DVS verdict name
The downstream IP address when the
“Enable Identification of Client IP Addresses using X-Forwarded-For” check box is enabled for the Web Proxy settings.
Safe browsing scanning verdict.
Indicates whether or not either the safe search or site content ratings feature was applied to the transaction. For more information, see
.
Unified response-side anti-malware scanning verdict that provides the malware category number independent of which scanning engines are enabled. Applies to transactions blocked or monitored due to server response scanning.
This field is written with double-quotes in the access logs.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-31
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field x-resp-dvs-threat-name x-resp-dvs-verdictname x-result-code x-resultcode-httpstatus x-sophos-file-name x-sophos-scanerror x-sophos-scanverdict x-sophos-virus-name x-suspect-user-agent x-transaction-id x-wbrs-score
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) x-wbrs-threat-reason x-wbrs-threat-type x-webcat-code-abbr x-webcat-code-full x-webcat-req-code-abbr
Format Specifier in
Access Logs
%X1
%XZ
%Xr
N/A
%Xy
%Xx
%XY
%Xz
%?BLOCK_SUSPECT
_USER_AGENT,
MONITOR_SUSPECT
_USER_AGENT?%
<User-Agent:%!%-%.
%I
%XW
%XK
%Xk
%XC
%XF
%XQ
Description
Unified response-side anti-malware scanning verdict that provides the malware threat name independent of which scanning engines are enabled. Applies to transactions blocked or monitored due to server response scanning.
This field is written with double-quotes in the access logs.
Unified response-side anti-malware scanning verdict that provides the malware category independent of which scanning engines are enabled. Applies to transactions blocked or monitored due to server response scanning.
This field is written with double-quotes in the access logs.
Scanning verdict information
Result code and the HTTP response code, with a slash (/) in between.
The file location where Sophos found the objectionable content. For non-archive files, this value is the file name itself. For archive file, it is the object in the archive, such as archive.zip/virus.exe
.
Sophos specific identifier: (scan return code)
Sophos specific identifier: (scan verdict)
Sophos specific identifier: (threat name)
Suspect user agent, if applicable. If the Web
Proxy determines the user agent is suspect, it will log the user agent in this field.
Otherwise, it logs a hyphen. This field is written with double-quotes in the access logs.
Transaction ID
Decoded WBRS score <-10.0-10.0>
Web reputation threat reason
Web reputation threat type
URL category abbreviation for the URL category assigned to the transaction.
Full name of the URL category assigned to the transaction. This field is written with double-quotes in the access logs.
The URL category verdict determined during request-side scanning, abbreviated.
25-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) x-webcat-req-code-full x-webcat-resp-code-abbr x-webcat-resp-code-full x-webroot-scanverdict x-webroot-spyid x-webroot-threat-name x-webroot-trace-id x-webroot-trr x-p2s-first-byte-time x-s2p-first-byte-time x-c2p-first-byte-time x-p2c-first-byte-time
Format Specifier in
Access Logs
%XR
%XA
%XL
%Xv
%Xs
%Xn
%Xi
%Xt
%:<1
%:>1
%:1<
%:1> x-p2p-auth-wait-time %:<a
Description
The URL category verdict determined during request-side scanning, full name.
The URL category verdict determined during response-side scanning, abbreviated.
Applies to the Cisco IronPort Web Usage
Controls URL filtering engine only.
The URL category verdict determined during response-side scanning, full name.
Applies to the Cisco IronPort Web Usage
Controls URL filtering engine only.
Malware scanning verdict from Webroot
Webroot specific identifier: (Spy ID)
Webroot specific identifier: (Threat name)
This field is written with double-quotes in the access logs.
Webroot specific scan identifier: (Trace ID)
Webroot specific identifier: (Threat Risk
Ratio (TRR))
The time it takes from the moment the Web
Proxy starts connecting to the server to the time it is first able to write to the server. If the
Web Proxy has to connect to several servers to complete the transaction, it is the sum of those times.
Wait-time for first response byte from server
Wait-time for first request byte from new client connection
Wait-time for first byte written to client x-p2p-auth-svc-time x-p2p-avc-svc-time x-p2p-avc-wait-time
%:>a
%:A<
%:A>
Web Proxy authentication process, after the
Web Proxy sent the request.
Wait-time to receive the response from the
Web Proxy authentication process, including the time required for the Web Proxy to send the request.
Wait-time to receive the response from the
AVC process, including the time required for the Web Proxy to send the request.
Wait-time to receive the response from the
AVC process, after the Web Proxy sent the request.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-33
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11
W3C Log Field x-p2s-body-time x-s2p-body-time x-c2p-body-time x-p2c-body-time x-p2p-fetch-time
Log Fields in W3C Logs and Format Specifiers in Access Logs (continued) x-p2p-dca-resp-wait-time x-p2p-dca-resp-svc-time x-p2p-dns-wait-time x-p2p-dns-svc-time x-p2s-header-time x-s2p-header-time x-c2p-header-time x-s2p-header-time x-p2p-mcafee-resp-svc-time
%:b<
%:b>
%:>c x-p2p-mcafee-resp-wait-time %:m> x-p2p-sophos-resp-svc-time
Format Specifier in
Access Logs
%:<b
%:>b
%:C>
%:C<
%:<d
%:>d
%:<h
%:>h
%:h<
%:h>
%:m<
%: p<
Description
Wait-time to write request body to server after header
Wait-time for complete response body after header received
Wait-time for complete client body
Wait-time for complete body written to client
Time required for the Web Proxy to read a response from the disk cache.
Wait-time to receive the response from the
Dynamic Content Analysis engine, after the
Web Proxy sent the request.
Wait-time to receive the verdict from the
Dynamic Content Analysis engine, including the time required for the Web Proxy to send the request.
Wait-time to receive the response from the
Web Proxy DNS process, after the Web
Proxy sent the request.
Wait-time to receive the response from the
Web Proxy DNS process, including the time required for the Web Proxy to send the request.
Wait-time to write request header to server after first byte
Wait-time for server header after first response byte
Wait-time for complete client header after first byte
Wait-time for complete header written to client
Wait-time to receive the verdict from the
McAfee scanning engine, including the time required for the Web Proxy to send the request.
Wait-time to receive the response from the
McAfee scanning engine, after the Web
Proxy sent the request.
Wait-time to receive the verdict from the
Sophos scanning engine, including the time required for the Web Proxy to send the request.
25-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Custom Formatting in Access Logs and W3C Logs
Table 25-11 Log Fields in W3C Logs and Format Specifiers in Access Logs (continued)
W3C Log Field
Format Specifier in
Access Logs x-p2p-sophos-resp-wait-time %: p> x-p2p-reputation-wait-time x-p2p-reputation-svc-time x-p2p-asw-req-wait-time x-p2p-asw-req-svc-time x-p2p-webroot-resp-svc-time %:w< x-p2p-webroot-resp-wait-tim e
%:<r
%:>r
%:<s
%:>s
%:w>
Description
Wait-time to receive the response from the
Sophos scanning engine, after the Web Proxy sent the request.
Wait-time to receive the response from the
Web Reputation Filters, after the Web Proxy sent the request.
Wait-time to receive the verdict from the Web
Reputation Filters, including the time required for the Web Proxy to send the request.
Wait-time to receive the verdict from the Web
Proxy anti-spyware process, after the Web
Proxy sent the request.
Wait-time to receive the verdict from the Web
Proxy anti-spyware process, including the time required for the Web Proxy to send the request.
Wait-time to receive the verdict from the
Webroot scanning engine, including the time required for the Web Proxy to send the request.
Wait-time to receive the response from the
Webroot scanning engine, after the Web
Proxy sent the request.
Configuring Custom Formatting in Access Logs
Use the System Administration > Log Subscriptions page to configure custom formatting for access log file entries. Click the access log file name to edit the access log subscription.
Figure 25-4 Configuring Custom Log Fields in the Access Logs
The syntax for entering format specifiers in the Custom Field is as follows:
<format_specifier1> <format_specifier2>
For example:
%a %b %E
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-35
Chapter 25 Logging
Including HTTP/HTTPS Headers in Log Files
You can add tokens before the format specifiers to display descriptive text in the access log file. For example: client_IP %a body_bytes %b error_type %E where client_IP
is the description token for log format specifier
%a
, body_bytes
is the descriptive token for
%b
, and
error_type
is the descriptive token for
%E
.
Note You can create a custom field for any header in a client request or a server response. For more information, see
Including HTTP/HTTPS Headers in Log Files, page 25-36 .
Configuring Custom Formatting in W3C Logs
Use the System Administration > Log Subscriptions page to configure custom formatting for W3C log file entries. Click the W3C log file name to edit the W3C log subscription.
Figure 25-5 Configuring Custom Log Fields in the W3C Logs
Enter the custom fields to add in the Custom Fields text box in the Log Fields section. You can enter multiple custom fields in the Custom Fields text box and add them simultaneously as long as each entry is separated by a new line (click Enter) before clicking Add .
Note You can create a custom field for any header in a client request or a server response. For more information, see
Including HTTP/HTTPS Headers in Log Files, page 25-36 .
Including HTTP/HTTPS Headers in Log Files
If the list of predefined access log and W3C log fields does not include all header information you want to log from HTTP/HTTPS transactions, you can type a user defined log field in the Custom Fields text box when you configure the access and W3C log subscriptions.
25-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Malware Scanning Verdict Values
Custom log fields can be any data from any header sent from the client or the server. If a request or response does not include the header added to the log subscription, the log file includes a hyphen as the log field value.
Table 25-12 defines the syntax to use for access and W3C logs.
Table 25-12 Configuring HTTP/HTTPS Headers in Log Files
Header Type
Access Log Format
Specifier Syntax
Header from the client application %< ClientHeaderName :
Header from the server
W3C Log Custom Field Syntax cs( ClientHeaderName )
%< ServerHeaderName : sc( ServerHeaderName )
For example, if you want to log the If-Modified-Since header value in client requests, enter the following text in the Custom Fields box for a W3C log subscription: cs(If-Modified-Since)
Malware Scanning Verdict Values
A malware scanning verdict is a value assigned to a URL request or server response that determines the probability that it contains malware. The scanning engines return the malware scanning verdict to the
DVS engine so the DVS engine can determine whether to monitor or block the scanned object.
They are the result of proprietary calculations that associate a numerical value to the probability that either the URL request or the response content contains malware. Each malware scanning verdict corresponds to a malware category listed on the Access Policies > Reputation and Anti-Malware Settings page when you edit the anti-malware settings for a particular Access Policy.
Both the Webroot and McAfee scanning engines can return malware scanning verdicts to the DVS engine. For more information about how the DVS engine handles malware scanning verdicts, see
IronPort DVS™ (Dynamic Vectoring and Streaming) Engine, page 20-4
.
Table 25-13 lists the different Malware Scanning Verdict Values and each malware category with which
they correspond.
Table 25-13 Malware Scanning Verdict Values
Malware Scanning Verdict Value Malware Category
Not Set
0 Unknown
2 Timeout
3 Error
4 Unscannable
12 Browser Helper Object
13 Adware
18 Commercial System Monitor
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-37
Chapter 25 Logging
Traffic Monitor Log
Table 25-13 Malware Scanning Verdict Values (continued)
Malware Scanning Verdict Value Malware Category
19 Dialer
20 Hijacker
25 Worm
27 Virus
34 PUA
35 Aborted
Traffic Monitor Log
The L4 Traffic Monitor log file provides a detailed record of monitoring activity. You can view L4 Traffic
Monitor log file entries and track updates to firewall block lists and firewall allow lists. Consider the following example log entries:
Example 1
172.xx.xx.xx discovered for blocksite.net (blocksite.net) added to firewall block list.
In this example, where a match becomes a block list firewall entry. The L4 Traffic Monitor matched an
IP address to a domain name in the block list based on a DNS request which passed through the appliance. The IP address is then entered into the block list for the firewall.
Example 2
172.xx.xx.xx discovered for www.allowsite.com (www.allowsite.com) added to firewall allow list.
In this example, a match becomes an allow list firewall entry. The L4 Traffic Monitor matched a domain name entry and added it to the appliance allow list. The IP address is then entered into the allow list for the firewall.
Example 3
Firewall noted data from 172.xx.xx.xx to 209.xx.xx.xx (allowsite.net):80.
In this example, the L4 Traffic Monitor logs a record of data that passed between an internal IP address and an external IP address which is on the block list. Also, the L4 Traffic Monitor is set to monitor, not block.
25-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Troubleshooting
AsyncOS for Web sends a critical email message to the configured alert recipients when the internal logging process drops web transaction events due to a full buffer.
By default, when the Web Proxy experiences a very high load, the internal logging process buffers events to record them later when the Web Proxy load decreases. When the logging buffer fills completely, the
Web Proxy continues to process traffic, but the logging process does not record some events in the access logs or in the Web Tracking report. This might occur during a spike in web traffic.
However, a full logging buffer might also occur when the appliance is over capacity for a sustained period of time. AsyncOS for Web continues to send the critical email messages every few minutes until the logging process is no longer dropping data.
The critical message contains the following text:
Reporting Client: The reporting system is unable to maintain the rate of data being generated. Any new data generated will be lost.
If AsyncOS for Web sends this critical message continuously or frequently, the appliance might be over capacity. Contact Cisco IronPort Customer Support to verify whether or not you need additional Web
Security appliance capacity.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-39
Troubleshooting
Chapter 25 Logging
25-40
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-41
Troubleshooting
Chapter 25 Logging
25-42
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-43
Troubleshooting
Chapter 25 Logging
25-44
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-45
Troubleshooting
Chapter 25 Logging
25-46
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-47
Troubleshooting
Chapter 25 Logging
25-48
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-49
Troubleshooting
Chapter 25 Logging
25-50
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 25 Logging
Troubleshooting
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
25-51
Troubleshooting
Chapter 25 Logging
25-52
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
26
Configuring Network Settings
This chapter contains the following information:
•
Changing the System Hostname, page 26-1
•
•
•
•
•
•
Configuring Network Interfaces, page 26-2
Configuring TCP/IP Traffic Routes, page 26-5
Virtual Local Area Networks (VLANs), page 26-7
Configuring Transparent Redirection, page 26-11
Configuring SMTP Relay Hosts, page 26-16
Configuring DNS Server(s), page 26-18
Changing the System Hostname
The hostname parameter is used to identify the system at the CLI prompt. You must enter a fully-qualified hostname for the system. The hostname parameter is also used in end-user notification pages, end-user acknowledgement pages, and to form the machine NetBIOS name when the Web
Security appliance joins an Active Directory domain. It has no direct relationship with the hostname configured for the interface.
Use the sethostname
command to change the name of the Web Security appliance: example.com> sethostname example.com> hostname.com
example.com> commit
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-1
Chapter 26 Configuring Network Settings
Configuring Network Interfaces
Configuring Network Interfaces
You can configure the appliance network interfaces by modifying IP address, subnet, and hostname information for the Management, Data, and L4 Traffic Monitor interfaces.
describes the network interface settings you can configure.
Table 26-1 Web Security Appliance Network Interface Settings
Interface
Management
Data
L4 Traffic Monitor
Port Number Description
M1 By default, the Management interface is used to administer the appliance and Web Proxy (data) monitoring. However, you can configure the M1 port for management use only.
P1 and P2
(proxy)
The Data interfaces are used for Web Proxy monitoring and L4
Traffic Monitor blocking (optional). You can also configure these interfaces to support outbound services such as DNS, software upgrades, NTP, and traceroute data traffic.
T1 and T2
For more information about configuring the Data interfaces, see
Configuring the Data Interfaces, page 26-2
.
The L4 Traffic Monitor interfaces are used to configure a duplex or simplex wiring type.
•
•
Duplex.
The T1 interface receives incoming and outgoing traffic.
Simplex.
T1 receives outgoing traffic and T2 receives incoming traffic.
Note If the Management and Data interfaces are all configured, each must be assigned IP addresses on different subnets.
You can manage the network interfaces using the following methods:
• Web interface.
Use the Network > Interfaces page. For more information, see
Network Interfaces from the Web Interface, page 26-3 .
• Command line interface.
Use the ifconfig CLI command to create, edit, and delete network interfaces.
Configuring the Data Interfaces
You can configure the Web Security appliance to use any of the following combinations of network interfaces for data traffic:
•
•
•
•
•
M1 only
M1 and P1
M1, P1, and P2
P1 only
P1 and P2
26-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring Network Interfaces
You can enable the M1 and P1 ports during or after System Setup. However, you can only enable the P2 port after System Setup in the web interface or using the ifconfig
CLI command.
The Web Proxy listens for client web requests on different network interfaces depending on how you configure the Web Security appliance:
• M1.
The Web Proxy listens for requests on this interface when it is not configured to be restricted to appliance management services only.
•
•
P1.
The Web Proxy listens for requests on this interface when it is enabled.
P2.
By default, the Web Proxy does not listen for requests on this interface, even when enabled.
However, you can configure it to listen for requests on P2 using the advancedproxyconfig > miscellaneous
CLI command.
To configure the appliance to use P2 as a second data interface:
Step 1
Step 2
Configure the appliance to use P1 as the interface for data traffic. You can do this during System Setup or after initial setup on the Network > Interfaces page.
Enable P2 in the web interface (see
Configuring the Network Interfaces from the Web Interface, page 26-3
) or using the ifconfig
CLI command.
Note If the Management and Data interfaces are all configured, each must be assigned IP addresses on different subnets.
Step 3 In the web interface, go to the Network > Routes page. Change the Default Route for data traffic to specify the next IP address that the P2 interface is connected to.
Note If you enable P2 to listen for client requests using the advancedproxyconfig > miscellaneous
CLI command, you can choose whether to use P1 or P2 for outgoing traffic. To use P1 for outgoing traffic, change the Default Route for data traffic to specify the next IP address that the P1 interface is connected to.
Configuring the Network Interfaces from the Web Interface
To configure the network interfaces from the web interface:
Step 1 Navigate to the Network > Interfaces page. Click Edit Settings .
The Edit Interfaces page appears.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-3
Configuring Network Interfaces
Figure 26-1 Editing Network Interfaces
Chapter 26 Configuring Network Settings
Step 2 Configure interface settings as necessary.
Table 26-2 describes the interface settings you can define for each interface.
Table 26-2 Interface Settings
Interface Setting Description
IP Address Enter the IP address to use to manage the Web Security appliance.
Netmask
Hostname
Enter an IP address that exists on your management network.
Enter the network mask to use when managing the Web Security appliance on this network interface.
Enter the hostname to use when managing the Web Security appliance on this network interface.
Step 3
Step 4
Step 5
Specify whether or not to have separate routing for the Management Services using the “Restrict M1 port to appliance management services only” field.
If this checkbox is selected, the M1 port is used for appliance management services only and is not used for the data (Web Proxy) traffic. You will need to configure another port for data traffic as well as separate routes for management and data traffic. For more information about configuring routes, see
Configuring TCP/IP Traffic Routes, page 26-5 .
Configure Appliance Management Services.
Choose whether or not to use HTTP or HTTPS to administer AsyncOS through the web interface. You must specify the port to access AsyncOS with each protocol you configure.
You can also choose to redirect HTTP requests to HTTPS. When you do this, AsyncOS automatically enables both HTTP and HTTPS.
Choose the type of wired connections plugged into the “T” network interfaces:
•
•
Duplex TAP.
Choose Duplex TAP when the T1 port receives both incoming and outgoing traffic.
You can use half- or full-duplex Ethernet connections.
Simplex TAP.
Choose Simplex TAP when you connect the T1 port to the internal network (traffic flows from the clients to the Internet) and you connect the T2 port to the external network (traffic flows from the Internet to the clients).
26-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring TCP/IP Traffic Routes
Step 6
Note Cisco recommends using simplex when possible because it can increase performance and security.
Submit and commit your changes.
Configuring TCP/IP Traffic Routes
You can define routes for appliance traffic, add static routes, load IP routing tables, and modify the default gateway using the Network > Routes page or the routeconfig command.
Routes are used for determining where to send traffic (routing traffic). The Web Security appliance needs to route the following kinds of traffic:
• Data traffic.
Traffic the Web Proxy processes from end users browsing the web.
• Management traffic.
Traffic created by managing the appliance through the web interface and traffic the appliance creates for management services, such as AsyncOS upgrades, component updates, DNS, authentication, and more.
By default, both kinds of traffic use the routes defined for all configured network interfaces. However, you can choose to split the routes (“split routing”) so that the M1 interface is only used for management traffic. When you enable split routing, data traffic only uses the routes configured for the data interfaces
(P1 and P2, if configured), and management traffic uses the routes configured for all configured network interfaces.
To enable split routing, use the “Restrict M1 port to appliance management services only” field on the
Network > Interfaces page. For more information, see
Configuring the Network Interfaces from the Web
.
The number of sections on the Network > Routes page is determined by whether or not split routing is enabled:
• Separate route configuration sections for Management and Data traffic (split routing enabled).
When you use the Management interface for management traffic only (“Restrict M1 port” is enabled), then this page includes two sections to enter routes, one for management traffic and one for data traffic.
shows the Routes page when the option is enabled.
• One route configuration section for all traffic (split routing enabled).
When you use the
Management interface for both management and data traffic (“Restrict M1 port” is disabled), then this page includes one section to enter routes for all traffic that leaves the Web Security appliance, both management and data traffic.
Note A route gateway must reside on the same subnet as the Management or Data interface on which it is configured.
Modifying the Default Route
You can modify the default gateway in the web interface or in the CLI using the setgateway
CLI command.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-5
Chapter 26 Configuring Network Settings
Configuring TCP/IP Traffic Routes
Note The Web Proxy sends out transactions on the data interface that is on the same network as the default gateway configured for data traffic.
To modify the default gateway in the web interface:
Step 1 Navigate to the Network > Routes page, and click on Default Route in the corresponding table.
Figure 26-2 Editing the Default Route
Step 2
Step 3
In the Gateway column, enter the IP address of the computer system on the next hop of the network connected to the network interface you are editing.
Submit and commit your changes.
Working With Routing Tables
You can save your current routing table to a file. You can load a previously saved route table. You can add new routes or delete existing ones.
To save a route table, click Save Route Table and specify where to save the file.
To load a previously saved route table, click Load Route Table , navigate to the file, and then submit and commit your changes.
Note When the destination address is on the same subnet as one of the physical network interfaces, AsyncOS sends data using the network interface with the same subnet. It does not consult the routing tables.
To add a route:
Step 1 Navigate to the Network > Routes page.
Figure 26-3 Adding a Route
26-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Virtual Local Area Networks (VLANs)
Step 2
Step 3
Step 4
Click the Add Route button corresponding to the interface for which you are creating the route. The Add
Route page is displayed.
Enter a Name, Destination Network, and Gateway.
Submit and commit your changes.
Virtual Local Area Networks (VLANs)
VLANs are virtual local area networks bound to physical data ports. You can configure one or more
VLANs to increase the number of networks the IronPort appliance can connect to beyond the number of physical interfaces included. For example, a Web Security appliance has two data interfaces available for VLANs: P1 and Management. VLANs allow more networks to be defined on separate “ports” on existing interfaces.
provides an example of configuring several VLANs on the P1 interface.
Figure 26-4 Using VLANs to Increase the Number of Networks Available on the Appliance
Cisco IronPort appliance configured for
VLAN1, VLAN2, and VLAN3
VLAN
“Router”
DMZ NOC
VLAN1
VLAN2
VLAN3
VLANs can be used to segment networks for security purposes, to ease administration, or increase bandwidth. For example, create multiple VLANs on the P1 interface and then apply different policies to each. VLANs appear as dynamic “Data Ports” labeled in the format of: “VLAN DDDD” where the
“DDDD” is the ID and is an integer up to 4 digits long (VLAN 2, or VLAN 4094 for example). AsyncOS supports up to 30 VLANs. Duplicate VLAN IDs are not allowed on an IronPort appliance.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-7
Chapter 26 Configuring Network Settings
Virtual Local Area Networks (VLANs)
VLANs and Physical Ports
A physical port does not need an IP address configured in order to be in a VLAN. The physical port on which a VLAN is created can have an IP that will receive non-VLAN traffic, so you can have both VLAN and non-VLAN traffic on the same interface.
VLANs can only be created on the Management and P1 data ports.
Managing VLANs
You can create, edit and delete VLANs via the etherconfig command. Once created, a VLAN can be configured via the interfaceconfig command in the CLI. Remember to commit all changes.
Creating a New VLAN via the etherconfig Command
In this example, two VLANs are created (named VLAN 31 and VLAN 34) on the P1 port:
Note Do not create VLANs on the T1 or T2 interfaces.
example.com> etherconfig
Choose the operation you want to perform:
- MEDIA - View and edit ethernet media settings.
- VLAN - View and configure VLANs.
- MTU - View and configure MTU.
[]> vlan
VLAN interfaces:
Choose the operation you want to perform:
- NEW - Create a new VLAN.
[]> new
VLAN ID for the interface (Ex: "34"):
[]> 34
Enter the name or number of the ethernet interface you wish bind to:
26-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
1. Management
2. P1
3. T1
4. T2
[1]> 2
VLAN interfaces:
1. VLAN 34 (P1)
Choose the operation you want to perform:
- NEW - Create a new VLAN.
- EDIT - Edit a VLAN.
- DELETE - Delete a VLAN.
[]> new
VLAN ID for the interface (Ex: "34"):
[]> 31
Virtual Local Area Networks (VLANs)
Enter the name or number of the ethernet interface you wish bind to:
1. Management
2. P1
3. T1
4. T2
[1]> 2
VLAN interfaces:
1. VLAN 31 (P1)
2. VLAN 34 (P1)
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-9
Chapter 26 Configuring Network Settings
Virtual Local Area Networks (VLANs)
Choose the operation you want to perform:
- NEW - Create a new VLAN.
- EDIT - Edit a VLAN.
- DELETE - Delete a VLAN.
[]>
Creating an IP Interface on a VLAN via the interfaceconfig Command
In this example, a new IP interface is created on the VLAN 34 ethernet interface.
Note Making changes to an interface may close your connection to the appliance. example.com> interfaceconfig
Currently configured interfaces:
1. Management (10.10.1.10/24 on Management: example.com)
2. P1 (10.10.0.10 on P1: example.com)
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- GROUPS - Define interface groups.
- DELETE - Remove an interface.
[]> new
IP Address (Ex: 10.10.10.10):
[]> 10.10.31.10
Ethernet interface:
1. Management
2. P1
26-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
3. VLAN 31
4. VLAN 34
[1]> 4
Netmask (Ex: "255.255.255.0" or "0xffffff00"):
[255.255.255.0]>
Hostname:
[]> v.example.com
Configuring Transparent Redirection
Currently configured interfaces:
1. Management (10.10.1.10/24 on Management: example.com)
2. P1 (10.10.0.10 on P1: example.com)
3. VLAN 34 (10.10.31.10 on VLAN 34: v.example.com)
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- DELETE - Remove an interface.
[]> example.com> commit
Configuring Transparent Redirection
When you configure the Web Security appliance web proxy service in transparent mode, you must connect the appliance to an Layer 4 switch or a WCCP v2 router, and you must configure the appliance so it knows to which device it is connected. You configure the device on the Network > Transparent
Redirection page.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-11
Configuring Transparent Redirection
Figure 26-5 Network > Transparent Redirection Page
Chapter 26 Configuring Network Settings
On this page, you can choose the device that transparently redirects traffic to the appliance, either an
Layer 4 switch or a WCCP router. When you choose an Layer 4 switch as the device, there is nothing else to configure on this page.
However, when you choose a WCCP router as the device, you must create at least one WCCP service.
Working with WCCP Services
A WCCP service is an appliance configuration that defines a service group to a WCCP v2 router. It includes information such as the service ID and ports used. Service groups allow a web proxy to establish connectivity with a WCCP router and to handle redirected traffic from the router.
You can create WCCP services that use the following service types:
• Standard service.
The standard service is also known as a well known service because the characteristics of it are known by both WCCP routers and the appliance. It redirects traffic on port
80. It is identified as the “web-cache” service.
• Dynamic service.
Dynamic services are any other service a web proxy creates, but the web proxy must describe the components of the service group to the router. AsyncOS supports the creation of any dynamic service you choose to define. To create a dynamic service, you must provide the service
ID number, port numbers, and specify whether to redirect packets based on the destination or source port and whether to distribute packets based on the client or server address.
The Web Cache Communication Protocol allows 257 different service IDs. AsyncOS allows you to create a dynamic WCCP service for each possible service ID. However, in typical usage, most users create one or two WCCP services, where one is a standard service and the other a dynamic service.
When you create a WCCP service of any type, you must also specify the following information:
• Assignment method.
For more information, see
Working with the Assignment Method, page 26-12
.
• Forwarding and Return method.
For more information, see
Working with the Forwarding and
If you enable IP spoofing on the appliance, you must create two WCCP services. For more information, see
IP Spoofing when Using WCCP, page 26-14 .
Working with the Assignment Method
WCCP defines the assignment method as the method by which redirected packets are distributed between web proxies. In this case, between one or more Web Security appliances. The assignment method determines how the router performs load balancing of packets among multiple Web Security appliances.
26-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring Transparent Redirection
You configure the assignment method for a WCCP service in the Load-Balancing Method field under the Advanced section when you create or edit a WCCP service.
You can configure WCCP services to use either of the following assignment methods:
• Mask.
This method relies on masking to make redirection decisions. WCCP routers make decisions using hardware in the router. This method can be very efficient because the hardware redirects the packets. You might want to choose mask to reduce CPU cycles on the router which can increase router performance. You can only use mask with WCCP routers that support mask assignment.
Note AsyncOS chooses the mask value to use with the router. You cannot configure the mask value.
• Hash.
This method relies on a hash function to make redirection decisions. You might want to use
Hash when the WCCP router does not support masking.
You can also configure a WCCP service to allow either mask or hash load balancing. When a WCCP service allows both mask and hash, AsyncOS communicates with the router to determine whether or not the router supports mask. If the router supports mask, then AsyncOS uses masking in the service group, if the router does not support mask, then AsyncOS uses hashing in the service group.
Working with the Forwarding and Return Method
WCCP defines the forwarding method as the method by which redirected packets are transported from the router to the web proxy. Conversely, the return method redirects packets from the web proxy to the router.
You configure the forwarding and return methods for a WCCP service in the Forwarding Method and
Return Method fields under the Advanced section when you create or edit a WCCP service.
You can configure WCCP services to use either of the following methods:
•
•
Layer 2 (L2).
This method redirects traffic at layer 2 by replacing the packet’s destination MAC address with the MAC address of the target web proxy. This method requires that the target web proxy be directly connected to the router at layer 2. WCCP routers only allow L2 negotiation when the appliance is directly connected to the router at layer 2. The L2 method redirects traffic at the router hardware level, and typically has better performance than Generic Routing Encapsulation
(GRE). You might want to choose L2 when the router is directly connected to the appliance and you want the performance improvement provided by the L2 method. You can only use the L2 method with WCCP routers that support L2 forwarding.
Generic Routing Encapsulation (GRE).
This method redirects traffic at layer 3 by encapsulating the IP packet with a GRE header and a redirect header. This method redirects traffic at the router software level, which can impact performance. You might want to choose GRE when the appliance is not directly connected to the router.
You can also configure a WCCP service to allow either the L2 or GRE methods. When a WCCP service allows both L2 and GRE, the appliance uses the method that the router says it supports. If both the router and appliance support L2 and GRE, the appliance uses L2.
Note If the router is not directly connected to the appliance, you must choose GRE.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-13
Chapter 26 Configuring Network Settings
Configuring Transparent Redirection
IP Spoofing when Using WCCP
You can configure the Web Proxy to do IP spoofing. When enabled, requests originating from a client retain the client’s source address and appear to originate from the client instead of the Web Proxy.
When you enable IP spoofing, you must create two WCCP services. One WCCP service must redirect traffic based on the destination port, and another based on the source port for the return path. The service based on the destination port can be the standard web-cache service. However, you must still create at least one dynamic service.
The two WCCP services you define for IP spoofing must have the same values for the following settings:
• Port numbers
•
•
Router IP addresses
Router security and password
Note Cisco suggests using a service ID number from 90 to 97 for the WCCP service used for the return path
(based on the source port).
For more information about creating WCCP services, see Adding and Editing a WCCP Service, page 26-14
.
Adding and Editing a WCCP Service
You must create at least one WCCP service when you configure the transparent redirection device as a
WCCP router. If IP spoofing is enabled on the appliance, you must create two WCCP services. For more information about IP spoofing, see
IP Spoofing when Using WCCP, page 26-14
.
To add or edit a WCCP service:
Step 1 Navigate to the Network > Transparent Redirection page.
Step 2
Step 3
Verify the transparent redirection device is a WCCP v2 router. If it is not, click Edit Device to change it.
To add a WCCP service, click Add Service . Or, to edit a WCCP service, click the name of the WCCP service in the Service Profile Name column.
The Add WCCP v2 Service page or Edit WCCP v2 Service page appears.
26-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring Transparent Redirection
Step 4 Configure the WCCP options.
describes the WCCP options.
Table 26-3 WCCP Service Options
WCCP Service Option
Service Profile Name
Service
Router IP Addresses
Description
Enter a name for the WCCP service.
Use this section to describe the service group for the router.
Choose to create either a standard (“well known”) or dynamic service group.
If you create a dynamic service, enter the following information:
•
•
Service ID.
Enter any number from 0 to 255 in the Dynamic Service
ID field.
Port number(s).
Enter up to eight port numbers for traffic to redirect in the Port Numbers field.
•
•
Redirection basis.
Choose to redirect traffic based on the source or destination port. Default is destination port.
Load balancing basis.
When the network uses multiple Web Security appliances, you can choose how to distribute packets among the appliances. You can distribute packets based on the server or client address. When you choose client address, packets from a client always get distributed to the same appliance. Default is server address.
For more information about well known and dynamic service groups, see
Working with WCCP Services, page 26-12 .
Enter the IP address for one or more WCCP enabled routers. You can enter up to 32 routers to the service group. You must enter the IP address of each router. You cannot enter a multicast address.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-15
Chapter 26 Configuring Network Settings
Configuring SMTP Relay Hosts
Table 26-3
Advanced
WCCP Service Options (continued)
WCCP Service Option
Router Security
Description
Choose whether or not to require a password for this service group. If required, enter the password in the password fields. The password can contain up to seven characters.
When you enable security for a service group, every appliance and WCCP router that uses the service group must use the same password.
Requiring a password enables you to control which routers and
WCCP-enabled systems, such as the Web Security appliance, become part of the service group.
WCCP uses the MD5 hash protocol to encrypt the password.
Note Each appliance or WCCP router in the service group authenticate the security component in a received WCCP packet immediately after validating the WCCP message header. Packets failing authentication are discarded.
Configure the following fields:
•
•
Load-Balancing Method.
This is also known as the assignment method. Choose Mask, Hash, or both. Default is both.
For more information about load-balancing, see
.
Forwarding Method.
Choose L2, GRE, or both. Default is both.
For more information about the forwarding method, see
Working with the Forwarding and Return Method, page 26-13 .
• Return Method.
Choose L2, GRE, or both. Default is both.
For more information about the return method, see
Forwarding and Return Method, page 26-13 .
Step 5 Submit and commit your changes.
Deleting a WCCP Service
To delete a WCCP service:
Step 1
Step 2
Step 3
Navigate to the Network > Transparent Redirection page.
Click the icon in the Delete column for the WCCP service you want to delete.
Commit your changes.
Configuring SMTP Relay Hosts
AsyncOS periodically sends system-generated email messages, such as notifications, alerts, and Cisco
IronPort Customer Support requests. By default, AsyncOS uses information listed in the MX record on your domain to send email. However, if the appliance cannot directly reach the mail servers listed in the
MX record, you must configure at least one SMTP relay host on the appliance.
26-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring SMTP Relay Hosts
You might want to configure an SMTP relay host in the following scenarios:
•
•
You want the system-generated emails to go to a non-local email address, and port 25 is blocked to outside networks.
Your mail servers do not allow direct port 25 traffic from internal hosts.
If no SMTP relay host is defined, AsyncOS delivers directly to the mail server for each email address.
Note If the Web Security appliance cannot communicate with the mail servers listed in the MX record or any of the configured SMTP relay hosts, it cannot send email messages and it writes a message in the log files.
You can configure one or more SMTP relay hosts. You might want to configure multiple SMTP relay hosts for redundancy in case one system becomes unavailable. When you configure multiple SMTP relay hosts, AsyncOS uses the topmost available SMTP relay host. If an SMTP relay host is unavailable, it tries to use the one below it in the list.
You can configure the SMTP relay host from either the web interface or command line interface:
• Web interface.
Use the Network > Internal SMTP Relay page.
• Command line interface.
Use the smtprelay
CLI command.
Configuring SMTP from the Web Interface
Use the Network > Internal SMTP Relay page.
To configure the SMTP relay host from the web interface:
Step 1 Navigate to the Network > Internal SMTP Relay page, and click Edit Settings .
Step 2 Enter the information listed in
.
Table 26-4 SMTP Relay Host Settings
Property
Relay Hostname or IP
Address
Port
Description
Enter the hostname or IP address to use for the SMTP relay
Routing Table to Use for SMTP
Enter the port for connecting to the SMTP relay. If this property is empty, the appliance uses port 25. This property is optional.
Choose the routing table associated with an appliance network interface, either Management or Data, to use for connecting to the SMTP relay. Choose whichever interface is on the same network as the relay system.
Step 3
Step 4
Optionally, you can add more SMTP relay host information by clicking Add Row .
Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-17
Chapter 26 Configuring Network Settings
Configuring DNS Server(s)
Configuring SMTP from the CLI
Use the smtprelay command to configure SMTP relay hosts.
For example: example.com> smtprelay
No internal SMTP relay host configured.
Choose the operation you want to perform:
- NEW - Add a new host.
[]> new
Please enter the hostname of your relay host. You may put a colon after the hostname to indicate a port to use other than 25, such as “smtp.example.com:547”.
Configuring DNS Server(s)
You can configure the DNS settings for your appliance using the Network > DNS page or using the dnsconfig command. Before you configure DNS, consider the following:
• Whether to use the Internet’s DNS servers or your own, and which specific server(s) to use.
•
•
•
Which routing table to use for DNS traffic.
You must use the routing table associated with the interface that faces the DNS server, either Data or Management.
The number of seconds to wait before timing out a reverse DNS lookup.
Clearing the DNS cache.
Specifying DNS Servers
AsyncOS for Web can use the Internet root DNS servers or your own DNS servers. When using the
Internet root servers, you can specify alternate servers to use for specific domains. Since an alternate
DNS server applies to a single domain, it must be authoritative (provide definitive DNS records) for that domain.
Split DNS
AsyncOS supports split DNS where internal servers are configured for specific domains and external or root DNS servers are configured for other domains. If you are using your own internal server, you can also specify exception domains and associated DNS servers.
26-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring DNS Server(s)
Using the Internet Root Servers
The AsyncOS DNS resolver is designed to accommodate the large number of simultaneous DNS connections.
Multiple Entries and Priority
For each DNS server you enter, you can specify a numeric priority. AsyncOS will attempt to use the DNS server with the priority closest to 0. If that DNS server is not responding AsyncOS will attempt to use the server at the next priority. If you specify multiple entries for DNS servers with the same priority, the system randomizes the list of DNS servers at that priority every time it performs a query. The system then waits a short amount of time for the first query to expire or “time out” and then increments with a slightly longer amount of time for subsequent servers. The amount of time depends on the exact number of DNS servers and priorities that have been configured. The timeout length is the same for all IP addresses at any particular priority. The first priority gets the shortest timeout, each subsequent priority gets a longer timeout. Further, the timeout period is roughly 60 seconds. If you have one priority, the timeout for each server at that priority is 60 seconds. If you have two priorities, the timeout for each server at the first priority is 15 seconds, and each server at the second priority is 45 seconds. For three priorities, the timeout increments are 5, 10, 45.
For example, four DNS servers with two configured at priority 0, one at priority 1, and one at priority 2:
Table 26-5 Example of DNS Servers, Priorities, and Timeout Intervals
1
2
Priority
0
Server(s)
1.2.3.4, 1.2.3.5
1.2.3.6
1.2.3.7
Timeout (seconds)
5, 5
10
45
AsyncOS randomly chooses between the two servers at priority 0. If one of the priority 0 servers is down, the other is used. If both priority 0 servers are down, the priority 1 server (1.2.3.6) is used, and finally, the priority 2 (1.2.3.7) server.
The timeout period is the same for both priority 0 servers, longer for the priority 1 server, and longer still for the priority 2 server.
DNS Alert
If an alert with the message “Failed to bootstrap the DNS cache” is generated when an appliance is rebooted, it means that the system was unable to contact its primary DNS servers. This can happen at boot time if the DNS subsystem comes online before network connectivity is established. If this message appears at other times, it could indicate network issues or that the DNS configuration is not pointing to a valid server.
Clearing the DNS Cache
You can use the Clear DNS Cache button on Network > DNS page, or the dnsflush
command to clear all information in the DNS cache when changes have been made to your local DNS system. Using this command might cause a temporary performance degradation while the cache is repopulated.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-19
Configuring DNS Server(s)
Configuring DNS
To edit DNS Settings:
Step 1
Step 2
Navigate to the Network > DNS page.
Click Edit Settings . The Edit DNS page appears.
Figure 26-6 Edit DNS Settings
Chapter 26 Configuring Network Settings
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Select to use the Internet’s root DNS servers or your own internal DNS server or the Internet’s root DNS servers and specify authoritative DNS servers.
If you use your own DNS server(s), or specify authoritative DNS servers, enter the server ID, specify a priority, and use the Add Row key to repeat as necessary for each server.
Choose the routing table associated with an appliance network interface type, either Management or
Data, to use for DNS traffic.
Enter the number of seconds to wait before cancelling a reverse DNS lookup.
In the Domain Search List, enter zero or more domain suffixes to append to hostnames before AsyncOS does a DNS match.
The DNS domain search list is used when a request does not resolve with the DNS server. The domains specified are each attempted in turn to see if a DNS match for the hostname plus domain can be found.
The list is searched in order (from left to right) until a match is found.
Submit and commit to save the changes.
26-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 26 Configuring Network Settings
Configuring DNS Server(s)
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
26-21
Configuring DNS Server(s)
Chapter 26 Configuring Network Settings
26-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
System Administration
C H A P T E R
27
This chapter contains the following information:
•
Managing the S-Series Appliance, page 27-1
•
•
•
•
•
•
•
•
•
•
•
•
Working with Feature Keys, page 27-7
Administering User Accounts, page 27-9
Defining User Preferences, page 27-14
Configuring Administrator Settings, page 27-15
Configuring the Return Address for Generated Messages, page 27-16
Setting System Time, page 27-27
Installing a Server Digital Certificate, page 27-29
Upgrading AsyncOS for Web, page 27-32
Configuring Upgrade and Service Update Settings, page 27-34
Reverting to a Previous Version of AsyncOS for Web, page 27-41
Managing the S-Series Appliance
The S-Series appliance provides a variety of tools for managing the system. Functionality on System
Administration tab helps you manage the following tasks:
•
•
•
•
•
•
Appliance configuration
Feature keys
Adding, editing, and removing user accounts
AsyncOS software upgrades
Updates to security components
System time
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-1
Chapter 27 System Administration
Support Commands
Saving and Loading the Appliance Configuration
All configuration settings within the Web Security appliance can be managed using a single configuration file. The file is maintained in XML (Extensible Markup Language) format.
To archive the current configuration, you can use the System Administration > Configuration Summary page to print a summary of appliance settings, and you can use the System Administration >
Configuration File page to create a local copy of the system configuration file. The system configuration file can be used to import a complete configuration or to load a unique sub-section and update specific settings.
When you save the configuration file, you can choose a system-generated name or define your own file name. You can mask the user’s passwords by clicking a checkbox. Masking a password causes the original, encrypted password to be replaced with “*****” in the exported or saved file. Please note, however, that configuration files with masked passwords cannot be loaded back into AsyncOS for Web.
Use the Load Configuration section of the System Administration > Configuration File page to load new configuration information into the Web Security appliance. You can load information using any of the following methods:
•
•
Place information in the configuration directory and upload it.
Upload the configuration file directly from your local machine.
• Paste configuration information directly into the web interface.
To load a copy of the configuration file, paste the configuration directly into the web interface page. At the top of the configuration file you must include the following tag:
<?xml version=”1.0” encoding=”ISO-8859-1”?> <!DOCTYPE config SYSTEM “config.dtd”>
<config> ... your configuration information in valid XML </config>
After loading the XML sub-section, submit and commit the update.
If a compatible configuration file is based on an older version of the set of URL categories than the version currently installed on the appliance, policies and identities in the configuration file may be modified automatically. For information, see
Managing Updates to the Set of URL Categories, page 18-5 .
Committing Changes to the Appliance Configuration
Each time you modify settings and change appliance behavior using the S-Series web interface, you must first submit your changes and then commit them to the active configuration.
For more information about committing changes, see
Committing and Clearing Changes, page 2-9
.
Support Commands
The features in this section are useful when you upgrade the appliance or contact your support provider.
You can find the following commands under the Technical Support section of the Support and Help menu:
• Open a Support Case.
For more information, see
Open a Support Case, page 27-3
.
•
•
Remote Access.
For more information, see
Packet Capture.
For more information, see Packet Capture, page 27-4 .
27-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Support Commands
Open a Support Case
You can use the appliance to send an email to Cisco IronPort Customer Support asking for assistance.
When the appliance sends the email, it also sends the configuration of the appliance. You can do this in the following ways:
• CLI.
Use the supportrequest
command.
• Web interface.
Use the Support and Help menu > Open a Support Case page.
When you send a support request, you can enter comments describing the issue for which you need support. The appliance must be able to send mail to the Internet to send a support request.
To send a support request in the web interface:
Step 1 From the Support and Help menu, choose Open a Support Case.
Figure 27-1 Open a Technical Support Case Page
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 2 In the Other Recipients field, enter other email addresses separated by commas if you want to send this support request to other people.
By default, the support request (including the configuration file) is sent to Cisco IronPort Customer
Support (via the checkbox at the top of the form).
Enter your contact information, such as name and email.
From the Issue Priority field, select the priority of this support request.
In the Issue Subject field, enter the text to use in the subject line of the email that will be sent.
In the Issue Description field, enter a description of the issue.
If you have a customer support ticket already for this issue, enter it.
Click Send .
A trouble ticket is automatically created with Cisco. For additional information, see
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-3
Chapter 27 System Administration
Support Commands
Remote Access
Use the Support and Help menu > Remote Access page to allow Cisco IronPort Customer Support remote access to the Web Security appliance. Click Edit Remote Access Settings to allow Cisco
IronPort Customer Support to access the appliance.
Figure 27-2 Remote Access Page
By enabling Remote Access you are activating a special account used by Cisco IronPort Customer
Support for debugging and general access to the system. This is used by Cisco IronPort Customer
Support for tasks such as assisting customers in configuring their systems, understanding configurations, and investigating problem reports. You can also use the techsupport
command in the CLI.
When enabling the “Secure Tunnel,” the appliance creates an SSH tunnel over the specified port to the server upgrades.ironport.com. By default this connection is over port 443, which will work in most environments. Once a connection is made to upgrades.ironport.com, Cisco IronPort Customer Support is able to use the SSH tunnel to obtain access to the appliance. As long as the connection over port 443 is allowed, this will bypass most firewall restrictions. You can also use the techsupport tunnel command in the CLI.
In both the “Remote Access” and “Tunnel” modes, a password is required. It is important to understand that this is not the password that will be used to access the system. Once that password and the system serial number are provided to your Customer Support representative, a password used to access the appliance is generated.
Once the techsupport tunnel is enabled, it will remain connected to upgrades.ironport.com
for 7 days.
After 7 days, no new connections can be made using the techsupport tunnel. If there are any existing connections using the tunnel after 7 days, those connections will continue to exist and work. However, once those connections are closed, they will not be able to open again because the techsupport tunnel will have closed after 7 days. The timeout set on the SSH tunnel connection does not apply to the Remote
Access account; it will remain active until specifically deactivated.
Packet Capture
Sometimes when you contact Cisco IronPort Customer Support with an issue, you may be asked to provide insight into the network activity going into and out of the Web Security appliance. The appliance provides the ability to intercept and display TCP/IP and other packets being transmitted or received over the network to which the appliance is attached.
You might want to run a packet capture to debug the network setup and to discover what network traffic is reaching the appliance or leaving the appliance.
27-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Support Commands
The appliance saves the captured packet activity to a file and stores the file locally. You can configure the maximum packet capture file size, how long to run the packet capture, and on which network interface to run the capture. You can also use a filter to limit the number of packets seen by the packet capture which can make the output more usable on networks with a high volume of traffic. You can send any stored packet capture file using FTP to Cisco IronPort Customer Support for debugging and troubleshooting purposes.
The Support and Help > Packet Capture page displays the list of complete packet capture files stored on the hard drive. When a packet capture is running, the web interface shows the status of the capture in progress by showing the current statistics, such as file size and time elapsed.
You can download the packet capture files using the Download button in the web interface, or by connecting to the appliance using FTP and retrieving them from the captures directory.
In the CLI, use the packetcapture command.
In the web interface, select the Packet Capture option under the Support and Help menu.
Note The packet capture feature is similar to the Unix tcpdump command.
Starting a Packet Capture
To start a packet capture in the CLI, run the packetcapture > start
command. If you need to stop a running packet capture, run the packetcapture > stop
command.
To start a packet capture in the web interface, select the Packet Capture option under the Support and
Help menu, and then click Start Capture . To stop a running capture, click Stop Capture .
Note The web interface only displays packet captures started in the web interface, not from the CLI. Similarly, the CLI only displays the status of a current packet capture run started in the CLI.
Editing Packet Capture Settings
To edit the packet capture settings in the CLI, run the packetcapture > setup
command.
To edit packet capture settings in the web interface, select the Packet Capture option under the Support and Help menu, and then click Edit Settings .
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-5
Support Commands
Chapter 27 System Administration
Table 27-1 describes the packet capture settings you can configure.
Table 27-1 Packet Capture Configuration Options
Option
Capture file size limit
Capture duration
Description
The maximum file size for all packet capture files.
Choose how long to run the packet capture:
• Run Capture Until File Size Limit Reached.
The packet capture runs until the file size limit is reached.
•
•
Run Capture Until Time Elapsed Reaches.
The packet capture runs until the configured time has passed. You can enter the time in seconds (s), minutes (m), or hours (h). If you enter the amount of time without specifying the units, AsyncOS uses seconds by default.
Note: If the file reaches the maximum size limit before the entire time has elapsed, the existing file is deleted (the data is discarded) and a new file starts with the current packet capture data.
Run Capture Indefinitely.
The packet capture runs until you manually stop it.
Note: If the file reaches the maximum size limit before you manually stop the packet capture, the existing file is deleted (the data is discarded) and a new file starts with the current packet capture data.
You can always manually stop any packet capture.
Select the network interface on which to run the packet capture.
Network interface to capture
Filters Choose whether or not to apply a filter to the packet capture to reduce the amount of data stored in the packet capture.
You can use one of the predefined filters to filter by port, source IP address, or destination IP address, or you can create a custom filter using any syntax supported by the Unix tcpdump command.
Note When you change the packet capture settings without committing the changes and then start a packet capture, AsyncOS uses the new settings. This allows you to use the new settings in the current session without enforcing the settings for future packet capture runs. The settings remain in effect until you clear them.
Figure 27-3 on page 27-7 shows where you can edit the packet capture settings in the web interface.
27-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Figure 27-3 Editing Packet Capture Settings in the Web Interface
Working with Feature Keys
Working with Feature Keys
Occasionally, your support team may provide a key to enable specific functionality on your system. Use the System Administration > Feature Keys page in the web interface (or the featurekey
command in the
CLI) to enter the key and enable the associated functionality.
Keys are specific to the serial number of your appliance and specific to the feature being enabled (you cannot re-use a key from one system on another system). If you incorrectly enter a key, an error message is generated.
Feature keys functionality is split into two pages: Feature Keys and Feature Key Settings.
Feature Keys Page
The Feature Keys page:
• Lists all active feature keys for the appliance.
•
•
Shows any feature keys that are pending activation.
Looks for new keys that have been issued (optional, and also can install keys).
A list of the currently enabled features is displayed. The Pending Activation section is a list of feature keys that have been issued for the appliance but have not yet been activated. Your appliance may check periodically for new keys depending on your configuration. You can click Check for New Keys to refresh the list of pending keys.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-7
Working with Feature Keys
Figure 27-4 The Feature Keys Page
Chapter 27 System Administration
You can also use the featurekey
CLI command to accomplish the same tasks as on the Feature Keys page.
Feature Key Settings Page
The Feature Key Settings page is used to control whether your appliance checks for and downloads new feature keys, and whether or not those keys are automatically activated.
Figure 27-5 The Feature Key Settings Page
To add a new feature key manually, paste or type the key into the Feature Key field and click Submit
Key . An error message is displayed if the feature is not added (if the key is incorrect, etc.), otherwise the feature key is added to the display.
To activate a new feature key from the Pending Activation list, select the key (mark the “Select” checkbox) and click Activate Selected Keys .
You can configure your appliance to automatically download and install new keys as they are issued. In this case, the Pending Activation list will always be empty. You can tell AsyncOS to look for new keys at any time by clicking the Check for New Keys button, even if you have disabled the automatic checking via the Feature Key Settings page.
You can also use the featurekeyconfig
CLI command to accomplish the same tasks as on the Feature
Key Settings page.
Expired Feature Keys
If the feature key for the feature you are trying to access (via the web interface) has expired, please contact your Cisco representative or support organization.
27-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Administering User Accounts
Administering User Accounts
The following types of users can log into the Web Security appliance to manage the appliance:
• Local users.
You can define users locally on the appliance itself. For more information, see
Managing Local Users, page 27-9 .
• Users defined in an external system.
You can configure the appliance to connect to an external
RADIUS server to authenticate users logging into the appliance. For information, see
External Authentication, page 27-12 .
You can manage local users and connections to external authentication servers using the System
Administration > Users page in the web interface, or the userconfig
command in the CLI.
Figure 27-6 shows where you manage local users and external authentication.
Figure 27-6 System Administration > Users Page
Note Any user you define can log into the appliance using any method, such as logging into the web interface or using SSH.
Managing Local Users
•
•
•
You can define any number users locally on the Web Security appliance. You can add, edit, and delete local users. Consider the following rules when defining local users:
• User names can contain lowercase letters, numbers, and the dash ( - ) character.
•
•
User names cannot start with a dash.
User names cannot be greater than 16 characters.
Passwords must contain at least 6 characters.
User names cannot be special names that are reserved by the system, such as “operator” or “root.”
If you also use external authentication, user names should not duplicate externally-authenticated user names.
Note You can define different preferences, such as language support, for local users. For more information, see
Defining User Preferences, page 27-14
.
The default system admin account has all administrative privileges. You can change the admin account password, but you cannot edit or delete this account.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-9
Chapter 27 System Administration
Administering User Accounts
To create a new user account, specify a user name and a full name, and then assign the user to a user role
can assign.
Table 27-2 User Types
Group
Administrator
Operator
Read-Only
Operator
Guest
Description
Allows full access to all system configuration settings. However, the upgradecheck and upgradeinstall
commands can be issued only from the system defined
“admin” account.
Restricts users from creating, editing, or removing user accounts. The operators group also restricts the use of the following commands:
• resetconfig
• upgradecheck
• upgradeinstall
• systemsetup or running the System Setup Wizard
User accounts with this role:
•
•
Can view configuration information.
Can make and submit changes to see how to configure a feature, but they cannot commit them.
• Cannot make any other changes to the appliance, such as clearing the cache or saving files.
• Cannot access the file system, FTP, or SCP.
The guests group users can only view system status information.
After assigning the user to a group, you must specify a password for the new account.
Note If you have lost the admin user password, contact your support provider.
Adding Local Users
To add a local user:
Step 1 On the System Administration > Users page, click Add User.
The Add Local User page is displayed.
Figure 27-7 Adding a Local User
27-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Administering User Accounts
Step 2
Step 3
Step 4
Step 5
Step 6
Enter a name for the user. Some words are reserved, such as “operator” and “root”.
Enter a full name for the user.
Select a user type. See Table 27-2, `User Types,' on page 10 for more information about user types.
Enter a password and retype it.
Submit and commit your changes.
Deleting Users
To delete a user:
Step 1
Step 2
Step 3
On the System Administration > Users page, click the trash can icon corresponding to the listed user name.
Confirm the deletion by clicking Delete in the warning dialog that appears.
Submit and commit your changes.
Editing Users
To edit a user:
Step 1
Step 2
Step 3
On the System Administration > Users page, click the user name.
The Edit User page is displayed.
Make changes to the user.
Submit and commit your changes.
Changing Passwords
Users can change their own passwords using the Change Password option under the Options menu located on the top right-hand side of the web interface.
Figure 27-8 shows where you can change the current user password.
Figure 27-8 The Change Password Option
Note To change the password for the admin account, use the System Administration > Users page or use the password
or passwd
command in the CLI. Password changes take effect immediately and do not require a commit.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-11
Chapter 27 System Administration
Administering User Accounts
Monitoring Users from the CLI
The who
, whoami
, and last
commands can be used to monitor user access to the appliance.
• The who
command lists users, the time of login, idle time, and the remote host from which the user is logged in: example.com> who
Username Login Time Idle Time Remote Host What
======== ========== ========= =========== ==== admin 03:27PM 0s 10.xx.xx.xx cli
• The whoami
command displays the user name and group information: example.com> whoami
Username: admin
Full Name: Administrator
Groups: admin, operators, config, log, guest
• The last
command displays information about users who have recently logged into the appliance.
example.com> last
Username Remote Host Login Time Logout Time Total Time
======== =========== ================ ================ ========== admin 10.xx.xx.xx Sat May 15 23:42 still logged in 15m admin 10.xx.xx.xx Sat May 15 22:52 Sat May 15 23:42 50m admin 10.xx.xx.xx Sat May 15 11:02 Sat May 15 14:14 3h 12m admin 10.xx.xx.xx Fri May 14 16:29 Fri May 14 17:43 1h 13m shutdown Fri May 14 16:22
Using External Authentication
You can configure the Web Security appliance to use a RADIUS directory service to authenticate users logging in to the appliance. You can use external authentication when logging into the appliance using
HTTP, HTTPS, SSH, and FTP. To set up the appliance to use an external directory for authentication, use the System Administration > Users page in the web interface or the userconfig > external
CLI command.
shows where you enable external authentication on the System Administration > Users page.
27-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Figure 27-9 Enabling External Authentication
Administering User Accounts
You can configure the appliance to contact multiple external servers for authentication. You might want to define multiple external servers to allow for failover in case one server is temporarily unavailable.
When you define multiple external servers, the appliance connects to the servers in the order defined on the appliance.
When external authentication is enabled and a user logs into the Web Security appliance, the appliance first determines if the user is the system defined “admin” account. If not, then the appliance checks the first configured external server to determine if the user is defined there. If the appliance cannot connect to the first external server, the appliance checks the next external server in the list. If the appliance cannot connect to any external server, it tries to authenticate the user as a local user defined on the Web Security appliance. If the user does not exist on any external server or on the appliance, or if the user enters the wrong password, access to the appliance is denied.
Consider the following rules and guidelines when using external authentication:
• You can configure up to ten RADIUS servers.
•
•
The appliance can communicate with RADIUS directories using either the Password Authentication
Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP).
You can map all RADIUS users to the Administrator user role type or you can map RADIUS users to different Web Security appliance user role types.
• If you will also add local users, be sure that local user names do not duplicate externally-authenticated user names.
To map RADIUS users to different Web Security appliance user role types, you assign a role type, such as Administrator and Operator, to a RADIUS CLASS attribute. Mapping different role types lets you specify the authorization level for each RADIUS user.
When you map different user role types to each RADIUS user, consider the following rules and guidelines:
• RADIUS CLASS attributes must contain from three to 253 characters. They must not contain colons, commas, or newline characters.
• Any RADIUS user whose CLASS attribute is not mapped to an appliance user role type is denied access to the appliance.
To enable external authentication using RADIUS:
Step 1
Step 2
On the System Administration > Users page, click Enable .
The Edit External Authentication page is displayed.
Check the Enable External Authentication option if it is not enabled already.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-13
Defining User Preferences
Figure 27-10 Enabling External Authentication Using RADIUS
Chapter 27 System Administration
Step 3
Step 4
Step 5
Step 6
Step 7
Enter the hostname for the RADIUS server.
Enter the port number for the RADIUS server. The default port number is 1812.
Enter the Shared Secret password for the RADIUS server.
Enter the number of seconds for the appliance to wait for a response from the server before timing out.
Optionally, click Add Row to add another RADIUS server. Repeat steps
for each RADIUS server.
Note You can add up to ten RADIUS servers.
Step 8 Enter the number of seconds AsyncOS stores the external authentication credentials before contacting the RADIUS server again to re-authenticate in the “External Authentication Cache Timeout” field.
Default is zero (0).
Note If the RADIUS server uses one-time passwords, for example passwords created from a token, enter zero (0). When the value is set to zero, AsyncOS does not contact the RADIUS server again to authenticate during the current session.
Step 9
Step 10
Step 11
Choose whether to map all externally authenticated users to the Administrator role or to different appliance user role types.
If you map users to different role types, enter the group name as defined in the RADIUS CLASS attribute in the Group Name or Directory field, and choose an appliance role type from the Role field. You can add more role mappings by clicking Add Row .
For more information on user role types, see
Managing Local Users, page 27-9 .
Submit and commit your changes.
Defining User Preferences
Local users can define preference settings, such as language, specific to each account. These settings apply by default when the user first logs into the appliance. The preference settings are stored for each user and are the same regardless from which client machine the user logs into the appliance.
When users change these settings but do not commit the changes, the settings revert to the default values when they log in again.
27-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Configuring Administrator Settings
describes the user preference settings you can define.
Table 27-3 User Preference Settings
Preference Setting
Language Display
Landing Page
Reporting Time Range
Displayed (default)
Number of Reporting Rows
Displayed
Description
The language AsyncOS for Web uses in the web interface and CLI.
The page that displays when the user logs into the appliance.
The default time range that displays for reports on the Reporting tab.
The number of rows of data shown for each report by default.
To define the user preference settings:
Step 1
Step 2
Step 3
Step 4
Step 5
Log into the appliance with the user account for which you want to define its preference settings.
Choose Preferences from the Options menu.
On the User Preferences page, click Edit Preferences . The Edit User Preferences Settings page is displayed.
Configure the settings described in
.
Submit and commit your changes.
Configuring Administrator Settings
You can configure the Web Security appliance to have stricter access requirements for administrators logging into the appliance. You might want to do this to meet certain organization requirements.
You configure these settings with the adminaccessconfig
CLI command. You can configure the appliance to:
•
•
•
Display user-defined text at administrator login.
Restrict administrator access to certain machines.
Require stronger SSL ciphers for administrator access.
Configuring Custom Text at Login
Using the adminaccessconfig > banner
CLI command, you can configure the appliance to display any text you specify when an administrator tries to logs in. You might want to do this to display a banner that informs the user of organizational policies and conditions. The custom banner text appears when an administrator tries to access the appliance through all interfaces, such as the web interface or via FTP.
You can load the custom text by either pasting it into the CLI prompt or by copying it from a file located on the Web Security appliance. To upload the text from a file, you must first transfer the file to the configuration directory on the appliance using FTP.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-15
Chapter 27 System Administration
Configuring the Return Address for Generated Messages
Configuring IP-Based Administrator Access
Using the adminaccessconfig > ipaccess CLI command, you can control from which IP addresses administrators access the Web Security appliance. Administrators can access the appliance from any machine or from machines with an IP address from a list you specify.
When restrict access to an allow list, you can specify IP addresses, subnets, or CIDR addresses.
By default, when you list the addresses that can access the appliance, the IP address of your current machine is listed as the first address in the allow list. You cannot delete the IP address of your current machine from the allow list.
Configuring the SSL Ciphers for Administrator Access
Using the adminaccessconfig > strictssl
CLI command, you can configure the appliance so administrators log into the web interface on port 8443 using stronger SSL ciphers (greater than 56 bit encryption).
When you configure the appliance to require stronger SSL ciphers, the change only applies to administrators accessing the appliance using HTTPS to manage the appliance. It does not apply to other network traffic connected to the Web Proxy using HTTPS.
Configuring the Return Address for Generated Messages
You can configure the return address for mail generated by AsyncOS for reports. You can specify the display, user, and domain names of the return address. You can also choose to use the Virtual Gateway domain for the domain name.
Configure the return address on the System Administration > Return Addresses page.
Figure 27-11 Configuring Return Addresses
To configure the return address for system-generated email messages:
Step 1
Step 2
Navigate to the System Administration > Return Addresses page.
Click Edit Settings .
Figure 27-12 Editing Return Address Settings
Display Name User Name Domain Name
27-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Managing Alerts
Step 3
Step 4
For Reports, enter the display name, user name, and domain name in the fields shown in
.
Submit and commit your changes.
Managing Alerts
Alerts are email notifications containing information about events occurring on the IronPort appliance.
These events can be of varying levels of importance (or severity) from minor (Informational) to major
(Critical) and pertain generally to a specific component or feature on the appliance. Alerts are generated by the IronPort appliance. You can specify which alert messages are sent to which users and for which severity of event they are sent. Manage alerts using the System Administration > Alerts page in the web interface or using the alertconfig command in the CLI.
Note To receive alerts and email notifications, you must configure the SMTP relay host that the appliance uses
to send the email messages. For information about configuring the SMTP relay host, see Configuring
SMTP Relay Hosts, page 26-16 .
Alerting Overview
The alerting feature consists of two main parts:
•
•
Alerts - consist of an Alert Recipient (email addresses for receiving alerts), and the alert notification (severity and alert type) sent to the recipient.
Alert Settings - specify global behavior for the alerting feature, including alert sender (FROM:) address, seconds to wait between sending duplicate alerts, and whether to enable AutoSupport (and optionally send weekly AutoSupport reports).
Alerts: Alert Recipients, Alert Classifications, and Severities
Alerts are email messages or notifications containing information about a specific function (or alert classification) or functions such as a hardware or anti-virus problem, sent to an alert- recipient. An alert recipient is simply an email address to which the alert notifications are sent. The information contained in the notification is determined by an alert classification and a severity. You can specify which alert classifications, at which severity, are sent to any alert recipient. The alerting engine allows for granular control over which alerts are sent to which alert recipients. For example, you can configure the system to send only specific alerts to an alert recipient, configuring an alert recipient to receive notifications only when Critical (severity) information about the System (alert type) is sent. You can also configure general settings (see
Configuring Alert Settings, page 27-22
).
Alert Classifications
AsyncOS sends the following alert classifications:
Table 27-4 Alert Classifications and Components
Alert Classification
System
Hardware
Updater
Alert Component
System
Hardware
Updater
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-17
Chapter 27 System Administration
Managing Alerts
Table 27-4 Alert Classifications and Components (continued)
Alert Classification
Web Proxy
DVS™ and Anti-Malware
L4 Traffic Monitor
Alert Component
Proxy
DVS
TrafMon
Severities
Alerts can be sent for the following severities:
• Critical: Requires immediate attention.
•
•
Warning: Problem or error requiring further monitoring and potentially immediate attention.
Information: Information generated in the routine functioning of this device.
Alert Settings
Alert settings control the general behavior and configuration of alerts, including:
•
•
•
•
•
The RFC 2822 Header From: when sending alerts (enter an address or use the default
“alert@<hostname>”). You can also set this via the CLI, using the alertconfig > from command.
The initial number of seconds to wait before sending a duplicate alert.
The maximum number of seconds to wait before sending a duplicate alert.
The status of AutoSupport (enabled or disabled).
The sending of AutoSupport’s weekly status reports to alert recipients set to receive System alerts at the Information level.
Sending Duplicate Alerts
You can specify the initial number of seconds to wait before AsyncOS will send a duplicate alert. If you set this value to 0, duplicate alert summaries are not sent and instead, all duplicate alerts are sent without any delay (this can lead to a large amount of email over a short amount of time). The number of seconds to wait between sending duplicate alerts (alert interval) is increased after each alert is sent. The increase is the number of seconds to wait plus twice the last interval. So a 5 second wait would have alerts sent at 5 seconds, 15, seconds, 35 seconds, 75 seconds, 155 seconds, 315 seconds, etc.
Eventually, the interval could become quite large. You can set a cap on the number of seconds to wait between intervals via the maximum number of seconds to wait before sending a duplicate alert field. For example, if you set the initial value to 5 seconds, and the maximum value to 60 seconds, alerts would be sent at 5 seconds, 15 seconds, 35 seconds, 60 seconds, 120 seconds, etc.
Cisco IronPort AutoSupport
To allow Cisco to better support and design future system changes, the appliance can be configured to send Cisco a copy of all alert messages generated by the system. This feature, called AutoSupport, is a useful way to allow our team to be proactive in supporting your needs. AutoSupport also sends weekly reports noting the uptime of the system, the output of the status
command, and the AsyncOS version used.
27-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Managing Alerts
By default, alert recipients set to receive Information severity level alerts for System alert types will receive a copy of every message sent to Cisco. This can be disabled if you do not want to send the weekly
.
Alert Messages
Alert messages are standard email messages. You can configure the Header From: address, but the rest of the message is generated automatically.
Alert From Address
You can configure the Header From: address via the Edit Settings button or via the CLI.
Alert Subject
An alert email message's subject follows this format:
Subject: [severity]-[hostname]: ([class]) short message
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-19
Chapter 27 System Administration
Managing Alerts
Example Alert Message
Date: 23 May 2007 21:10:19 +0000
From: IronPort S650 Alert [[email protected]]
Subject: Critical <System> example.com: Internal SMTP giving up on message to [email protected] with...
The Critical message is:
Internal SMTP giving up on message to [email protected] with subject 'IronPort Report:
Client Web Activity (example.com)': Unrecoverable error.
Product: IronPort S650 Web Security Appliance
Model: S650
Version: 5.1.0-225
Serial Number: XXXXXXXXXXXX-XXXXXXX
Timestamp: Tue May 10 09:39:24 2007
For more information about this error, please see
http://support.ironport.com
If you desire further information, please contact your support provider.
Managing Alert Recipients
Log in to the S-Series appliance web interface (GUI) and click the System Administration tab. Click the
Alerts link in the left menu. For information about how to access the S-Series appliance web interface, see
Accessing the Web Security Appliance, page 2-2
.
27-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Figure 27-13 The Alerts Page
Managing Alerts
Note If you enabled AutoSupport during System Setup, the email address you specified will receive alerts for all severities and classes by default. You can change this configuration at any time.
The Alerts page lists the existing alert recipients and alert settings.
From the Alerts page, you can:
• Add, configure, or delete alert recipients
• Modify the alert settings
Adding New Alert Recipients
To add a new alert recipient:
Step 1 Click Add Recipient...
on the Alerts page. The Add Alert Recipients page is displayed:
Figure 27-14 Adding a New Alert Recipient
Step 2
Step 3
Step 4
Enter the recipient’s email address. You can enter multiple addresses, separated by commas.
Select which alert severities to receive.
Submit and commit your changes.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-21
Chapter 27 System Administration
Managing Alerts
Configuring Existing Alert Recipients
To edit an existing alert recipient:
Step 1
Step 2
Step 3
Click the alert recipient in the Alert Recipients listing. The Configure Alert Recipient page is displayed.
Make changes to the alert recipient.
Submit and commit your changes.
Deleting Alert Recipients
To delete an alert recipient:
Step 1
Step 2
Step 3
Click the trash can icon corresponding to the alert recipient in the Alert Recipient listing.
Confirm the deletion by clicking Delete in the warning dialog that appears.
Commit your changes.
Configuring Alert Settings
Alert settings are global settings, meaning that they affect how all of the alerts behave.
Editing Alert Settings
To edit alert settings:
Step 1 Click Edit Settings...
on the Alerts page. The Edit Alert Settings page is displayed:
Figure 27-15 Editing Alert Settings
Step 2
Step 3
Enter a Header From: address to use when sending alerts, or select Automatically Generated
(“alert@<hostname>”).
Mark the checkbox if you want to specify the number of seconds to wait between sending duplicate alerts. For more information, see
Sending Duplicate Alerts, page 27-18 .
• Specify the initial number of seconds to wait before sending a duplicate alert.
• Specify the maximum number of seconds to wait before sending a duplicate alert.
27-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Managing Alerts
Step 4
Step 5
You can enable AutoSupport by checking the Cisco IronPort AutoSupport option. For more information about AutoSupport, see
Cisco IronPort AutoSupport, page 27-18 .
• If AutoSupport is enabled, the weekly AutoSupport report is sent to alert recipients set to receive
System alerts at the Information level. You can disable this via the checkbox.
Submit and commit your changes.
Alert Listing
The following sections list alerts by classification. The table in each section includes the alert name
(internally used descriptor), actual text of the alert, description, severity (critical, information, or warning) and the parameters (if any) included in the text of the message. The value of the parameter is replaced in the actual text of the alert. For example, an alert message below may mention “$ip” in the message text. “$ip” is replaced by the actual IP address when the alert is generated.
Feature Key Alerts
contains a list of the various feature key alerts that can be generated by AsyncOS, including a description of the alert and the alert severity.
Table 27-5 Listing of Possible Feature Key Alerts
Message Alert Severity
A “$feature” key was downloaded from the IronPort key server and placed into the pending area. EULA acceptance required.
Information.
Your “$feature” evaluation key has expired. Please contact your authorized IronPort sales representative.
Warning.
Your “$feature” evaluation key will expire in under
$days day(s). Please contact your authorized
IronPort sales representative.
Warning.
Parameters
$feature: Name of the feature.
$feature: Name of the feature.
$feature: Name of the feature.
$days: The number of days that will pass before the feature key will expire.
Hardware Alerts
Message
A RAID-event has occurred:
$error
contains a list of the various hardware alerts that can be generated by AsyncOS, including a description of the alert and the alert severity.
Table 27-6 Listing of Possible Hardware Alerts
Alert Severity
Warning
Parameters
$error: Text of the RAID error.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-23
Chapter 27 System Administration
Managing Alerts
Logging Alerts
Message
$error.
description of the alert and the alert severity.
Table 27-7 Listing of Possible Logging Alerts
Log Error: Subscription $name: Log partition is full.
Log Error: Push error for subscription $name:
Failed to connect to $ip: $reason.
Alert Severity
Information.
Critical.
Critical.
Parameters
$error: The traceback string of the error.
$name: Log subscription name.
Log Error: Push error for subscription $name: An
FTP command failed to $ip: $reason.
Log Error: Push error for subscription $name: SCP failed to transfer to $ip:$port: $reason',
Log Error: 'Subscription $name: Failed to connect to $hostname ($ip): $error.
Log Error: Subscription $name: Network error while sending log data to syslog server $hostname
($ip): $error
Subscription $name: Timed out after $timeout seconds sending data to syslog server $hostname
($ip).
Subscription $name: Syslog server $hostname ($ip) is not accepting data fast enough.
Subscription $name: Oldest log file(s) were removed because log files reached the maximum number of $max_num_files. Files removed include:
$files_removed.
Critical.
Critical.
Critical.
Critical.
Critical.
Critical.
Information.
$name: Log subscription name.
$ip: IP address of the remote host.
$reason: Text describing the connect error
$name: Log subscription name.
$ip: IP address of the remote host.
$reason: Text describing what went wrong.
$name: Log subscription name.
$ip: IP address of the remote host.
$port: Port number on the remote host.
$reason: Text describing what went wrong.
$name: Log subscription name.
$hostname: Hostname of the syslog server.
$ip: IP address of the syslog server.
$error: Text of the error message.
$name: Log subscription name.
$hostname: Hostname of the syslog server.
$ip: IP address of the syslog server.
$error: Text of the error message.
$name: Log subscription name.
$timeout: Timeout in seconds.
$hostname: Hostname of the syslog server.
$ip: IP address of the syslog server.
$name: Log subscription name.
$hostname: Hostname of the syslog server.
$ip: IP address of the syslog server.
$name: Log subscription name.
$max_num_files: Maximum number of files allowed per log subscription.
$files_removed: List of files that were removed.
27-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Managing Alerts
Reporting Alerts
Message
contains a list of the various reporting alerts that can be generated by AsyncOS, including a description of the alert and the alert severity.
Table 27-8 Listing of Possible Reporting Alerts
Alert Severity
The reporting system is unable to maintain the rate of data being generated. Any new data generated will be lost.
The reporting system is now able to handle new data.
Critical.
Information.
A failure occurred while building periodic report
‘$report_title’.
Critical.
This subscription should be examined and deleted if its configuration details are no longer valid.
A failure occurred while emailing periodic report
‘$report_title’.
Critical.
This subscription has been removed from the scheduler.
Processing of collected reporting data has been disabled due to lack of logging disk space. Disk usage is above $threshold percent. Recording of reporting events will soon become limited and reporting data may be lost if disk space is not freed up (by removing old logs, etc).
Warning.
Once disk usage drops below $threshold percent, full processing of reporting data will be restarted automatically.
PERIODIC REPORTS: While building periodic report $report_title' the expected domain specification file could not be found at
‘$file_name’. No reports were sent.
Critical.
Counter group “$counter_group” does not exist.
PERIODIC REPORTS: While building periodic report $report_title’ the domain specification file
‘$file_name’ was empty. No reports were sent.
Critical.
Critical.
PERIODIC REPORTS: Errors were encountered while processing the domain specification file
‘$file_name’ for the periodic report ‘$report_title’.
Any line which has any reported problem had no report sent.
Critical.
$error_text
Parameters
Not applicable.
Not applicable.
$report_title:
$report_title:
$threshold:
$file_name:
Title of the report.
Title of the report.
Threshold value.
$report_title: Title of the report.
Name of the file.
$counter_group:
$report_title:
$file_name:
Name of the counter_group.
Title of the report.
Name of the file.
$report_title: Title of the report.
$file_name: Name of the file.
$error_text: List of errors encountered.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-25
Chapter 27 System Administration
Managing Alerts
Message
Table 27-8 Listing of Possible Reporting Alerts (continued)
Processing of collected reporting data has been disabled due to lack of logging disk space. Disk usage is above $threshold percent. Recording of reporting events will soon become limited and reporting data may be lost if disk space is not freed up (by removing old logs, etc).
Alert Severity
Warning.
Once disk usage drops below $threshold percent, full processing of reporting data will be restarted automatically.
The reporting system has encountered a critical error while opening the database. In order to prevent disruption of other services, reporting has been disabled on this machine. Please contact customer support to have reporting enabled.
The error message is:
Critical.
$err_msg
Parameters
$threshold: Threshold value.
$err_msg: Error message text.
System Alerts
Message
Startup script $name exited with error: $message
System halt failed: $exit_status: $output',
System reboot failed: $exit_status: $output
Process $name listed $dependency as a dependency, but it does not exist.
description of the alert and the alert severity.
Table 27-9 Listing of Possible System Alerts
Process $name listed $dependency as a dependency, but $dependency is not a wait_init process.
Process $name listed itself as a dependency.
Process $name listed $dependency as a dependency multiple times.
Alert Severity
Critical.
Critical.
Critical.
Critical.
Critical.
Critical.
Critical.
Parameters
$name: Name of the script.
$message: Error message text.
$exit_status: Exit code of the command.
$output: Output from the command.
$exit_status: Exit code of the command.
$output: Output from the command.
$name: Name of the process.
$dependency: Name of the dependency that was listed.
$name: Name of the process.
$dependency: Name of the dependency that was listed.
$name: Name of the process.
$name: Name of the process.
$dependency: Name of the dependency that was listed.
27-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Setting System Time
Table 27-9
Message
Dependency cycle detected: $cycle.
Listing of Possible System Alerts (continued)
Alert Severity
Critical.
Parameters
$cycle: The list of process names involved in the cycle.
$error: The error message associated with the exception.
An error occurred while attempting to share statistical data through the Network Participation feature. Please forward this tracking information to your IronPort support provider:
Warning.
Error: $error.
There is an error with “$name”.
Critical.
An application fault occurred: “$error”
Tech support: Service tunnel has been enabled, port
$port
Tech support: Service tunnel has been disabled.
Critical.
Information.
Information.
$name: Name of the process that generated a core file.
$error: Text of the error, typically a traceback.
$port: Port number used for the service tunnel.
Not applicable.
Updater Alerts
description of the alert and the alert severity.
Table 27-10 Listing of Possible Updater Alerts
Message
The $app application tried and failed $attempts times to successfully complete an update. This may be due to a network configuration issue or temporary outage.
Warning.
The updater has been unable to communicate with the update server for at least $threshold.
Unknown error occurred: $traceback.
Alert Severity
Warning.
Critical.
Parameters
$app: Web Security appliance security service name.
$attempts: Number of attempts tried.
$threshold:
$traceback:
Threshold value time.
Traceback information.
Setting System Time
To set the system time on your Web Security appliance, set the time zone used, or select an NTP server and query interface. To set the system time, use the System Administration > Time Zone or Time Settings page or use the ntpconfig
, settime
, and settz commands.
Selecting a Time Zone
To set the time zone use the System Administration > Time Zone page:
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-27
Chapter 27 System Administration
Setting System Time
Figure 27-16 The Time Zone Page
Select a time zone in the Time Zone area. You can configure the time zone by specifying the region and country, or by using a GMT offset.
The web interface uses the POSIX-style method of indicating the time zone using a GMT offset. This may be different than the offset convention used elsewhere.
The offset refers to the amount of hours that must be added or subtracted to the local time zone in order to reach GMT (Greenwich Mean Time or the Prime Meridian). Hours preceded by a minus sign (“-”) are east of the Prime Meridian. A plus sign (“+”) indicates west of the Prime Meridian.
For example, if the current time in New York is 08:00, then you must add five hours to get the current time in Greenwich, England, which is 13:00. In this case, to indicate the time in New York, the GMT offset is GMT+5. The “+5” in the offset indicates that you must add five hours to the time in New York to reach Greenwich Mean Time.
Editing System Time
To edit system time, use the System Administration > Time Settings page.
Figure 27-17 The Edit Time Settings Page
Configure NTP (Network Time Protocol)
To edit NTP server settings and use an NTP server to synchronize the system clock with other computers:
Step 1
Step 2
Step 3
Enter an NTP server IP address and use the Add Row key to repeat as necessary for each NTP server.
Choose the routing table associated with an appliance network interface type, either Management or
Data, to use for NTP queries. This is the IP address from which NTP queries should originate.
Submit and commit the changes.
Manually Setting System Time
To set the system time manually:
27-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Step 1
Step 2
Step 3
Step 4
Select Set Time Manually.
Enter the month, day, year, hour, minutes, and seconds.
Select A.M or P.M.
Submit and commit to save the changes.
Installing a Server Digital Certificate
Installing a Server Digital Certificate
When an administrator logs into the Web Security appliance using HTTPS, the appliance uses a digital certificate to securely establish the connection with the client application. The Web Security appliance uses the “Cisco IronPort Web Security Appliance Demo Certificate” that comes installed by default.
However, client applications are not programmed to recognize this certificate, so you can upload a digital certificate to the appliance that your applications recognize automatically.
shows the warning message that is displayed in Firefox when accessing the Web Security appliance using the Cisco IronPort Web Security Appliance Demo Certificate.
Figure 27-18 Cisco IronPort Web Security Appliance Demo Certificate as an Unknown Authority
To configure the Web Security appliance to use a different digital server certificate, follow these steps:
Step 1
Step 2
Obtain a certificate and private key pair to upload. For more information, see
Obtaining Certificates, page 27-29
.
Upload the certificate and private key pair to the appliance. For more information, see
Certificates to the Web Security Appliance, page 27-30 .
Obtaining Certificates
To obtain a digital certificate to upload to the appliance, you must follow these steps:
Step 1
Step 2
Generate a public-private key pair.
Generate a Certificate Signing Requests (CSR).
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-29
Chapter 27 System Administration
Installing a Server Digital Certificate
Step 3 Contact a certificate authority (CA) to sign the certificate.
The certificate you upload to the appliance must meet the following requirements:
• It must use the X.509 standard.
•
•
It must include a matching private key in PEM format. DER format is not supported.
The private key must be unencrypted.
The Web Security appliance cannot generate Certificate Signing Requests (CSR) for certificates uploaded to the appliance. Therefore, to have a certificate created for the appliance, you must issue the signing request from another system. Save the PEM-formatted key from this system because you will need to install it on the appliance later.
You can use any UNIX machine with a recent version of OpenSSL installed. Be sure to put the appliance hostname in the CSR. Use the guidelines at the following location for information on generating a CSR using OpenSSL: http://www.modssl.org/docs/2.8/ssl_faq.html#ToC28
Once the CSR has been generated, submit it to a certificate authority (CA). The CA will return the certificate in PEM format.
If you are acquiring a certificate for the first time, search the Internet for “certificate authority services
SSL server certificates,” and choose the service that best meets the needs of your organization. Follow the service’s instructions for obtaining an SSL certificate.
Note You can also generate and sign your own certificate. Tools for doing this are included with OpenSSL, free software from http://www.openssl.org
.
Intermediate Certificates
In addition to root certificate authority (CA) certificate verification, AsyncOS supports the use of intermediate certificate verification. Intermediate certificates are certificates issued by a trusted root CA which are then used to create additional certificates. This creates a chained line of trust. For example, a certificate may be issued by example.com who, in turn, is granted the rights to issue certificates by a trusted root CA. The certificate issued by example.com must be validated against example.com’s private key as well as the trusted root CA’s private key.
Uploading Certificates to the Web Security Appliance
To upload a digital certificate to the Web Security appliance, use the certconfig
command.
The following example shows a certificate being uploaded. You can also add intermediate certificates from this command.
example.com> certconfig
Currently using the demo certificate/key for HTTPS management access.
Choose the operation you want to perform:
27-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
- SETUP - Configure security certificate and key.
[]> setup
Installing a Server Digital Certificate
Management (HTTPS): paste cert in PEM format (end with '.'):
-----BEGIN CERTIFICATE-----
MIICLDCCAdYCAQAwDQYJKoZIhvcNAQEEBQAwgaAxCzAJBgNVBAYTAlBUMRMwEQYD
VQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5ldXJv bmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMTEmJy dXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZpMB4X
DTk2MDkwNTAzNDI0M1oXDTk2MTAwNTAzNDI0M1owgaAxCzAJBgNVBAYTAlBUMRMw
EQYDVQQIEwpRdWVlbnNsYW5kMQ8wDQYDVQQHEwZMaXNib2ExFzAVBgNVBAoTDk5l dXJvbmlvLCBMZGEuMRgwFgYDVQQLEw9EZXNlbnZvbHZpbWVudG8xGzAZBgNVBAMT
EmJydXR1cy5uZXVyb25pby5wdDEbMBkGCSqGSIb3DQEJARYMc2FtcG9AaWtpLmZp
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNw
L4lYKbpzzlmC5beaQXeQ2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAATAN
BgkqhkiG9w0BAQQFAANBAFqPEKFjk6T6CKTHvaQeEAsX0/8YHPHqH/9AnhSjrwuX
9EBc0n6bVGhN7XaXd6sJ7dym9sbsWxb+pJdurnkxjx4=
-----END CERTIFICATE-----
.
paste key in PEM format (end with '.'):
-----BEGIN RSA PRIVATE KEY-----
MIIBPAIBAAJBAL7+aty3S1iBA/+yxjxv4q1MUTd1kjNwL4lYKbpzzlmC5beaQXeQ
2RmGMTXU+mDvuqItjVHOK3DvPK7lTcSGftUCAwEAAQJBALjkK+jc2+iihI98riEF oudmkNziSRTYjnwjx8mCoAjPWviB3c742eO3FG4/soi1jD9A5alihEOXfUzloenr
8IECIQD3B5+0l+68BA/6d76iUNqAAV8djGTzvxnCxycnxPQydQIhAMXt4trUI3nc a+U8YL2HPFA3gmhBsSICbq2OptOCnM7hAiEA6Xi3JIQECob8YwkRj29DU3/4WYD7
WLPgsQpwo1GuSpECICGsnWH5oaeD9t9jbFoSfhJvv0IZmxdcLpRcpslpeWBBAiEA
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-31
Chapter 27 System Administration
Upgrading AsyncOS for Web
6/5B8J0GHdJq89FHwEG/H2eVVUYu5y/aD6sgcm+0Avg=
-----END RSA PRIVATE KEY-----
.
Do you want add an intermediate certificate? [N]> N
Currently using custom certificate/key for HTTPS management access.
Choose the operation you want to perform:
- SETUP - Configure security certificate and key.
[]> example.com> commit
Please enter some comments describing your changes:
[]> Installed certificate and key for HTTPS management.
Changes committed: Fri Sep 26 17:59:53 2008 GMT
Upgrading AsyncOS for Web
Upgrading AsyncOS for Web uses the following two step process:
Step 1
Step 2
Configure the update and upgrade settings.
You can configure settings that affect how the Web
Security appliance downloads the upgrade information. For example, you can choose from where to download the upgrade images and more. For more information, see
Configuring Upgrade and Service
.
Upgrade the system software.
After you configure the update and upgrade settings, upgrade the software on the appliance. If you have Upgrade Notifications turned on the appliance, administrators will see a message at the top of the Web Interface notifying them of an available upgrade. For more information, see
Upgrading AsyncOS for Web from the Web Interface, page 27-34
and
AsyncOS for Web from the CLI, page 27-34
.
Consider the following guidelines when you upgrade AsyncOS for Web:
27-32
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Upgrading AsyncOS for Web
•
•
•
•
Before you start the upgrade, save the XML configuration file off the Web Security appliance from the System Administration > Configuration File page or by using the saveconfig
command. For more information, see
Saving and Loading the Appliance Configuration, page 27-2 .
When upgrading, do not pause for long amounts of time at the various prompts. If the TCP session times out during the download, the upgrade may fail.
Consider saving other files stored on the appliance, such as PAC files or customized end-user notification pages.
Consider saving the configuration information to an XML file after the upgrade completes, too.
Available Upgrade Notifications
You can configure the Web Security appliance to display a message at the top of the web interface notify you that an upgrade to AsyncOS is available for the appliance. AsyncOS displays this notification for any administrator logged into the appliance.
Figure 27-19 Upgrade Available Notification
Hover over the notification with your mouse cursor to view the number of upgrades available for the appliance and the version and build number of the latest available upgrade.
Figure 27-20 AsyncOS Upgrade Build Information
Click the down arrows in the lower right corner to expand the notification window. The window displays a link to the System Administration > System Upgrade page for you to start the upgrade.
To dismiss the message, check the Clear the notification check box and click Close . The appliance will not display another notification until a new upgrade becomes available.
Figure 27-21 Expanded Upgrade Available Window
You can enable these notifications on your appliance using the System Administration > Upgrade and
Update Settings page. See
Configuring Upgrade and Service Update Settings, page 27-34 for more
information.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-33
Configuring Upgrade and Service Update Settings
Upgrading AsyncOS for Web from the Web Interface
To upgrade AsyncOS after you configure the update and upgrade settings:
Chapter 27 System Administration
Step 1
Step 2
On the System Administration > Configuration File page, save the XML configuration file off the Web
Security appliance.
On the System Administration > System Upgrade page, click Available Upgrades .
The Available Upgrades page is displayed.
Figure 27-22 The Available Upgrades Page
Step 3
Step 4
Select an upgrade from the list of available upgrades, and click Begin Upgrade to start the upgrade process. Answer the questions as they appear.
When the upgrade is complete, click Reboot Now to reboot the Web Security appliance.
Upgrading AsyncOS for Web from the CLI
Issue the upgrade
command from the CLI to show a list of available upgrades. Select the desired upgrade from the list to install it. You may be asked to confirm messages or read and agree to license agreements, etc.
Differences from Traditional Upgrading Method
Please note these differences when upgrading AsyncOS from a local server as opposed to the traditional method:
Step 1
Step 2
The upgrading installs immediately while downloading .
A banner displays for 10 seconds at the beginning of the upgrade process. While this banner is displayed, you have the option to type Control+C to exit the upgrade process before downloading starts.
Configuring Upgrade and Service Update Settings
You can configure how the Web Security appliance downloads security services updates, such as Web
Reputation Filters and AsyncOS for Web upgrades. For example, you can choose which network interface to use when downloading the files, configure the update interval. or disable automatic updates.
27-34
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Configuring Upgrade and Service Update Settings
AsyncOS periodically queries the update servers for new updates to all security service components, but not for new AsyncOS upgrades. To upgrade AsyncOS, you must manually prompt AsyncOS to query for available upgrades. You can also manually prompt AsyncOS to query for available security service updates. For more information, see
Manually Updating Security Service Components, page 27-41 .
When AsyncOS queries an update server for an update or upgrade, it performs the following steps:
1.
Contacts the update server.
2.
Cisco allows the following sources for update servers:
– Cisco IronPort update servers.
For more information, see
Updating and Upgrading from the
Cisco IronPort Update Servers, page 27-36
.
– Local server.
For more information, see Upgrading from a Local Server, page 27-36
.
Receives an XML file that lists the available updates or AsyncOS upgrade versions. This XML file is known as the “manifest.”
3.
Downloads the update or upgrade image files.
By default, AsyncOS contacts the Cisco IronPort update servers for both update and upgrade images and the manifest XML file. However, you can choose from where to download the upgrade and update images and the manifest file. You might want to specify a local update server for the images or manifest file for any of the following reasons:
•
•
You have multiple appliances to upgrade simultaneously.
If your organization has multiple Web
Security appliances that need to upgrade, you can download the upgrade image to a web server inside your network and serve it to all appliances in your network.
Your firewall settings require static IP addresses for the Cisco IronPort update servers.
The
Cisco IronPort update servers use dynamic IP addresses. If you have strict firewall policies, you may need to configure a static location for updates and AsyncOS upgrades. For more information, see
Configuring a Static Address for the Cisco IronPort Update Servers, page 27-36 .
Note Only use a local update server for upgrade images, not update images. When you specify a local update server, the local server does not automatically receive updated security service updates from Cisco, so the appliances in your network eventually become out of date. Use a local update server for upgrading
AsyncOS, and then change the update and upgrade settings back to use the Cisco IronPort update servers so the security services update automatically again.
You can configure upgrade and updates settings in the web interface or the CLI. For more information, see
Configuring the Update and Upgrade Settings from the Web Interface, page 27-38 and
Configuring the Update and Upgrade Settings from the CLI, page 27-41
.
shows where you configure upgrade and update settings in the web interface.
Figure 27-23 System Administration > Upgrade and Update Settings Page
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-35
Chapter 27 System Administration
Configuring Upgrade and Service Update Settings
Updating and Upgrading from the Cisco IronPort Update Servers
The Web Security appliance can connect directly to the Cisco IronPort update servers and download upgrade images and security service updates. Each appliance downloads the updates and upgrade images separately.
Cisco uses a distributed update server architecture to make sure customers can quickly download updates and AsyncOS upgrades wherever in the world they are located. Because of this distributed server architecture, the Cisco IronPort update servers use dynamic IP addresses. If you have strict firewall policies, you may need to configure a static location for AsyncOS upgrades. For more information, see
Configuring a Static Address for the Cisco IronPort Update Servers, page 27-36 .
Configuring a Static Address for the Cisco IronPort Update Servers
The Cisco IronPort update servers use dynamic IP addresses. If you have strict firewall policies, you may need to configure a static location for updates and AsyncOS upgrades. If you determine that your firewall settings require a static IP address for updates, complete the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Contact Cisco IronPort Customer Support to obtain the static URL address.
Navigate to the System Administration > Upgrade and Update Settings page, and click Edit Update
Settings .
On the Edit Update Settings page, in the “Update Servers (images)” section, choose Local Update
Servers and enter the static URL address received in step
.
Verify that Cisco IronPort Update Servers is selected for the “Update Servers (list)” section.
Submit and commit your changes.
Upgrading from a Local Server
The Web Security appliance can download AsyncOS upgrades from a server within your network instead of obtaining upgrades directly from the Cisco IronPort update servers. When you use this feature, you only download the upgrade image from Cisco one time, and then serve it to all Web Security appliances in your network.
Figure 27-24 shows how Web Security appliances download upgrade images from local servers.
27-36
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Figure 27-24 Upgrading from a Local Server
Configuring Upgrade and Service Update Settings
Cisco IronPort Update
Servers
HTTP connection to Internet through firewall local HTTP connections
Local web server with access to the Internet
Web Security Appliances
To upgrade from a local server, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Configure a local server to retrieve and serve the upgrade files.
Download the upgrade zip file.
Using a browser on the local server, go to http://updates.ironport.com/fetch_manifest.html
to download a zip file of an upgrade image. To download the image, enter your serial number and the version number of the appliance. You will then be presented with a list of available upgrades. Click on the upgrade version that you want to download.
Unzip the zip file in the root directory on the local server while keeping the directory structure intact.
Configure the appliance to use the local server using the System Administration > Upgrade and Update
Settings page or the updateconfig
command.
On the System Administration > System Upgrade page, click Available Upgrades or run the upgrade command.
Note Cisco recommends changing the update and upgrade settings to use the Cisco IronPort update servers
(using dynamic or static addresses) after the upgrade is complete to ensure the security service components continue to update automatically.
Hardware and Software Requirements for Local Upgrade Servers
For downloading AsyncOS upgrade files, you must have a system in your internal network that has a
web browser (see Browser Requirements, page 2-6
) and Internet access to the Cisco IronPort update servers.
Note If you need to configure a firewall setting to allow HTTP access to this address, you must configure it using the DNS name and not a specific IP address.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-37
Chapter 27 System Administration
Configuring Upgrade and Service Update Settings
For hosting AsyncOS upgrade files, a server on the internal network must have a web server, such as
Microsoft IIS (Internet Information Services) or the Apache open source server, which has the following features:
•
•
•
•
Supports the display of directory or filenames in excess of 24 characters.
Has directory browsing enabled.
Is configured for anonymous (no authentication) or Basic (“simple”) authentication.
Contains at least 350MB of free disk space for each AsyncOS upgrade image.
Configuring the Update and Upgrade Settings from the Web Interface
To edit the AsyncOS update and upgrade settings:
Step 1 Navigate to the System Administration > Upgrade and Update Settings page, and click Edit Update
Settings . The Edit Update Settings page is displayed.
Figure 27-25 on page 27-39 shows the options you can configure on the Edit Update Settings page.
27-38
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Figure 27-25 Edit Update Settings Page
Configuring Upgrade and Service Update Settings
Step 2 Configure the settings in
.
Table 27-11 Update and Upgrade Settings
Setting
Automatic Updates
Upgrade Notifications
Description
Choose whether or not to enable automatic updates of the security components. If you choose automatic updates, enter the time interval. The default is enabled and the update interval is 5 minutes.
Choose whether to display a notification at the top of the Web Interface when a new upgrade to AsyncOS is available. The appliance only displays this notification for administrators.
For more information, see
Available Upgrade Notifications, page 27-33
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-39
Chapter 27 System Administration
Configuring Upgrade and Service Update Settings
Table 27-11 Update and Upgrade Settings (continued)
Setting
Update Servers (list)
Description
Choose whether to download the list of available upgrades and updates
(the manifest XML file) from the Cisco IronPort update servers or a local web server.
The default is the Cisco IronPort update servers. You might want to choose a local web server when you want to temporarily download an upgrade image stored on a local web server. After you download the image, Cisco recommends changing this setting back to the Cisco IronPort update servers so that security components continue to update automatically.
When you choose a local update server, enter the full path to the manifest
XML file for the list including the file name and port number for the server. If you leave the port field blank, AsyncOS uses port 80. If the server requires authentication, you can also enter a valid user name and password.
For more information, see
Upgrading from a Local Server, page 27-36 .
Update Servers (images) Choose whether to download upgrade and update images from the Cisco
IronPort update servers or a local web server. The default is the Cisco
IronPort update servers. You might want to choose a local web server under either of the following circumstances:
• You want to download the upgrade and update images from Cisco, but you need to enter a static address provided by Cisco IronPort
Customer Support.
Routing Table
Proxy Server (optional)
• You want to temporarily download an upgrade image stored on a local web server. After you download the image, Cisco recommends changing this setting back to the Cisco IronPort update servers (or the static address if you used that) so that security components continue to update automatically.
When you choose a local update server, enter the base URL and port number for the server. If you leave the port field blank, AsyncOS uses port
80. If the server requires authentication, you can also enter a valid user name and password.
For more information, see
Updating and Upgrading from the Cisco
IronPort Update Servers, page 27-36 and Upgrading from a Local Server, page 27-36 .
Choose which network interface’s routing table to use when contacting the update servers. The available proxy data interfaces are shown. Default is
Management.
If an upstream proxy server exists and requires authentication, enter the server information and user name and password here.
Step 3 Submit and commit your changes.
27-40
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Configuring the Update and Upgrade Settings from the CLI
The updateconfig command is used to configure update and upgrade settings, such as where the appliance looks for service updates and AsyncOS upgrades. The settings you configure using the updateconfig command are the same as you can define in the web interface. For more information on these settings, see
.
Note You can use the ping command to ensure that the appliance can contact the local server. You can also use the telnet CLI command to telnet to port 80 of the local server to ensure the local server is listening on that port.
Manually Updating Security Service Components
By default, each security service component periodically receives updates to its database tables from the
Cisco IronPort update servers. However, you can manually update the database tables.
Typically, you do not need to manually update to the database tables. In the event a manual update is required, you can modify default settings and configure an update using the options on the System
Administration > Upgrade and Update Settings page.
Note Some updates are available on an on-demand basis from the GUI pages related to the feature. For example, to manually update only the set of URL categories, see
Manually Updating the URL Category
.
To configure a manual update:
Step 1
Step 2
Step 3
Step 4
Navigate to the System Administration > Upgrade and Update Settings page.
Click Edit Update Settings .
The Edit Update Settings page appears.
Specify the location of the update files.
Initiate the update using the Update Now function key on the component page located on the Security
Services tab. For example, Security Services > Web Reputation Filters page.
Note Updates that are in-progress cannot be interrupted. All in-progress updates must complete before new changes can be applied.
Tip View a record of update activity in the updater log file. Subscribe to the updater log file on the System
Administration > Log Subscriptions page.
Reverting to a Previous Version of AsyncOS for Web
AsyncOS for Web supports the ability to revert the AsyncOS for Web operating system to a previous qualified build for emergency uses.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-41
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Note You cannot revert to a version of AsyncOS for Web earlier than version 7.5.
Effective in version 7.5, when you upgrade to a later version, the upgrade process automatically saves the current system configuration to a file on the Web Security appliance. (However, Cisco recommends manually saving the configuration file to a local machine as a backup.) This allows AsyncOS for Web to load the configuration file associated with the earlier release after reverting to the earlier version.
However, when it performs a reversion, it uses the current network settings for the management interface.
When you revert AsyncOS, you can choose to revert to the currently running build. This allows you to clear all data on the appliance and start with a new, clean configuration.
Note If updates to the set of URL categories are available, they will be applied after AsyncOS reversion.
Reverting AsyncOS for an Appliance Managed by the SMA
You can revert AsyncOS for Web from the Web Security appliance. However, if the Web Security appliance is managed by a Security Management appliance, consider the following rules and guidelines:
•
•
When Centralized Reporting is enabled on the Web Security appliance, AsyncOS for Web finishes transferring the reporting data to the Security Management appliance before it starts the reversion.
If the files take longer than 40 seconds to transfer to the Security Management appliance, AsyncOS for Web prompts you to continue waiting to transfer the files, or continue the reversion without transferring all files.
When the Web Security appliance is managed by a Security Management appliance and you revert from one version of AsyncOS for Web to an earlier version, such as reverting from version 7.6 to version 7.5, you must associate the Web Security appliance with the appropriate Configuration
Master. Otherwise, pushing a configuration from the Security Management appliance to the Web
Security appliance might fail.
Available Versions
Because upgrades cause one-way transformation of key subsystems, the reversion process is complex and requires qualification by Cisco Quality Assurance teams. Not all prior versions of the AsyncOS for
Web operating system are available for reversion. The earliest AsyncOS for Web version supported for this functionality is AsyncOS 7.5.0. Prior versions of AsyncOS for Web are not supported.
Important Note About Reversion Impact
Reverting the operating system on a Web Security appliance is a very destructive action. This action destroys all configuration logs and databases. In addition, reversion disrupts web traffic handling until the appliance is reconfigured.
Depending on the initial Web Security appliance configuration, this action may destroy network configuration. If this happens, you will need physical local access to the appliance after performing the reversion.
27-42
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Before you revert AsyncOS for Web, back up the following information from the Web Security appliance to a separate machine:
•
•
•
•
•
System configuration file.
Log files you want to preserve.
Reports you want to preserve.
Customized end-user notification pages stored on the appliance.
PAC files stored on the appliance.
Reverting AsyncOS for Web
To revert AsyncOS for Web to a previous version, complete the following steps:
Step 1 Save a backup copy of the current configuration of your appliance (with passwords unmasked) on another machine.
Note This is not the configuration file that will be loaded after reverting.
Step 2
Step 3
Back up to a separate machine any of the following files that you might want to preserve:
•
•
•
Log files
Reports
Any customized end-user notification pages stored on the appliance
• Any PAC files stored on the appliance
Log into the CLI of the appliance you want to revert.
Note When you run the revert
command in the next step, several warning prompts are issued. After these warning prompts are accepted, the revert action takes place immediately. Therefore, do not begin the reversion process until after you have completed the pre-reversion steps.
Step 4
Step 5
Step 6
From the CLI, enter the revert
command.
Confirm twice that you want to continue with the reversion.
Choose one of the available versions to revert to.
The appliance reboots twice.
Note The reversion process is time-consuming. It may take fifteen to twenty minutes before reversion is complete and console access to the appliance is available again.
The appliance should now run using the selected AsyncOS for Web version. You can access the web interface from a web browser.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-43
Reverting to a Previous Version of AsyncOS for Web
Chapter 27 System Administration
27-44
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-45
Reverting to a Previous Version of AsyncOS for Web
Chapter 27 System Administration
27-46
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-47
Reverting to a Previous Version of AsyncOS for Web
Chapter 27 System Administration
27-48
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 27 System Administration
Reverting to a Previous Version of AsyncOS for Web
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
27-49
Reverting to a Previous Version of AsyncOS for Web
Chapter 27 System Administration
27-50
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Command Line Interface
C H A P T E R
28
This chapter contains the following information:
•
The Command Line Interface Overview, page 28-1
•
•
•
Using the Command Line Interface, page 28-1
General Purpose CLI Commands, page 28-5
Web Security Appliance CLI Commands, page 28-6
The Command Line Interface Overview
The AsyncOS Command Line Interface (CLI) is an interactive interface designed to allow you to configure and monitor the Web Security appliance. The commands are invoked by entering the command name with or without any arguments. If you enter a command without arguments, the command prompts you for the required information.
The Command Line Interface is accessible using SSH on IP interfaces that have been configured with these services enabled, or using terminal emulation software on the serial port. By default, SSH is configured on the Management port.
Using the Command Line Interface
This section describes the rules and conventions of the AsyncOS Command Line Interface.
Accessing the Command Line Interface
Access to the CLI varies depending on the management connection method chosen while setting up the appliance. The factory default username and password are listed next. Initially, only the admin user account has access to the CLI. You can add other users with differing levels of permission after you have accessed the CLI for the first time using the admin account. The System Setup Wizard prompts you to change the password for the admin account.
You can also reset the admin account password at any time using the passwd
command.
You can connect using one of the following methods:
• Ethernet.
Start an SSH session with the IP address of the Web Security appliance. The factory default IP address is 192.168.42.42. SSH is configured to use port 22.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-1
Chapter 28 Command Line Interface
Using the Command Line Interface
• Serial connection.
Start a terminal session with the communication port on your personal computer that the serial cable is connected to.
Log in to the appliance by entering the username and password below.
• Username: admin
• Password: ironport
For example: login: admin password: ironport
Working with the Command Prompt
The top-level command prompt consists of the fully qualified hostname, followed by the greater than (
>
) symbol, followed by a space. For example: example.com>
When running commands, the CLI requires input from you. When the CLI is expecting input, the prompt displays the default values enclosed in square brackets ( [] ) followed by the greater than ( > ) symbol.
When there is no default value, the brackets are empty.
For example: example.com> routeconfig
Choose a routing table:
- MANAGEMENT - Routes for Management Traffic
- DATA - Routes for Data Traffic
[]>
When there is a default setting, the setting is displayed within the command-prompt brackets. For example: example.com> setgateway
Warning: setting an incorrect default gateway may cause the current connection to be interrupted when the changes are committed.
Enter new default gateway:
[172.xx.xx.xx]>
When a default setting is shown, typing Return is equivalent to accepting the default:
28-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 28 Command Line Interface
Using the Command Line Interface
Command Syntax
When operating in the interactive mode, the CLI command syntax consists of single commands with no white space and no arguments or parameters. For example: example.com> logconfig
Select Lists
When you are presented with multiple choices for input, some commands use numbered lists. Enter the number of the selection at the prompt.
For example:
Log level:
1. Critical
2. Warning
3. Information
4. Debug
5. Trace
[3]> 3
Yes/No Queries
When given a yes or no option, the question is posed with a default in brackets. You may answer
Y
,
N
,
Yes
, or
No
. Case is not significant.
For example:
Do you want to enable the proxy? [Y]> Y
Subcommands
Some commands give you the opportunity to use subcommand directives such as NEW , EDIT , and DELETE .
The EDIT and DELETE functions provide a list of previously configured values.
For example: example.com> interfaceconfig
Currently configured interfaces:
1. Management (172.xxx.xx.xx/xx: example.com)
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-3
Chapter 28 Command Line Interface
Using the Command Line Interface
- DELETE - Remove an interface.
[]>
Within subcommands, typing Enter or Return at an empty prompt returns you to the main command.
Escaping Subcommands
You can use the Ctrl+C keyboard shortcut at any time within a subcommand to immediately exit return to the top level of the CLI.
Command History
The CLI keeps a history of all commands entered during a session. Use the Up and Down arrow keys on your keyboard, or the Ctrl+P and Ctrl+N key combinations to scroll through a running list of the recently-used commands.
Completing Commands
The AsyncOS CLI supports command completion. You can enter the first few letters of some commands followed by the Tab key and the CLI completes the string. If the letters you entered are not unique among commands, the CLI “narrows” the set. For example: example.com> set (type the Tab key) setgateway, setgoodtable, sethostname, settime, settz example.com> seth (typing the Tab again completes the entry with sethostname )
Configuration Changes
You can make configuration changes while web operations proceed normally.
Configuration changes do not take effect until you complete the following steps:
Step 1
Step 2
Step 3
Issue the commit
command at the command prompt.
Give the commit
command the input required.
Receive confirmation of the commit
procedure at the CLI.
Changes to configuration that have not been committed are recorded, but do not go into effect until you run the commit
command. However, not all commands require the commit
command to be run.
Exiting the CLI session, system shutdown, reboot, failure, or issuing the clear
command clears changes that have not yet been committed.
28-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 28 Command Line Interface
General Purpose CLI Commands
General Purpose CLI Commands
This section describes the some basic commands you might use in a typical CLI session, such as committing and clearing changes. For a full list of commands, see
.
Committing Configuration Changes
The commit
command allows you to change configuration settings while other operations proceed normally. Changes are not actually committed until you receive confirmation and a timestamp. Exiting the CLI session, system shutdown, reboot, failure, or issuing the clear
command clears changes that have not yet been committed.
Entering comments after the commit command is optional.
example.com> commit
Please enter some comments describing your changes:
[]> Changed “psinet” IP Interface to a different IP address
Changes committed: Wed Jan 01 12:00:01 2007
Note To successfully commit changes, you must be at the top-level command prompt. Type Return at an empty prompt to move up one level in the command line hierarchy.
Clearing Configuration Changes
The clear
command clears any changes made to the appliance configuration since the last commit
or clear
command was issued. example.com> clear
Are you sure you want to clear all changes since the last commit? [Y]> y
Changes cleared: Wed Jan 01 12:00:01 2007 example.com>
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-5
Chapter 28 Command Line Interface
Web Security Appliance CLI Commands
Exiting the Command Line Interface Session
The exit command logs you out of the CLI application. Configuration changes that have not been committed are cleared.
example.com> exit
Configuration changes entered but not committed. Exiting will lose changes.
Type 'commit' at the command prompt to commit changes.
Are you sure you wish to exit? [N]> y
Seeking Help on the Command Line Interface
The help command lists all available CLI commands and gives a brief description of each command.
The help command can be invoked by typing either help or a single question mark ( ?
) at the command prompt.
example.com> help
Web Security Appliance CLI Commands
The Web Security Appliance CLI supports a set of proxy and UNIX commands to access, upgrade, and administer the system.
Table 28-1 lists the Web Security appliance Command Line Interface commands.
Table 28-1 Web Security appliance Administrative Commands
Command advancedproxyconfig adminaccessconfig alertconfig authcache bwcontrol
Description
Configure more advanced Web Proxy configurations, such as authentication and DNS parameters.
For more information about the advancedproxyconfig
command, see
Advanced Proxy Configuration, page 6-21
.
You can configure the Web Security appliance to have stricter access requirements for administrators logging into the appliance.
For more information about the adminaccessconfig command, see
Configuring Administrator Settings, page 27-15
.
Specify alert recipients, and set parameters for sending system alerts.
Allows you to delete a one or all entries (users) from the authentication cache. You can also list all users currently included in the authentication cache.
You might want to clear a user from the authentication cache so the user can login again from a different machine before the User session
Restrictions values times out.
Enable bandwidth control debug messages in the Default Proxy log file.
28-6
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 28 Command Line Interface
Web Security Appliance CLI Commands
Table 28-1 certconfig clear commit createcomputerobject datasecurityconfig dnsconfig dnsflush etherconfig externaldlpconfig featurekey grep help iccm_message ifconfig or interfaceconfig last loadconfig logconfig mailconfig musconfig
Web Security appliance Administrative Commands (continued) featurekeyconfig
Configure security certificates and keys.
Clears pending configuration changes since last commit.
Commits pending changes to the system configuration.
Creates a computer object at the location you specify.
Defines a minimum request body size, below which upload requests are not scanned by the Cisco IronPort Data Security Filters.
For more information, see
Bypassing Upload Requests Below a Minimum
Configure DNS server parameters.
Flush DNS entries on the appliance.
Configure Ethernet port connections.
Defines a minimum request body size, below which upload requests are not scanned by the external DLP server.
For more information, see
Bypassing Upload Requests Below a Minimum
Submits valid keys to activate licensed features.
For more information, see
.
Automatically check for and update feature keys.
For more information, see
Feature Key Settings Page, page 27-8
.
Searches named input files for lines containing a match to the given pattern.
Returns a list of commands.
Clears the message in the web interface and CLI that indicates when this
Web Security appliance is managed by a Security Management appliance
(M-Series).
Configure and manage network interfaces including M1, P1, and P2.
Displays currently configured interfaces, and provides an operations menu to create, edit, or delete interfaces.
Lists user-specific user information that includes ttys and hosts, in reverse time order or lists the users that are logged in at a specified date and time.
Load a system configuration file.
Configure access to log files.
Mail the current configuration file to the address specified.
Use this command to enable Secure Mobility Solution and configure how to identify remote users, either by IP address or by integrating with one or more Cisco adaptive security appliances.
Note: Changes made using this command cause the Web Proxy to restart.
For more information on enabling and configuring Secure Mobility
Solution, see
Enabling Secure Mobility, page 15-2
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-7
Chapter 28 Command Line Interface
Web Security Appliance CLI Commands
Table 28-1 musstatus nslookup ntpconfig packetcapture ping proxyconfig
<enable | disable> proxystat quit, q, exit reboot reportingconfig resetconfig rollovernow routeconfig saveconfig setgateway
Web Security appliance Administrative Commands (continued) passwd pathmtudiscovery
Use this command to display information related to Secure Mobility
Solution when the Web Security appliance is integrated with an adaptive security appliance.
This command displays the following information:
•
•
The status of the Web Security appliance connection with each adaptive security appliance.
The duration of the Web Security appliance connection with each adaptive security appliance in minutes.
•
•
The number of remote clients from each adaptive security appliance.
The number of remote clients being serviced, which is defined as the number of remote clients that have passed traffic through the Web
Security appliance.
• The total number of remote clients.
Queries Internet domain name servers for information about specified hosts and domains or to print a list of hosts in a domain.
Configure NTP servers. Displays currently configured interfaces, and provides an operations menu to add, remove, or set the interface from whose IP address NTP queries should originate.
Intercepts and displays TCP/IP and other packets being transmitted or received over the network to which the appliance is attached.
For more information, see
.
Set the password.
Enables or disables Path MTU Discovery.
You might want to disable Path MTU Discovery if you need to packet fragmentation.
Sends an ICMP ECHO REQUEST to the specified host or gateway.
Enables or disables the Web Proxy.
Display web proxy statistics.
Terminates an active process or session.
Flushes the file system cache to disk, halts all running processes, and restarts the system.
Configure a reporting system.
Restores the configuration to factory defaults.
Roll over a log file.
Configure destination IP addresses and gateways for traffic. Displays currently configured routes, and provides an operations menu to create, edit, or delete, or clear entries.
Saves a copy of the current configuration settings to a file. This file can be used to restore defaults, if necessary.
Configure the default gateway for the machine.
28-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 28 Command Line Interface
Web Security Appliance CLI Commands
Table 28-1 settime settz showconfig shutdown smtprelay snmpconfig sshconfig status supportrequest tail techsupport telnet testauthconfig traceroute updateconfig updatenow upgrade userconfig
Web Security appliance Administrative Commands (continued) sethostname setntlmsecuritymode
Set the hostname parameter.
Changes the security setting for the NTLM authentication realm to either
“ads” or “domain.”
When the setting is “domain,” the appliance joins the Active Directory domain with a domain security trust account, and when the setting is
“ads,” it joins the domain as a native Active Directory member. Default is ads.
Set system time.
Displays the current time zone, and provides an operations menu to set a local time zone.
Display all configuration values.
Note: User passwords are encrypted.
Terminates connections and shuts down the system.
Configure SMTP relay hosts for internally generated email. An SMTP relay host is required to receive system generated email and alerts. For more information about configuring SMTP relay hosts, see
.
Configure the local host to listen for SNMP queries and allow SNMP requests.
Configure hostname and host key options for trusted servers.
Displays system status.
Send the support request email to Cisco IronPort Customer Support. This includes system information and a copy of the master configuration.
Displays the end of a log file. Command accepts log file name or number as parameters.
example.com> tail system_logs example.com> tail 9
Provides a temporary connection to allow Cisco IronPort Customer
Support to access the system and assist in troubleshooting.
Communicates with another host using the TELNET protocol.
Tests the authentication settings for a given authentication realm against the authentication servers defined in the realm.
For more information about testing authentication settings, see
Authentication Settings, page 21-15 .
Traces IP packets through gateways and along the path to a destination host.
Configure update and upgrade settings. For more information, see
Configuring Upgrade and Service Update Settings, page 27-34
.
Update all components.
Install an AsyncOS software upgrade.
Configure system administrators.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-9
Web Security Appliance CLI Commands
Table 28-1 version webcache who whoami
Chapter 28 Command Line Interface
Web Security appliance Administrative Commands (continued)
Displays general system information, installed versions of system software, and rule definitions.
Examine or modify the contents of the proxy cache, or configure domains and URLs that the appliance never caches. Allows an administrator to remove a particular URL from the proxy cache or specify which domains or URLs to never store in the proxy cache.
For more information, see
Displays who is logged into the system.
Displays user information.
28-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 28 Command Line Interface
Web Security Appliance CLI Commands
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
28-11
Web Security Appliance CLI Commands
Chapter 28 Command Line Interface
28-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
C H A P T E R
29
Common Tasks
This chapter contains the following sections:
•
How to Prevent Users from Accessing Streaming Media Websites During Business Hours, page 29-2
•
•
•
•
•
•
•
How to Bypass Authentication for Specific User Agents, page 29-4
How to Bypass Authentication for Specific Websites, page 29-6
How to Bypass Decryption for specific HTTPS Websites, page 29-8
How to Bypass Web Reputation Filtering without Bypassing Anti-Malware Scanning, page 29-10
How to Create Access Policies that Apply to Active Directory User Groups, page 29-12
How to Automate Log File Transfers, page 29-14
How to Redirect Traffic to a Different URL, page 29-15
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-1
Chapter 29 Common Tasks
How to Prevent Users from Accessing Streaming Media Websites During Business Hours
How to Prevent Users from Accessing Streaming Media
Websites During Business Hours
In this task, you will prevent all users from accessing streaming media websites during your business hours, which you define as 8 am to 5 pm, Monday through Friday. However, you will allow them access during the lunch hour, from noon to 1 pm. You might want to do this to reduce overall bandwidth usage during work hours so there is sufficient capacity to accomplish work related tasks.
For example, a significant number of employees have complained about slow network speeds when trying to access SalesForce.com. Meanwhile your IT administrator has pointed out that 30% of employees access streaming music during business hours. By blocking streaming music during business hours only, you can increase bandwidth to allow employees to access work related sites like
SalesForce.com more quickly, while still allowing employees to access all sites during non-critical business times.
This task assumes you already have defined an Identity Policy for the users you want to prevent from accessing streaming media websites.
To prevent users from accessing streaming media websites during business hours:
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 17
Step 18
Navigate to the Web Security Manager > Defined Time Ranges page.
Click Add Time Range . The Add Time Range page appears.
In the Time Range Name field, enter a name for this range of times you will configure, such as
Business
Hours
.
In the Time Zone section, choose “Use Time Zone Setting from Appliance”.
In the Time Values area, Day of Week section, select the following check boxes:
Monday, Tuesday, Wednesday, Thursday, Friday
In the Time Values area, Time of Day section, enter 8:00 in the From field, and enter 12:00 in the To field.
Click Add Row to create an additional time value row.
In the Day of Week section of the new row, check the following check boxes:
Monday, Tuesday, Wednesday, Thursday, Friday
In the Time of Day section of the new row, enter
13:00
in the From field, and enter
17:00
in the To field.
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a policy name, such as
BlockStreamingMedia
.
In the Insert Above Policy field, place the Access Policy group above the current top most policy group.
In the Identities and Users section, choose “Select one or More Identities” in the dropdown field.
In the Identity field, choose the Identity group that corresponds to the users you want to block from accessing streaming media websites.
If the Identity requires authentication, specify which users are authorized for this policy group, such as all authenticated users.
Click Submit .
29-2
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Prevent Users from Accessing Streaming Media Websites During Business Hours
Step 19
Step 20
Step 21
Step 22
Step 23
Step 24
Click the link under the URL Filtering column for the Access Policy you just created.
The Access Policies: URL Filtering: BlockStreamingMedia page appears.
In the Predefined URL Category Filtering section, click Time-Based for the Streaming Media URL category.
When you select Time-Based for the URL category, additional fields appear under the category name where you can choose the actions.
In the In Time Range field, choose
BusinessHours
.
In the Action field, choose
Block
.
In the Otherwise field, choose
Monitor
.
Submit and Commit your changes.
Now, when users try to access websites that contain streaming media applications during business hours, such as youtube.com, they will be blocked and will see an end-user notification page displaying the reason for the block.
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
Filtering Transactions Using URL Categories, page 18-9
•
•
Creating Time Based URL Filters, page 18-23
Working with Time Based Policies, page 8-9
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-3
Chapter 29 Common Tasks
How to Bypass Authentication for Specific User Agents
How to Bypass Authentication for Specific User Agents
In this task, you will make sure the Web Proxy does not authenticate requests from particular user agents on the network. You might want to do this to for user agents that cannot prompt end users for their authentication credentials. In particular, this task will bypass authentication for all applications that access the Web on the iPhone, iPad, and iPod.
This task assumes one or more authentication realms are already defined on the Web Security appliance.
To bypass authentication for specific user agents:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 17
Navigate to the Web Security Manager > Identities page.
Click Add Identity.
In the Name field, enter a name for this policy, such as UserAgentsToBypass .
In the Insert Above field, verify this Identity is above all other Identities that require authentication.
Under Membership Definition, click Advanced to expand the advanced policy options.
Click the link next to User Agents.
On the Identities: Policy “UserAgentsToBypass”: Membership by User Agent page, in the Common
User Agents section, click Others to expand the other user agents.
Select the Microsoft Windows Update check box.
In the Customer User Agents field, enter the following entries:
• iPhone
• iPad
• iPod
Click Done .
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a name for this policy, such as
APBypassAuthUserAgents
.
In the Identities and Users field, choose “Select One or More Identities.”
In the Identity field, select the Identity created in
.
Submit and Commit your changes.
When an application on the iPhone, iPad, or iPod tries to access the Web, it succeeds and does not prompt users for their username and password.
Note You can add the %u custom field to the access logs to see which user agents try to access the Web.
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
Working with User Agent Based Policies, page 8-11
29-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
•
Creating Identities, page 9-17
How to Bypass Authentication for Specific User Agents
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-5
Chapter 29 Common Tasks
How to Bypass Authentication for Specific Websites
How to Bypass Authentication for Specific Websites
In this task, you will make sure the Web Proxy does not authenticate requests from users trying to access specific websites. You might want to do this to for websites that do not interact properly with proxy servers that authenticate their users, but you still want the Web Proxy to apply security services to the website, such as web reputation filtering and anti-malware scanning. Also, you might want to do this for websites that multiple user agents need to access, but the user agents cannot prompt users to enter authentication credentials, such as Microsoft Windows updater user agents.
For example, users have been complaining about not being able to access files they need for work hosted on a partner website. They can access the files on the partner’s website when they are not connected to the local network, but cannot access the partner’s website when they are connected to the local network.
IT has learned from reading the Web Security appliance access logs that the partner’s web server is not fully RFC compliant with HTTP and cannot communicate properly with the Web Proxy when it authenticates its end users. By not authenticating users that access the partner’s website, you can still allow access while protecting users by scanning the content downloaded from the server.
Additionally, on Windows machines, the Microsoft Windows updater fails by either hanging or displaying an error message to end users.
This task assumes one or more authentication realms are already defined on the Web Security appliance.
To bypass authentication for specific websites:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Navigate to the Web Security Manager > Custom URL Categories page.
On the Customer URL Categories page, click Add Custom Category .
In the Category Name field, enter a name for this category, such as
BypassAuth
.
In the Sites field, enter the addresses for the websites you want to have bypassed for authentication. In this task, enter the following addresses:
• mypartnersite.com
• .mypartnersite.com
• download.windowsupdate.com
• .windowsupdate.microsoft.com
• .update.microsoft.com
• .download.windowsupdate.com
• update.microsoft.com
• .windowsupdate.com
• download.microsoft.com
• windowsupdate.microsoft.com
• ntservicepack.microsoft.com
• wustat.windows.com
• c.microsoft.com
Click Submit .
Navigate to the Web Security Manager > Identities page.
Click Add Identity .
In the Name field, enter a name for this policy, such as
WebsitesToBypassAuth
.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-6
Chapter 29 Common Tasks
How to Bypass Authentication for Specific Websites
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Step 20
Step 9
Step 10
Step 11
Step 12
In the Insert Above field, verify this Identity is above all other Identities that require authentication and below all Identities that do not require authentication.
Under Membership Definition, click Advanced to expand the advanced policy options.
Click the link next to URL Categories.
On the Identities: Policy “WebsitesToBypassAuth”: Membership by URL Categories page, in the
Custom URL Categories section, click in the Add column for the custom URL category created in
Click Done .
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a name for this policy, such as
APBypassAuthWebsites
.
In the Identities and Users field, choose “Select One or More Identities.”
In the Identity field, select the Identity created in
.
Submit and Commit your changes.
Now, Microsoft Windows updater running on each client machine will be able to access the multiple
Microsoft servers listed in Step 4
to receive Windows updates. Additionally, when users try to access the partner website listed in
mypartnersite.com
), they are able to view the site with no problem and without being prompted for their username and password.
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
Custom URL Categories, page 18-16
•
•
Creating Identities, page 9-17
Bypassing Authentication, page 21-29
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-7
Chapter 29 Common Tasks
How to Bypass Decryption for specific HTTPS Websites
How to Bypass Decryption for specific HTTPS Websites
In this task, you will pass through traffic to specific HTTPS websites. You might want to do this to allow users to access the HTTPS website, while still inspecting traffic to other websites.
Some websites and web-based applications that use HTTPS do not work when the Web Security appliance decrypts the traffic between the client and the server. If you trust these HTTPS websites, you can configure the appliance to pass through traffic from clients to the HTTPS servers instead of decrypting the traffic to inspect for malware and to enforce acceptable use policies.
For example, users have been complaining about not being able to access a partner website that uses
HTTPS while connected to the local network. IT has learned from reading the Web Security appliance access logs that the partner’s HTTPS server is not fully RFC compliant with HTTPS and cannot communicate properly with the HTTPS Proxy when it decrypts traffic between clients and the HTTPS server. By bypassing all HTTPS traffic to the partner’s website, you can still allow access while decrypting traffic to other HTTPS servers.
This task assumes that the HTTPS Proxy is enabled and decrypts traffic by default.
To bypass decryption for specific HTTPS websites:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Navigate to the Web Security Manager > Custom URL Categories page.
On the Customer URL Categories page, click Add Custom Category .
In the Category Name field, enter a name for this category, such as
HTTPSPassThru
.
In the Sites field, enter the addresses for the websites you want to bypass decryption, such as mypartnersite.com
Click Submit .
Navigate to the Web Security Manager > Identities page.
Click Add Identity .
In the Name field, enter a name for this policy, such as
WebsitesToBypassDecryption
.
Under Membership Definition, click Advanced to expand the advanced policy options.
Click the link next to URL Categories.
On the Identities: Policy “WebsitesToBypassDecryption”: Membership by URL Categories page, in the
Custom URL Categories section, click in the Add column for the custom URL category created in
.
Click Done .
Click Submit .
Navigate to the Web Security Manager > Decryption Policies page.
Click Add Policy .
In the Name field, enter a name for this policy, such as
DPPassThrough
.
In the Identities and Users field, choose “Select One or More Identities.”
In the Identity field, select the Identity created in
.
Submit and Commit your changes.
Now, when users try to access the websites listed in
, they are able to view sites with no problem while still decrypting traffic for other sites.
29-8
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Bypass Decryption for specific HTTPS Websites
Where to Find More Information
•
•
•
You can read the following sections for more detailed information on the steps included in this task:
Custom URL Categories, page 18-16
Creating Identities, page 9-17
•
Enabling the HTTPS Proxy, page 12-15
Creating Decryption Policies, page 12-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-9
Chapter 29 Common Tasks
How to Bypass Web Reputation Filtering without Bypassing Anti-Malware Scanning
How to Bypass Web Reputation Filtering without Bypassing
Anti-Malware Scanning
In this task, you will bypass Web Reputation filtering for some websites while still ensuring the content downloaded from these sites is scanned for malware. You might want to do this to allow access to particular websites your organization must work with that have very low web reputation scores (scores below the configured default score threshold for blocking, such as -6.0). However, you still want to protect users from malware, so you want to ensure that the sites are scanned by the anti-malware scanning engines.
For example, your customer’s website runs on a server with an IP address that also runs irreputable domains, thereby lowering your customer’s overall reputation score. Your IT department has confirmed that your organization trusts the customer’s website enough to allow users to access it. By bypassing web reputation filtering for the customer’s domain, you can still allow users to access it while scanning downloaded content for malware.
This task assumes:
•
•
The Adaptive Scanning feature is not enabled. When Adaptive Scanning is enabled, you cannot configure web reputation score thresholds.
You have a list of addresses that you want to bypass for Web Reputation filtering. In this task, you will bypass Web Reputation filtering for the fictitious site mylowreputationsite.com.
• You want to block all websites with a web reputation score of -7.0 or less. That is, the websites you want to bypass Web Reputation Filtering have a score higher than -7.0.
To bypass Web Reputation filtering for specific websites:
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 1
Step 2
Step 3
Step 4
Step 12
Step 13
Step 14
Step 15
Navigate to the Web Security Manager > Custom URL Categories page.
On the Customer URL Categories page, click Add Custom Category .
In the Category Name field, enter a name for this category, such as
BypassWebRep
.
In the Sites field, enter the addresses for the websites you want to have bypassed for Web Reputation filtering. In this task, enter the following addresses:
• mylowreputationsite.com
• Any other website that has a web reputation score greater than -7.0 that you want to access.
Click Submit .
Navigate to the Web Security Manager > Identities page.
Click Add Identity .
In the Name field, enter a name for this policy, such as WebsitesToBypassWebRep .
Under Membership Definition, click Advanced to expand the advanced policy options.
Click the link next to URL Categories.
On the Identities: Policy “WebsitesToBypassWebRep”: Membership by URL Categories page, in the
Custom URL Categories section, click in the Add column for the custom URL category created in
.
Click Done .
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
29-10
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Bypass Web Reputation Filtering without Bypassing Anti-Malware Scanning
Step 16
Step 17
Step 18
Step 19
Step 20
Step 21
Step 22
Step 23
In the Policy Name field, enter a name for this policy, such as
APBypassWebRep
.
In the Identities and Users field, choose “Select One or More Identities.”
In the Identity field, select the Identity created in
.
Click Submit .
On the Access Policies page, click the Web Reputation and Anti-Malware Filtering link for the Access
Policy you created in
Under the “Web Reputation and Anti-Malware Settings” section, choose Define Web Reputation and
Anti-Malware Custom Settings if it is not chosen already.
Move the left marker to -7.0 to change the score threshold for blocking URLs.
Submit and Commit your changes.
Now, when users try to access the website in Step 4
, they should be able to access it (instead of seeing an end-user notification page informing them that it was blocked due to web reputation) as long as the current score is greater than -7.0 and that no malware was found during scanning.
Where to Find More Information
•
•
•
You can read the following sections for more detailed information on the steps included in this task:
•
Custom URL Categories, page 18-16
Creating Identities, page 9-17
Configuring Web Reputation and Anti-Malware in Access Policies, page 20-11
Configuring Web Reputation Scores, page 20-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-11
Chapter 29 Common Tasks
How to Create Access Policies that Apply to Active Directory User Groups
How to Create Access Policies that Apply to Active Directory
User Groups
You might want to grant different levels of access control to different users. For example, you might need to allow marketing users to access partner websites, but block engineering users from accessing partner sites. When users are authenticated against an authentication server, such as Microsoft Active Directory, and the authentication server has different user groups defined, you can create different policies for different user groups.
In this task, you will create two Access Policies that apply to users in different Active Directory user groups. One policy will be for Marketing users and the other for Engineering users.
This task assumes that an NTLM authentication realm is defined on the Web Security appliance that references an Active Directory server with configured user groups.
To create Access Policies that apply to different Active Directory user groups:
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 16
Step 17
Step 18
Navigate to the Web Security Manager > Identities page.
Click Add Identity .
In the Name field, enter a name for this policy, such as
NTLMUsers
.
In the Insert Above field, verify this Identity is below all other Identities that do not require authentication.
In the Define Members by Authentication section, choose “Require Authentication” from the drop down menu.
In the Select a Realm or Sequence field, choose the NTLM authentication realm already defined on the appliance.
In the Define Members by Protocol section, choose “HTTP/HTTPS Only.” This is because authentication is not supported with native FTP transactions.
Use the default values for all other settings, or optionally, change them as needed by your organization.
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a name for this policy, such as
MarketingPolicy
.
In the Identities and Users field, choose “Select One or More Identities.”
In the Identity field, select the Identity created in
.
Under Authorized Users and Groups for the NTLM authentication realm, choose “Selected Groups and
Users” and then click the link next to “Groups.”
On the Access Policies: Policy “PolicyName”: Edit Groups page, add user groups to the Authorized
Groups section. You can do this using any of the following methods:
•
•
Select a user group in the directory search list window and either double-click or click Add .
Type the entire group name in the Directory Search window, and after the search is complete, click
Add . This allows you to enter groups that do not appear in the directory search list, such as groups that belong to a trusted domain or groups that are not yet available in the directory.
Click Done .
Click Submit .
29-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Create Access Policies that Apply to Active Directory User Groups
Step 19
Step 20
Step 21
Repeat Step 11 through Step 18 using a different Access Policy name, such as
EngineeringPolicy
and specifying different Active Directory user groups.
On the Access Policies page, configure access control settings for each Access Policy as desired.
Submit your changes.
Now, users from the set of users defined in
will have different Access Policies applied to them than the users defined in
. Assuming you configure different access control settings for each
Access Policy, each set of users will observe different behavior when accessing the web.
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
•
Creating Identities, page 9-17
Configuring Identities in Other Policy Groups, page 9-22
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-13
Chapter 29 Common Tasks
How to Automate Log File Transfers
How to Automate Log File Transfers
In this task, you will configure the appliance so it automatically transfers the access logs using SCP to a remote server every day at noon and midnight. You might want to do this if you want each log file to contain web access information for the same amount of time (12 hours).
For example, you use a third party tool to analyze the web data in the access logs each day, and you want each access log file to contain data for the exact same amount of time, 12 hours.
This task assumes you have access to an SCP server, including the host name, directory, and username.
To automatically transfer log files to a remote server using SCP:
Step 1
Step 2
Step 3
Step 4
Navigate to the System Administration > Log Subscriptions page.
Click the “accesslogs” link under the Log Name column.
On the Edit Log Subscription page, in the Rollover by Time field, choose “Daily Rollover.”
In the Time of Day field, enter the following text:
00:00, 12:00
Note You can automatically transfer log files multiple times a day by entering multiple times separated by a comma.
Step 5
Step 6
Step 7
Step 8
In the Retrieval Method section, choose “SCP on Remote Server.”
Enter the required SCP server information, such as SCP host name and username.
Leave other settings as is, or change as desired.
Submit and commit your changes.
Now, AsyncOS for Web transfer the newly saved log file to the SCP server each day at noon and midnight. For more details on the tasks AsyncOS for Web performs when it rolls over a log file, see
Rolling Over Log Subscriptions, page 25-8
.
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
Working with Log Subscriptions, page 25-7
•
Rolling Over Log Subscriptions, page 25-8
29-14
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Redirect Traffic to a Different URL
How to Redirect Traffic to a Different URL
You can use the Cisco IronPort Web Security Appliance to redirect users to a different website. You can configure the appliance to redirect traffic originally destined for a URL in a custom URL category to a location you specify. This allows you to redirect traffic on the appliance instead of at the destination server.
For example, the Benefits department owns an internal webpage that includes links for users to view and edit their benefits information, such as health insurance provider. The Benefits department sent an email to users announcing the benefits enrollment deadline several weeks in advance. However, they needed to change the location of their webpage a few days before the benefits enrollment deadline. Instead of sending a new email to all users, you can use the Web Security appliance to redirect users from the original URL to the new and correct URL.
In this task, you will redirect traffic for an internal server to a different internal server.
To redirect traffic to a different URL:
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 1
Step 2
Step 3
Step 4
Step 14
Step 15
Step 16
Step 17
Navigate to the Web Security Manager > Custom URL Categories page.
On the Customer URL Categories page, click Add Custom Category .
In the Category Name field, enter a name for this category, such as
IntranetToRedirect
.
In the Sites field, enter the addresses for the websites you want to redirect to another URL. In this task, enter the following address:
• intranet.example.com
Click Submit .
Navigate to the Web Security Manager > Access Policies page.
Click Add Policy .
In the Policy Name field, enter a name for this policy, such as
APRedirectIntranet
.
In the Identities and Users field, keep the default value of “All Identities.”
Click Submit .
On the Access Policies page, click the URL Filtering link for the Access Policy you created in
In the Custom URL Category Filtering section, click Select Custom Categories .
In the Select Custom Categories for this Policy dialog box, choose “Include in policy” for the custom
URL category you created in
Click Apply .
In the Custom URL Category Filtering section, click in the Redirect column for the custom URL category you just added.
In the Redirect To field, enter the URL to which you want to redirect traffic originally intended for the
URL in
internal.example.com
.
Submit and commit your changes.
Now, when users open a browser and try to access intranet.example.com, the browser is redirected to internal.example.com.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-15
Chapter 29 Common Tasks
How to Redirect Traffic to a Different URL
Where to Find More Information
You can read the following sections for more detailed information on the steps included in this task:
•
•
Custom URL Categories, page 18-16
Redirecting Traffic, page 18-21
29-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Chapter 29 Common Tasks
How to Redirect Traffic to a Different URL
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
29-17
How to Redirect Traffic to a Different URL
Chapter 29 Common Tasks
29-18
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
A P P E N D I X
A
Supplemental End User License Agreement for Cisco
Systems Email and Web Security Software
IMPORTANT: READ CAREFULLY
This Supplemental End User License Agreement ("SEULA") contains additional terms and conditions for the Software product licensed under the End User License Agreement ("EULA") between You
("You" as used herein means You and the business entity you represent or “Company”) and Cisco
(collectively, the "Agreement"). Capitalized terms used in this SEULA but not defined will have the meanings assigned to them in the EULA. To the extent that there is a conflict between the terms and conditions of the EULA and this SEULA, the terms and conditions of this SEULA will take precedence.
In addition to the limitations set forth in the EULA on your access and use of the Software, you agree to comply at all times with the terms and conditions provided in this SEULA. DOWNLOADING,
INSTALLING, OR USING THE SOFTWARE CONSTITUTES ACCEPTANCE OF THE
AGREEMENT, AND YOU ARE BINDING YOURSELF AND THE BUSINESS ENTITY THAT YOU
REPRESENT TO THE AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THE
AGREEMENT, THEN CISCO IS UNWILLING TO LICENSE THE SOFTWARE TO YOU AND (A)
YOU MAY NOT DOWNLOAD, INSTALL OR USE THE SOFTWARE, AND (B) YOU MAY RETURN
THE SOFTWARE (INCLUDING ANY UNOPENED CD PACKAGE AND ANY WRITTEN
MATERIALS) FOR A FULL REFUND, OR, IF THE SOFTWARE AND WRITTEN MATERIALS ARE
SUPPLIED AS PART OF ANOTHER PRODUCT, YOU MAY RETURN THE ENTIRE PRODUCT
FOR A FULL REFUND. YOUR RIGHT TO RETURN AND REFUND EXPIRES 30 DAYS AFTER
PURCHASE FROM CISCO OR AN AUTHORIZED CISCO RESELLER, AND APPLIES ONLY IF
YOU ARE THE ORIGINAL END USER PURCHASER.
For purposes of this SEULA, the Product name and the Product description you have ordered is any of the following ("Software"):
Cisco AsyncOS for Email,
Cisco AsyncOS for Web
Cisco AsyncOS for Management
Cisco Email Anti-Spam, Sophos Anti-Virus
Cisco Email Outbreak Filters
Cloudmark Anti-Spam
Cisco Image Analyzer
McAfee Anti-Virus
Cisco Intelligent Multi-Scan
Cisco RSA Data Loss Prevention
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
A-1
A-2
Appendix A Supplemental End User License Agreement for Cisco Systems Email and Web Security Software
Cisco Email Encryption
Cisco Email Delivery Mode
Cisco Web Usage Controls
Cisco Web Reputation
Sophos Anti-Malware
Webroot Anti-Malware
McAfee Anti-Malware
Cisco Email Reporting
Cisco Email Message Tracking
Cisco Email Centralized Quarantine
Cisco Web Reporting
Cisco Web Policy and Configuration Management
Cisco Advanced Web Security Management with Splunk
Email Encryption for Encryption Appliances
Email Encryption for System Generated Bulk Email
Email Encryption and Public Key Encryption for Encryption Appliances
Large Attachment Handling for Encryption Appliances
Secure Mailbox License for Encryption Appliances
Definitions
For purposes of this SEULA, the following definitions apply:
"Company Service" means the Company's email or Internet services provided to End Users for the purposes of conducting Company's internal business.
"End User" means the employee, contractor or other agent authorized by Company to access the Internet or use email services via the Company Service.
“Ordering Document” means the purchase agreement, evaluation agreement, beta, pre-release agreement or similar agreement between the Company and Cisco or the Company and a Cisco reseller, or the valid terms of any purchase order accepted by Cisco in connection therewith, containing the purchase terms for the Software license granted by this Agreement.
"Personally Identifiable Information" means any information that can be used to identify an individual, including, but not limited to, an individual's name, user name, email address and any other personally identifiable information.
"Services" means Cisco Software Subscription Services.
“Service Description” means the description of the Services at HYPERLINK
"http://www.cisco.com/web/about/doing_business/legal/service_descriptions/index.html." http://www.cisco.com/web/about/doing_business/legal/service_descriptions/index.html.
“Telemetry Data” means samples of Company’s email and web traffic, including data on email message and web request attributes and information on how different types of email messages and web requests were handled by Company’s Cisco hardware products. Email message metadata and web requests included in Telemetry Data are anonymized and obfuscated to remove any Personally Identifiable
Information.
“Term” means the length of the Software subscription You purchased, as indicated in your Ordering
Document.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Appendix A Supplemental End User License Agreement for Cisco Systems Email and Web Security Software
Additional License Terms and Conditions
LICENSE GRANTS AND CONSENT TO TERMS OF DATA COLLECTION
License of Software.
By using the Software and the Documentation, Company agrees to be bound by the terms of this
Agreement, and so long as Company is in compliance with this Agreement, Cisco hereby grants to
Company a nonexclusive, non-sublicensable, non-transferable, worldwide license during the Term to use the Software only on Cisco's hardware products, solely in connection with the provision of the Company
Service to End Users. The duration and scope of this license(s) is further defined in the Ordering
Document. The Ordering Document supersedes the EULA with respect to the term of the Software license. Except for the license rights granted herein, no right, title or interest in any Software is granted to the Company by Cisco, Cisco's resellers or their respective licensors. Your entitlement to Upgrades to the Software is subject to the Service Description. This Agreement and the Services are co-terminus.
Consent and License to Use Data.
Subject to the Cisco Privacy Statement at HYPERLINK
"http://www.cisco.com/web/siteassets/legal/privacy.html" http://www.cisco.com/web/siteassets/legal/privacy.html, Company hereby consents and grants to Cisco a license to collect and use Telemetry Data from the Company. Cisco does not collect or use Personally
Identifiable Information in the Telemetry Data. Cisco may share aggregated and anonymous Telemetry
Data with third parties to assist us in improving your user experience and the Software and other Cisco security products and services. Company may terminate Cisco's right to collect Telemetry Data at any time by disabling SenderBase Network Participation in the Software. Instructions to enable or disable
SenderBase Network Participation are available in the Software configuration guide.
Description of Other Rights and Obligations
Please refer to the Cisco Systems, Inc. End User License Agreement, Privacy Statement and Service
Description for Cisco Software Subscription Services.
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
A-3
Appendix A Supplemental End User License Agreement for Cisco Systems Email and Web Security Software
A-4
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
A access log file
W3C access logs
ACL decision tags
anti-malware information
anti-malware request example entry
anti-malware response example entry
custom formatting
no category (nc)
no score (ns)
overview
URL category
Web Reputation Filters example entry
web reputation information
access logs custom fields
Access Policies
and URL category changes
anti-malware
application filtering
configuring Web
creating
flow diagram
guest users
membership
I N D E X
Monitor action
objects
overview
protocols and user
proxy port of request
subnet of request
time of request
URL category of request
user agent of request
user location of request
Access Policy groups
ACL decision tags access log file
Active Directory changing passwords
joining the domain
multiple domains
transparent user identification
Active Directory Agent, Cisco
AD Agent
adding
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-1
Index
IN-2
WCCP service
addresses ambiguous address
known allowed address
known malware address
unlisted address
adminaccessconfig command overview
administering the appliance connecting to the management interface
System Setup
Wizard
administrator access configuring for IP addresses
configuring SSL
adult content filtering
logging usage
advancedproxyconfig command overview
web proxy usage agreement
alert listing
alerts alert
classifications 27-17 recipients 27-17
settings
severities
All Identities overview
Cisco IronPort AsyncOS 7.5.7 for Web User Guide allowing traffic
L4 Traffic
Monitor
ambiguous address
AMW
anonymizing usernames in reports
anti-malware access log file
access log
configuring
outbound scanning
overview
rules for L4 Traffic
Monitor
scanning verdicts
Anti-Malware report
anti-malware rules
L4 Traffic
Monitor
anti-malware scanning bypassing
AnyConnect Secure
Mobility
AnyConnect Secure
Mobility Daemon log
Secure Mobility
appliance hostname
application behaviors
application bypass settings
Index configuring
application control application behaviors
applications
application types
bandwidth
bypassing application
configuring
instant messaging
overview
report
reporting
rules and guidelines
applications blocking
configuring bandwidth limits
defined
application scanning
application types configuring bandwidth limits
defined
overriding bandwidth limits
Application Visibility and
Control
Application Visibility and
Control engine
Application Visibility report overview
archiving reports
assignment method
WCCP service
AsyncOS reversion
AsyncOS upgrades overview
authentication behavior with multiple realms
bypassing
compared to authorization
configuring global settings
configuring
LDAP
configuring
NTLM
defined
entering the domain
exempting user agents
failure
global Identity policy
guest access
HTTPS requests
Identity groups
LDAP
MSN Messenger
native FTP
NTLM
overview
realms
re-authenticating users
SaaS applications
sending credentials securely
special characters
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-3
Index
IN-4 supported characters for
Basic
surrogates
surrogates supported
upstream proxies
authentication credentials defined
invalid
SaaS Access
Control
sending securely
authentication realms behavior with multiple realms
creating
deleting
editing
overview
authentication scheme
Identity group
authentication sequences behavior with multiple realms
creating
deleting
editing
overview
authentication server
authentication surrogates supported
authorization defined
failing
AutoSupport feature
available upgrades
AVC engine
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
updates
B backing up keys for FIPS management
bandwidth configuring overall
configuring user
limiting
bandwidth limits configuring for
configuring for
overall
overriding for
overview
per user
Basic authentication securely sending credentials
blacklist address
address blocking adult content
all traffic by default
file types
instant messenger
objects
peer-to-peer
Index ports
protocols
upload requests
upload requests due to
AVC engine
upload requests due to malware
user agents
user experience
blocking traffic by default in System
Setup Wizard
L4 Traffic
Monitor
browsers
browse view application control
bypassing application
authentication
decryption
scanning and filtering
upload requests from
C
CA
authorities capturing network packets overview
case-sensitivity
categories
advertisements
alcohol
arts
business and industry
chat and instant messaging
cheating and plagiarism
child abuse content
computers and internet
computer security
dating
digital postcards
dining and drinking
dynamic and residential
education
18-29 entertainment 18-29 extreme 18-29
fashion
file transfer services
finance
freeware and
gambling
games
government and law
hacking
hate speech
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-5
Index
IN-6 health and
humor
illegal activities
illegal downloads
infrastructure and content delivery
internet telephony
job search
lingerie and swimsuits
lotteries
mobile phones
nature
news
non-governmental organizations
non-sexual nudity
online communities
online storage and backup
online trading
organizational email
parked domains
18-32 peer file transfer 18-32
photo searches and images
politics
pornography
professional networking
real estate
religion
SaaS and B2B
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
science and technology
search engines and
portals 18-33 sex education 18-33
shopping
social networking
society and culture
sports and
streaming audio
streaming video
tobacco
transportation
unclassified
weapons
web-based email
web hosting
web page translation
category filtering
certificate authorities
certificate authority
certificate files
root certificates converting formats
supported
uploading
certificates
Index backing up for FIPS management
CSR for HTTPS
Proxy
CSR for HTTPS Proxy
CSR for Identity
Provider for SaaS
CSR for web interface
FIPS management
generating and signing your own
installing for credential encryption
installing on appliance
invalid
overview
root
SaaS Access
types supported for
FIPS
validating
validating certificate authorities
Certificate Signing Request
(CSR) for HTTPS
Proxy
for HTTPS Proxy
for Identity Provider for
SaaS
for web interface
Change Password link
changing passwords
cipher defined
ciphertext defined
Cisco Active Directory
Agent
Cisco ASA integration configuring
overview
Cisco Cloud Web Security
Cisco IronPort Data
Security Filters overview
Cisco IronPort Data
Security Policies and URL category
Data Security
Policies user location of
Cisco IronPort Web Usage
Controls overview
cleartext defined
CLI case-sensitivity in
clearing changes
clonesource
clonetarget
committing
configuring host keys
configuring languages
fipsconfig
initializing the HSM card
overview
rolling over log files
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-7
Index
IN-8 supported languages
viewing most recent log files
warning message
welcome message
Client Malware Risk
Client Malware Risk report
Client Malware Risk report page
clonesource command
clonetarget command
Cloud Web Security
Connector
authentication
changing modes
cloud routing policies
Cloud Web Security
Connector
HTTPS
compared to standard
configuring
data loss prevention
directory group policies
documentation
FTP
logging
overview
settings
setting the appliance
user authentication
command line interface
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Commit Changes button overview
commit
command
committing changes commit
command
overview
Web Proxy restart
community string
compressing log files
computer account joining an Active
Directory domain
configuration file
configuring
administrator settings
application control settings
custom text at login
data interfaces
FTP proxy, advanced options
HTTPS Proxy
Identities
proxy cache options
return addresses
WCCP router
web proxy, advanced options
Web Reputation
Filters
configuring the appliance anti-malware
Index browser requirements
clearing changes
committing changes
enabling features
L4 Traffic
Monitor
log files
network interfaces
reporting
scheduling
submitting changes
upstream proxies
Web Proxy settings
connecting
L4 Traffic
Monitor
web proxy in explicit forward mode
web proxy in transparent mode
connecting the appliance
Layer 4 switch
P1 and P2 ports
serial line
WCCP router
content filtering
Cisco IronPort Data
Security Policies
controlling applications overview
controlling bandwidth
overview
user limits
control settings
Decryption
Policies
creating
Access Policies
authentication realms
authentication
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Identities
log subscriptions
Outbound Malware
Scanning Policies
Routing Policies
time ranges
user agent based policies
credential encryption certificate and key
FIPS management
FTP requests
HTTPS requests
overview
cryptography certificate authority
cipher
ciphertext
cleartext
digital certificate
digital signature
key
overview
plaintext
private key
public key
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-9
Index public key infrastructure
root certificate
self-signed certificate
symmetric key
CSS in end-user notification pages
custom certificate authority importing
custom fields access and W3C logs
customizing
custom text
at login
custom URL categories overview
redirecting traffic
custom welcome message configuring for
CLI
IN-10
D data interfaces configuring
overview
data loss prevention
Data Security
Policies
External DLP
Policies
Outbound Malware
Scanning Policies
Data Loss Prevention
Policies, External
datasecurityconfig
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
Data Security logs overview
Data Security Policies configuring
content
creating
flow diagram
logging
membership
minimum request size
Monitor action
overview
protocol of request
proxy port of request
subnet of request
upload request definition
URL category of request
user agent of request
Data Security Policies,
Data Security Policy groups
debugging
decrypting
overview
decrypting HTTPS traffic configuring Decryption
Policies
overview
decryption bypassing
Index
Decryption Policies
and URL category changes
blocking
bypassing decryption
controlling
traffic 12-23 control settings 12-23
creating
cryptography
dropping traffic
enabling
flow diagram
guest users
membership
overview
passing through
proxy port of request
subnet of request
time of request
URL category of request
user agent of request
user location of request
Decryption Policy groups
policy groups
default route configuring
defining user preferences
deleting a URL from the web proxy cache
authentication realms
authentication
log subscriptions
WCCP service
DEM format converting
deploying the appliance
L4 Traffic
Monitor
multiple appliances and
overview
deployment
deployment connecting to a WCCP router
example scenario
existing proxies
L4 Traffic
Monitor
overview
preparing for
web proxy in explicit forward mode
web proxy in
depth of appliance
DHCP
WPAD
digital certificate defined
certificates digital cryptography
cryptography
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-11
Index digital signature defined
dimensions of appliance
DLP servers
DNS failover
authoritative name servers
configuring
installing the appliance
WPAD
DNS cache flushing
domain entering for authentication
dropping traffic
Decryption
Policies
duplex deploying the L4
Traffic Monitor
network tap
DVS engine how it works
overview
working with multiple malware verdicts
Dynamic Content Analysis engine enabling
overview
dynamic service
Dynamic Vectoring and
Streaming engine
DVS engine
IN-12
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
E editing authentication realms
authentication sequences
WCCP service
editing the appliance concurrent editing
enabling
HTTPS Proxy
P2 port
Secure Mobility
end-user acknowledgement page configuring
FTP requests
HTTPS requests
overview
end-user notification pages customizing
native FTP
on-box notification pages
overview
user defined notification pages
variables
end-user URL category page configuring
warning users
etherconfig
command
VLAN
evaluating Access Policy membership matching client requests
Index evaluating Data Security
Policy membership matching client requests
evaluating Decryption
Policy membership matching client requests
evaluating External DLP
Policy membership matching client requests
evaluating Identity group membership authentication
authentication
examples
matching client requests
overview
evaluating Outbound
Malware Scanning membership matching client requests
evaluating policy group membership overview
evaluating Routing Policy membership matching client requests
exempting user agents from authentication
expired keys overview
exporting
External Data Loss
Prevention and URL Category changes
externaldlpconfig
External DLP Policies configuring
creating
defining external DLP servers
load balancing
logging
membership
minimum request
overview
protocol of
proxy port of
subnet of request
URL category of
user agent of
user location of
External DLP Policy groups
policy groups external DLP servers
DLP servers
F failed authentication allowing guest access
overview
failover
DLP servers
Routing Policies
feature keys
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-13
Index
IN-14 adding manually
expired keys
overview
settings
Federal Information
Processing Standard
FIPS management filtering adult content
anti-malware
category
data in Cisco IronPort
Data Security
Policies
objects in Access
Policies
protocols
user agents
Web Reputation
fipsconfig
command
FIPS management backing up certificates and keys
cloning HSM cards
credential encryption
default password
explained
FIPS Officer
HTTPS Proxy
logging
logging into
managing certificates and keys
multiple HSM cards
overview
SaaS Access
Control
Cisco IronPort AsyncOS 7.5.7 for Web User Guide secure authentication
supported certificate types
FIPS management console logging into
FIPS Officer default password
overview
Firefox
PAC files
formatting access log
end-user acknowledge pages
end-user notification pages
forwarding method
GRE
L2
FTP
WCCP service
active mode
configuring notification
credential encryption
end-user acknowledgement page
FTP over HTTP
passive mode
FTP Poll
FTP Proxy overview
FTP proxy advanced configuration
G generating
root certificates for
HTTPS
global Identity policy authentication
global policy group
GRE overview
forwarding
greylist address
guest access overview
GUI configuring language
supported languages
H hash assignment
WCCP assignment
height of appliance
heuristic analysis
McAfee scanning
hostkeyconfig command
host keys configuring
hostname appliance
changing
HSM card
Index cloning
initializing
working with
HTTP/HTTPS headers logging
HTTPS authentication
bypassing decryption
certificate authority
cipher definition
ciphertext
cleartext
credential encryption
digital certificate
digital signature
end-user acknowledgement page
key definition
logging
overview
plaintext
private key cryptography
public key cryptography
public key infrastructure
root certificate
self-signed certificate
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-15
Index symmetric key cryptography definition
transparently redirected transactions
HTTPS Proxy configuring
decrypting traffic
FIPS management
transparently redirected transactions
HTTPS requests authentication
I
ICAP
External DLP
Policies
identifying users transparently
transparent user identification
Identities
about
and URL category
authentication
configuring in policy groups
creating
evaluating membership
guest privileges
local users
remote users
Identity groups
policy groups proxy port of
IN-16
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
URL category of request
user agent of request
identity provider configuring
identity provider initiated flow
SaaS Access
importing trusted root certificates
init
installation reverting
installing the appliance prerequisites
setup worksheet
instant messaging traffic controlling
interfaceconfig command
VLAN
interfaces see network interfaces
Internet Explorer re-authentication
WPAD
invalid certificates handling
IP based access about
IPMI
IP spoofing
WCCP service
Index
J joining
Active Directory
K key defined
key files
keys converting
supported
backing up for FIPS management
FIPS management
overview
known allowed address defined
known malware address defined
L
L2 forwarding
L4 Traffic Monitor allowing traffic
allow list
ambiguous addresses
anti-malware rules
blocking
blocking traffic
configuring
database
deploying
how it works
interfaces
known allowed addresses
known malware addresses
L2 switch
monitoring
monitoring traffic
overview
report
span/mirror port
unlisted addresses
viewing activity
L4 Traffic Monitor interfaces overview
languages defining default per user
supported
user preferences
last
command
Layer 4 switch connecting to the appliance
defined
LDAP overview
load balancing traffic to external DLP servers
traffic to upstream proxies
load-balancing method
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-17
Index
IN-18
assignment method local users overview
log fields
W3C access logs
log files
log subscriptions compressed
configuring host keys for SSH
configuring the level of information recorded
custom
extensions in filenames
formatting access and
W3C logs
HTTP/HTTPS headers
L4 Traffic
Monitor
naming convention
overview
types
viewing most recent version
logging
HTTP/HTTPS headers
HTTPS requests
redirected traffic
Secure Mobility
logging in
FIPS management console
web interface
login
login message configuring for
CLI
Cisco IronPort AsyncOS 7.5.7 for Web User Guide logs
FTP Poll
overview
log subscriptions adding
deleting
editing
overview
M
M1 interface overview
M1 port connecting to a laptop
MAIL FROM configuring for notifications
malware configuring scanning
malware verdicts multiple
management interface overview
managing the appliance connecting to a laptop
connecting to the management interface
Index
System Setup
Wizard
mask assignment
WCCP assignment
matching client requests
Access Policies
Cisco IronPort Data
Security Policies
Decryption
External DLP
Outbound Malware
Scanning Policies
Routing Policies
McAfee scanning engine
database
heuristic analysis
overview
membership diagram
Access Policies
Cisco IronPort Data
Security Policies
Decryption
External DLP
Outbound Malware
Scanning Policies
Routing Policies
Metadata File for Service
Provider
SaaS applications
MIB file
SNMP
mirror port deploying the L4
Traffic Monitor
misclassified URLs reporting
URL submission tool
mobile users overview
Monitor
Access Policies
Cisco IronPort Data
Security Policies
Decryption
Policies
monitoring
L4 Traffic
Monitor
scheduling reports
summary data
system activity
traffic
users from the
CLI
MSN Messenger authentication
multiple Active Directory domains overview
multiple Identities overview
musconfig command overview
musstatus
command overview
N native FTP authentication
configuring notification messages
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-19
Index guidelines
overview
transparently redirected connections
navigating web interface
negotiating
SSL session
Netscape
network interfaces
appliance ports
enabling P2
P1 and P2
T1 and T2
VLANs
network tap duplex
simplex
no category (nc)
notification pages
end-user notification pages
Novell eDirectory transparent user identification
NTLM bypassing
computer account
entering a domain
joining an Active
Directory domain
overview
NTLMSSP bypassing
IN-20
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
O object filtering
Access Policies
objects blocking
on-box notification pages overview
on-demand reports
outbound malware scanning overview
Outbound Malware
Scanning Policies
configuring
creating
logging
membership
overview
protocol of request
proxy port of request
subnet of request
URL category of request
user agent of request
user location of request
Outbound Malware
Scanning Policy groups
Outbound Malware Scan
Policy and URL category changes
Overview report
P
P1 and P2 interfaces
Index overview
P2 port configuring
PAC files configuring browsers
format
Netscape and
Firefox
overview
storing on the appliance
WPAD
packet capture editing settings
overview
starting
pages in the web interface
passing through traffic
Decryption
passwords
Active Directory
changing
PDF creating
special
PER format converting
physical dimensions of appliance
pinout serial connection
plaintext defined
policies table examples
overview
policy group member definition
Access Policies
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Identities
Outbound Malware
Scanning Policies
overview
Routing Policies
user agent based
policy groups about
Access Policies
All Identities
Cisco IronPort Data
Security Policies
creating
custom URL categories
Decryption
Policies
evaluating group membership
External DLP
Policies
global policy
guidelines
Outbound Malware
Scanning Policies
overview
policies table
time based
tracing
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-21
Index
IN-22 types of policies
user agent based
policy types overview
ports
Access Policies
blocking
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Identities
Outbound Malware
Scanning Policies
network interfaces preferences defining for users
private key cryptography defined
protocol filtering
Access Policies
protocols
Access Policies
blocking
Cisco IronPort Data
Security Policies
External DLP
Policies
Outbound Malware
Scanning Policies
proxy
web proxy
Proxy Buffer
proxy bypass list about
Cisco IronPort AsyncOS 7.5.7 for Web User Guide using with WCCP
proxy cache configuring
proxy groups creating
public key cryptography
public key infrastructure
R realms
realms re-authentication overview
using with Internet
Explorer
using with PAC files
redirecting traffic logging and reporting
overview
Redirect setting
URL categories
regular expressions overview
using in URL
remote users overview
reporting redirected traffic
reporting misclassified
reports anonymizing
Index
Anti-Malware
Application
Visibility
archiving
charts
Client Detail
Client Malware
Risk
Client Malware Risk
Page
custom date ranges
exporting data
interactive display
L4 Traffic
Monitor
making usernames
Malware
Category
Malware Threat
on-demand
Overview
printing to PDF
Reports by User
Location
return address
scheduling
search option
System Status
time range for scheduled reports
uncategorized
URLs
URL Categories
Web Reputation
Filters
Web Sites
Reports by User Location report overview
restarting Web Proxy effects
restoring keys for FIPS management
result codes
return addresses configuring
reversion versions available
revert installation
RFC
1065
1066
1067
1213
1907
2571-2575
overview
rollovernow command
root certificate defined
root certificates generating
importing trusted
uploading
using
routes default route
overview
routing tables
split routing
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-23
Index
and URL category
creating
failover
load balancing
membership
overview
protocol of
proxy port of
subnet of request
URL category of
user agent of
user location of
Routing Policy groups
policy groups routing tables configuring
routing traffic
S
SaaS Access Control authenticating users
authentication requirements
certificate
configuring identity provider
enabling
FIPS management
IN-24
Cisco IronPort AsyncOS 7.5.7 for Web User Guide identity provider initiated flow
multiple appliances
overview
prompting for authentication
SAML
service provider
service provider initiated flow
single sign-on
single sign-on
URL
understanding
zero day revocation
SaaS Application
Authentication Policies creating
SaaS applications
Authentication Policies authentication requirements
creating SaaS
Metadata File for
Service Provider
single sign-on
safe search enforcing
SAML identity provider
SaaS Access
service provider
scanning verdicts anti-malware
Index search view application control
secure LDAP
Secure Mobility configuring from the
CLI
enabling
overview
report
transparent user identification
self-signed certificate defined
SensorBase Network
sequences
sequences serial connection connecting to the appliance
service provider defined
service provider initiated flow
SaaS Access
sethostname command overview
setting up the appliance prerequisites
Simple Network
Management Protocol
simplex deploying the L4
Traffic Monitor
network tap
single sign-on
transparent user identification defined
SaaS applications
URL for SaaS access
site content rating enforcing
warning
SMI file
SNMP
SNMP community string
hardware failure trap conditions
hardware objects
IPMI
overview
SMI file
SNMPv1
SNMPv2
SNMPv3 passphrase
specifying multiple trap targets
traps
Sophos scanning engine overview
span port deploying the L4
Traffic Monitor
special characters authentication
splash page web proxy usage agreement
split routing
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-25
Index
SSH defined
configuring host keys
FIPS management
using with the
CLI
SSL negotiating a
SSL ciphers configuring for administrator access
SSL handshake overview
SSO URL
SaaS Access
Control
standard service
WCCP service
Start Test button overview
Submit button
submitting changes configuring the appliance
subnet
Access Policies
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Outbound Malware
Scanning Policies
supported languages
IN-26
Cisco IronPort AsyncOS 7.5.7 for Web User Guide configuring default
GUI and CLI
supportrequest command
surrogates authentication
symmetric key cryptography
Syslog
System Capacity report overview
system configuration file
System Setup Wizard logging in
overview
Review page
Security page
Start page
URL
username
System Status report
system time
T
T1 and T2 interfaces overview
tabs in web interface
tail
tcpdump
testauthconfig command
testing authentication settings
Threat Risk Threshold
Webroot
time based policies overview
URL Filters
time ranges
Access Policies
creating
Decryption
policy groups
Routing Policies
TLS used in HTTPS
tokens
to upstream proxies
tracing policies overview
traffic redirecting
transaction result codes
transparently identifying users
identification transparent mode native FTP
transparent redirection
transparent redirection adding a WCCP service
assignment
forwarding
Index
GRE forwarding method
hash assignment
HTTPS connections
L2 forwarding method
mask
overview
transparent user identification
Active Directory
configuring
Novell eDirectory
overview
remote users
rules and guidelines
SaaS applications
Secure Mobility
tuiconfig CLI command
tuistatus CLI command
understanding
troubleshooting policy groups
trusted root certificates importing
tty connection connecting to the appliance
tuiconfig
command overview
tuistatus
command overview
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-27
Index
U uncategorized URLs defined
in reports
URL submission
unlisted address defined
unrecognized root authority invalid
updates manual updates
overview
upgrades available
configuring upgrade settings
overview
requirements for local upgrade servers
streaming
upgrading
AsyncOS
uploading certificate files
root certificates
root certificates for
HTTPS
upload request defined
upstream proxies adding proxy information
authentication
creating proxy groups
IN-28
Cisco IronPort AsyncOS 7.5.7 for Web User Guide deployment
overview
URL routing traffic
Access Policies
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Identity groups
Outbound Malware
Scanning Policies
Routing Policies
URL categories
abbreviations
blocking
redirecting traffic
uncategorized
URL Categories report
URL category set updates
URL Filters bypassing
configuring
custom categories
Dynamic Content
Analysis engine
no category
regular expressions
time based
URL category
Index viewing filtering activity
URL processing
L4 Traffic
Monitor
URL submission tool using
user accounts
managing
types of
user agent
Decryption
Identity groups
Routing Policies
user agent based policies overview
user agent filtering
Access Policies
user agents
Access Policies
blocking
Cisco IronPort Data
Security Policies
exempting from authentication
External DLP
file types
instant messenger
objects
Outbound Malware
Scanning Policies
user defined notification pages example
overview
parameters
User Discovery Service log
Secure Mobility
user location
Access Policies
Cisco IronPort Data
Security Policies
Decryption
Policies
External DLP
Policies
Outbound Malware
Scanning Policies
Routing Policies
user name
usernames making unrecognizable in reports
user password length
user preferences defining
V validating
validating certificate authorities
variables access logs
end-user notification pages
VLAN defined
etherconfig command
example use
interfaceconfig command
Cisco IronPort AsyncOS 7.5.7 for Web User Guide
IN-29
Index labels
overview
W
W3C access logs custom fields
custom
log fields
overview
user defined log fields
warning accessing adult content
warning page end-user URL category page
warning users
configuring end-user warning page
using URL categories
WBRS
Filters
WCCP bypassing the web
WCCP cluster overview
WCCP configuration example configuration
syntax
WCCP router cluster
configuration syntax
configuring
IN-30
Cisco IronPort AsyncOS 7.5.7 for Web User Guide connecting to the appliance
deploying the appliance
multiple
WCCP services
WCCP services adding
assignment method
deleting
dynamic service
editing
forwarding method
IP spoofing
overview
standard service
well known service
web browsers configuring
detecting PAC files automatically
PAC files
supported
web interface browser requirements
clearing changes
committing changes
FIPS management
logging in
navigating
pages
tabs
user name and
advertisement
Related manuals
advertisement