Contents

Introduction

Prerequisites

Requirements

Components Used

Before you Begin

Steps to Integrate SWA to SMA

Step 1. Export the Configuration File from SWA

Step 2. Create the Configuration Manager

Step 3.Configuration Manager Settings

Step 4. Add Web Appliance

Step 5. Validate the Integration

Fixing Errors

"The CentralizedServices is Disabled"

"Authentication Failed for IP"

"Cisco Centralized Web Reporting is disabled in the SWA"

"The list of URL categories on this WSA was older than the list published from the SMA"

"The host key appears to have changed"

Related Information

Introduction

This document describes the process of integrating the Secure Web Appliance (SWA) to Security Management Appliance (SMA).

Prerequisites

Requirements

Cisco recommends knowledge of these topics:

- Access ToGraphic User Interface (GUI)of SWA.

- Administrative Access to the SWA.

- Administrative Access to the SMA.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Before you Begin

1. Make sure the SMA and SWA are both licensed.

2. Check the compatibility matrix of the SWA and SMA, use this link: SWA-SMA-ESA Compatibility Matrix.

Note: Make sure the version you are planning to integrate is not deprovisioned.

Image - Deprovisioned Releases

Steps to Integrate SWA to SMA

Step 1. Export the Configuration File from SWA

Step 1.1. From the GUI, Navigate to System Administration and choose Configuration File.

Step 1.2. Make sure Download file to local computer to view or save is selected.

Step 1.3. Choose Encrypt passwords in the Configuration Files.

Step 1.4. (Optional) Choose a name for the configuration file.

Step 1.5. Click Submit.

Image - Exporting the configuration File

Step 2. Create the Configuration Manager

Note: If the Configuration Manager is already in configured in the SMA, skip to Step 4.

Step 2.1. From the SMA GUI Click on the Web tab.

Step 2.2. From Utilities select Configuration Manager.

Step 2.3. If the Configuration manger is not Initialized yet, click on the Initialize link for the desired Configuration Manager, else skip to Step 2.5.

Tip: The Configuration Manager version must align with the first two segments of your SWA version. For example, if your SWA version is 15.5.0-710, you must use Configuration Manager 15.5.

Step 2.4. Select Use default settings and click Initialize.

Step 2.5. Click Import Configuration for the desired Configuration Manager.

Image - Configuration Manager

Step 2.6. From the Select Configuration Source choose Web Configuration File.

Step 2.7. Select the configuration file you exported on Step 1.

Image - Import Configuration

Step 2.8. Click Import.

Step 2.9. Commit the changes.

Step 3. Configuration Manager Settings

Step 3.1. From the SMA GUI Click on the Web tab.

Step 3.2. From Utilities select Security Services Display.

Step 3.3. Make sure the desired features are configured correctly, you can enable or disable the features from Edit Display Settings.

Step 3.4. If you made any changes, Submit and Commit.

Image - Security Services Display

Step 4. Add Web Appliance

Step 4.1. From the SMA GUI Click on the Management Appliance tab.

Step 4.2. From Centralized Services select Security Appliances.

Step 4.3. Click Add Web Appliance

Image - Add Web Appliance

Step 4.4. Enter the Appliance Name and the IP address or Hostname.

Step 4.5. Click Establish Connection.

Step 4.6.Enter the Username and Passphrase and click Establish Connection.

Step 4.7. Assign the Configuration Manager.

Image - Adding the SWA

Step 4.8. Submit and Commit the changes.

Step 5. Validate the Integration

Step 5.1. From the SMA GUI, Click on the Web tab.

Step 5.2. From Utilities, select Web Appliance Status.

Step 5.3. If you are seeing a Warning message Attention Required. Click on the appliance name for details, click the name of the SWA and view the details.

Image - Web Appliance Status

Tip: For troubleshooting view the Fixing Errors section in this article.

Fixing Errors

"The Centralized Services is Disabled"

While you try to select a Centralized services, if the check box is inactive, click on the question mark (?) and the guide navigates you through the path to enable that service.

Image - The Centralized Services is Disabled

"Authentication Failed for IP"

While you are integrating the SWA to SMA if you receive this error, make sure the IP address or hostname and the credentials are correct.

Image - Authentication Failed

"Cisco Centralized Web Reporting is disabled in the SWA"

If the SMA is configured with the Centralized Web Reporting and you assign that feature to the SWA while integrating the SWA to SMA in "Step 4", you need to enable Cisco Centralized Web Reporting:

Image - Centeralized Web Reporting is Disabled in the SWA

To fix the issue, connect to the SWA from CLI and type reportingconfig and select CENTRALIZED, follow the wizard to enable the Centralized Reporting and commit the changes.

SWA_CLI> reportingconfig

Choose the operation you want to perform:

- COUNTERS - Limit counters recorded by the reporting system.

- WEBTRACKINGQUERYTIMEOUT - Timeout value for Webtracking Queries.

- AVERAGEOBJECTSIZE - Average HTTP Object Size used for Bandwidth Savings Calculation.

- WEBEVENTBUCKETING - Enable or Disable web transaction event bucketing.

- CTROBSERVABLE - Enable or Disable CTR observable based indexing.

- CENTRALIZED - Enable/Disable Centralized Reporting for this Secure Web Appliance.

[]> CENTRALIZED

Reporting service status: Local Reporting enabled.  (Show usernames in reports.)

Do you want to enable Centralized Reporting for this appliance? [N]> Y

Do you want to anonymize usernames in reports? [N]> N

Reporting service status: Centralized Reporting enabled.  (Show usernames in reports.)

Choose the operation you want to perform:

- COUNTERS - Limit counters recorded by the reporting system.

- WEBTRACKINGQUERYTIMEOUT - Timeout value for Webtracking Queries.

- AVERAGEOBJECTSIZE - Average HTTP Object Size used for Bandwidth Savings Calculation.

- WEBEVENTBUCKETING - Enable or Disable web transaction event bucketing.

- CTROBSERVABLE - Enable or Disable CTR observable based indexing.

- CENTRALIZED - Enable/Disable Centralized Reporting for this Secure Web Appliance.

[]>

SWA_CLI> commit

"The list of URL categories on this WSA was older than the list published from the SMA"

If while you are publishing the configuration to SWA and receiving the Error indicates that the URL category list in SWA and SMA are not the same, make sure both devices are able to connect to Cisco Update Server and there are no Errors in the "updater_logs":

Image - The list of URL categories are not matching

To force the SWA or SMA to download the update, from the CLI, type updatenow.

To view the SMA or SMA, Logs related to update, from the CLI type grep and choose the number associated with updater_logs and follow the wizard

Tip: to view the live logs, type "Y" in the answer to Do you want to tail the logs? [N]>.

"The host key appears to have changed"

If while you are integrating the SWA to the SMA and receiving the Error that the host key has been changed, this is due to the reason that SMA has stored a different host Key for the same IP address in its key store.

Image -The host key appears to have changed

To fix this Error, log in to CLI of SMA, run logconfig and Enter HOSTKEYCONFIG. Type DELETE and press Enter. Then, select the number associated to the SWA and press enter until the wizard is finished.

Commit the changes:

SMA_CLI> logconfig

Currently configured logs:

Log Name            Log Type                      Retrieval           Interval

---------------------------------------------------------------------------------

1. aggregatord_logs    Aggregatord Logs              Manual Download     None

2. authentication      Authentication Logs           Manual Download     None

...

Choose the operation you want to perform:

- NEW - Create a new log.

- EDIT - Modify a log subscription.

- DELETE - Remove a log subscription.

- DELETELOGFILE - Delete log files

- SETUP - General settings.

- LOGHEADERS - Configure headers to log.

- HOSTKEYCONFIG - Configure SSH host keys.

[]> HOSTKEYCONFIG

Currently installed host keys:

1. 10.48.48.182 ssh-rsa AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...ZhW4gEXWE=

2. 10.48.48.181 ssh-rsa BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBb...4p74b9Q9k=

Choose the operation you want to perform:

- NEW - Add a new key.

- EDIT - Modify a key.

- DELETE - Remove a key.

- SCAN - Automatically download a host key.

- PRINT - Display a key.

- HOST - Display system host keys.

- FINGERPRINT - Display system host key fingerprints.

- USER - Display system user keys.

- REGENERATESCPKEYS - Regenerate SSH Keys for SCP Log Subscription Retrieval.

[]> DELETE

Enter the number of the key you wish to delete.

[]> 2

Currently installed host keys:

1. 10.62.131.143 ssh-rsa AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...ZhW4gEXWE=

...

SMA_CLI> commit

Related Information

- User Guide for AsyncOS 15.2 for Cisco Secure Web Appliance

- Install Secure Web Appliance on Vmware ESXi

- Install Secure Web Appliance on Microsoft Hyper-V

- Secure Web Appliance Initial Setup

- Cisco Secure Email and Web Virtual Appliance Installation Guide

- Configure Custom URL Categories in Secure Web Appliance - Cisco

- Use Secure Web Appliance Best Practices

- Configure Firewall for Secure Web Appliance

- Configure Decryption Certificate in Secure Web Appliance

- Troubleshoot Secure Web Appliance DNS Service