Cisco Security Appliance Integration

Overview

Cisco Cloud Web Security supports integration with on-premises security appliances:

Cisco Adaptive Security Appliance (ASA)
Cisco Integrated Services Router (ISR)
Cisco Web Security Appliance (WSA)

To connect your security appliance with Cisco Cloud Web Security, see the deployment guides:

http://www.cisco.com/c/en/us/support/security/cloud-web-security/products-installation-and-configuration-guides-list.html

For details on further configuration, see the support documentation for the security appliance.

Tip

Test that the service is working by going to http://www.eicar.org and attempt to download their Anti-Malware Testfile. This should generate a block message.

Hybrid Web Security

Hybrid Web Security provides unified cloud and on-premises policy enforcement and threat defense using security policies you define in Cisco ScanCenter. Register your on-premises WSA with Cisco ScanCenter to automatically download and periodically update your security policies from the CWS cloud.

Before you begin

Connect, install, and configure your security appliance to operate in Hybrid Web Security mode. For information on how to set up a Cisco WSA, see:

Release Notes for AsyncOS 9.2 for Cisco Web Security Appliances
AsyncOS 9.2 for Cisco Web Security Appliances User Guide (primarily Chapters 2 and 3)

Note

Both CWS and WSA require a Certificate Authority signed certificate to authenticate and secure communications between them. Generate this certificate externally and upload the certificate and its key to both Cisco ScanCenter and the Cisco WSA.

Procedure

Step 1

In Cisco ScanCenter, navigate to Admin > Management > Hybrid Web Security.

Step 2

Click Generate Token.

Step 3

After the new authorization token is generated, click Copy Token to Clipboard.

Step 4

Paste the authorization token in the setup of the security appliance. Specifically in the Cisco WSA, paste the token in the Enter Authorization Key dialog box on the Web Policy Connectivity page of the System Setup Wizard. Refer to Chapter 3 in the AsyncOS 9.2 for Cisco Web Security Appliances User Guide.

Note

An unregistered token expires after 1 hour. If the token expires before use, generate a new token.

Note

One unique token is generated for use on any one security appliance. For multiple security appliances, repeat these steps to generate multiple tokens.

Step 5

In the Registered WSAs section, a table lists the security appliances currently and successfully registered with CWS. To remove an appliance, select its check box and click Deregister.

What to do next

Upon successful registration, the security appliance downloads your Cisco Cloud Web Security policy from Cisco ScanCenter.

Every time you modify your CWS policy in Cisco ScanCenter, the whole policy is downloaded to the security appliance to synchronize policies.
By default, every two minutes, the Cisco WSA checks to see if there is an updated policy to download.
For information on configuring security policy and web filtering, see Overview.
In the Cisco WSA, view its Reporting > System Status page to check the status of its hybrid registration with CWS.

Note

Some items that are configurable in Cisco ScanCenter are not yet supported for downloading by the Cisco WSA.

The following items must be configured directly on the Cisco WSA:

Email Alert Settings. Frequency of email alerts you want to receive.
Customized Alerts. Custom text and other settings for Block and AUP/EUA pages.
Global Settings. Enabling of settings such as SearchAhead, SafeSearch, AUP (EUA on the WSA), Dynamic Classification Engine, Content Range Headers, and Sandboxing.

Authentication Realms. Authentication realms must be configured directly on the Cisco WSA shortly after the System Setup Wizard finishes configuring Hybrid Web Security mode. In CWS, an authentication realm refers to SAML and EasyID. On the Cisco WSA, the types supported are different and usually refer to NTLM (SAML is not yet supported on the Cisco WSA). If CWS rules have either 'auth-user-name' or authentication groups configured, on the Cisco WSA you must configure authentication realms and custom identification profiles with authentication enabled. For more information, see the AsyncOS 9.2 for Cisco Web Security Appliances User Guide (primarily Chapters 6 and 7).

Note

Conversion and download of any HTTPS rules or authentication group rules is skipped during Cisco WSA hybrid set-up. These rules are automatically completed only after you set up the Cisco WSA in Hybrid Web Security mode and configure HTTPS proxy, authentication realms, and identification profiles, as CWS-to-WSA policy updates occur every two minutes.

The following items are not currently supported for use on on-premises security appliances and do not get downloaded by the Cisco WSA:

Anonymize CWS Action Type. Any rule assigned the Anonymize action.
Authenticate CWS Action Type. Any rule assigned the Authenticate action.
Warn CWS Action Type. Any rule assigned the Warn action.
Outbound Filters. Any rule using a filter that contains any Keyword, Outbound File Type, Preconfigured ID, or Regular Expression. Inbound extensions are also not supported.
Whitelisting sets of domains and URLs to bypass Spyware or Web Reputation (WebRep) scanning at the global level.
Delegated Administration. The Cisco WSA does not incorporate the concept of delegated administration. CWS will send a merged policy configuration.
SafeSearch. Works with Google, Yahoo and Bing. Because they are moving to HTTPS, we require HTTPS inspection to be enabled in the cloud.

For additional information, including warnings, caveats, and what functionality is and is not supported, see:

Release Notes for AsyncOS 9.2 for Cisco Web Security Appliances
AsyncOS 9.2 for Cisco Web Security Appliances User Guide (primarily Chapter 2)

Note

Translation of both default and user-defined CWS policies to WSA policies is not a one-to-one conversion. However, the action that results from application of a particular policy in both environments is the same. In other words, the Block or Allow decision is always consistent, regardless of the sequence of rules “fired” in both cases. This allows rule evaluation in the proxy to be optimized for better performance without compromising consistent behavior.

Transparent Redirection

The Cisco WSA can be configured to enable usernames, internal IP addresses, and domain groups to be sent using PIM to Cisco Cloud Web Security without needing to make end-user changes. There are several ways to achieve this but Cisco recommends using an explicit proxy, PAC file, or WPAD. The Cisco WSA is a network-level proxy and makes transparent redirection possible for network-based clients without requiring additional agents, such as Cisco Cloud Web Security Connector.

Note

You must switch off scanning and the additional features of the Cisco WSA. However, you can enable caching. When using the Cisco WSA in transparent mode, user granularity is available for HTTP traffic only. To pass HTTPS traffic to Cisco Cloud Web Security, enable HTTPS inspection, providing that it is legal to do so in your jurisdiction.

Configuring the Upstream Proxy

Procedure

Step 1	On the WSA, click Network > Upstream Proxies.
Step 2	Click Add Group.
Step 3	In the Name field, enter `WebSecurity`.
Step 4	In the Proxy Servers area, enter the Proxy Address, Port and the number of Reconnection Attempts for each of the Cisco Cloud Web Security proxy servers (found in your provisioning email). Typically the port will be `8080`, and the number of reconnection attempts should be `2`.
Step 5	In the Load Balancing drop-down list, choose a method. Typically this will be None (Failover).
Step 6	Click a Failure Handling method to specify how to handle requests if the primary and secondary Cisco Cloud Web Security proxies are both unavailable. This should be Drop requests.
Step 7	Click Submit to apply your changes. Alternatively, click Cancel to abandon your changes.
Step 8	Click Commit Changes.

Setting the Routing Policies

Procedure

Step 1	On the WSA, click Web Security Manager > Routing Policies.
Step 2	Edit the default routing policy, and in the Upstream Proxy Group drop-down list, choose WebSecurity.
Step 3	Click Submit to apply your changes. Alternatively, click Cancel to abandon your changes.

CLI Settings

Procedure

Step 1	Log in to the CLI and enter `advancedproxyconfig`.
Step 2	At the parameter group select prompt, enter `caching`.
Step 3	At the caching options prompt, enter `4` to select Customized Mode.
Step 4	Accept the default values until you are prompted to enter the `Time in seconds after which an explicit IMS Refresh request must be issued`.
Step 5	Enter `0`.
Step 6	Enter `commit` to make the change, and then enter a description of the change.

Cisco ScanCenter Administrator Guide, Release 5.2

Book Title

Chapter Title

Results

Chapter: Cisco Security Appliance Integration

Cisco Security Appliance Integration

Overview