Secure Access Security Profile Decryption Requirements for Warning Actions

Issue

Users need configuration guidance for Cisco Secure Access regarding whether Decryption must be enabled in the Security Profile settings when the Access Policy action is set to Warning. The specific question applies to these Security Profile features:

• Threat Categories

• File inspection

• Cisco Secure Malware Analytics

• File Type Blocking

• Safe Search

The question centers on understanding the relationship between Access Policy Warning actions and Security Profile Decryption requirements for these security features to function properly.

Environment

• Product: Cisco Secure Internet Access Advantage

• Technology: Secure Access

• Software Version: ALL

• Configuration: Security Profile with various security features

• Policy Configuration: Access Policy with Warning action settings

Resolution

Lab validation has confirmed that Access Policy Warning actions work normally even when only Decryption is enabled in the Security Profile and all other features are disabled. This means that for these Security Profile features, Decryption does not need to be specifically enabled for each individual feature when using Warning actions:

• Threat Categories

• File inspection

• Cisco Secure Malware Analytics

• File Type Blocking

• Safe Search

Configuration Guidance

When configuring Access Policy with Warning actions:

Step 1: Configure the Access Policy action to Warning for the desired policy rules.

Step 2: In the Security Profile settings, ensure that Decryption is enabled at the profile level.

Step 3: Individual security features (Threat Categories, File inspection, Cisco Secure Malware Analytics, File Type Blocking, and Safe Search) can remain disabled in their specific Decryption settings while still functioning properly with Warning actions.

This configuration approach allows the Warning action to function correctly while maintaining flexibility in Security Profile feature management.

Cause

The Warning action in Access Policy operates at a different level than individual Security Profile feature decryption requirements. The Warning action can function with only the main Decryption setting enabled at the Security Profile level, without requiring individual decryption enablement for each specific security feature.

Related Content

• Cisco Technical Support & Downloads