목차

질문:

기고자: Kei Ozaki 및 Siddharth Rajpathak, Cisco TAC 엔지니어

질문:

HTTPS 트래픽에 대한 액세스 로그에 기록되는 항목

환경:AsyncOS 버전 7.1.x 이상을 실행하는 Cisco WSA(Web Security Appliance), HTTPS 프록시 사용

Cisco WSA(Web Security Appliance)에서 HTTPS 트래픽을 로깅하는 방법은 일반 HTTP 트래픽과 다릅니다.  액세스 로그에 기록된 HTTPS 항목은 요청이 처리되는 방식에 따라 다르게 표시됩니다.일반적으로 일반적인 HTTP 트래픽과 다른 특성을 갖습니다.

로깅되는 항목은 사용 중인 구축 모드(명시적 전달 모드 또는 투명 모드)에 따라 달라집니다.

먼저 액세스 로그를 쉽게 읽을 수 있는 몇 가지 키워드를 살펴보겠습니다.

TCP_CONNECT - 트래픽이 투명하게 수신되었음을 표시합니다(WCCP 또는 L4 리디렉션을 통해)...등)

CONNECT - 트래픽이 명시적으로 수신되었음을 나타냅니다.

DECRYPT_WBRS - WSA가 WBRS 점수로 인해 트래픽을 해독하기로 결정했음을 나타냅니다.

PASSTHRU_WBRS - WSA가 WBRS 점수로 인해 트래픽을 통과하기로 결정했음을 나타냅니다.

DROP_WBRS - WSA가 WBRS 점수로 인해 트래픽을 삭제하기로 결정한 것으로 표시됩니다.

- HTTPS 트래픽이 해독되면 WSA는 2개의 항목을 로깅합니다.

- TCP_CONNECT 또는 CONNECT는 수신되는 요청의 유형에 따라, 해독된 URL을 "GET https://"으로 표시합니다.

- 전체 URL은 WSA가 트래픽을 해독하는 경우에만 표시됩니다.

또한 다음 사항에 유의하십시오.

- 투명 모드에서 WSA는 처음에 대상 IP 주소만 표시합니다.

- 명시적 모드에서 WSA는 대상 호스트 이름을 표시합니다.

다음은 액세스 로그에 표시되는 몇 가지 예입니다.

투명 - 암호 해독

1252543170.769 192.168.30.103 TCP_MISS_SSL/200 0 TCP_CONNECT tunnel://192.168.34.32:443/ - DIRECT/192.168.34.32 - DECRYPT_WBRS-DefaultGroup-test.id-NONE-NONE-Routing <Sear,5.0,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-. -,-,-> -

1252543171.166 395 192.168.30.103 TCP_MISS_SSL/200 2061 GET https://www.example.com:443/sample.gif - DIRECT/192.168.34.32 image/gif DEFAULT_CASE-test.policy-test.id-NONE-NONE-NONE <Sear,5.0, 0,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-, 0,-,-,-,-, 0,-,-,-,-, 0,-,-,-,-,-, 0, 0, 0,-,-, -,,-,-,-,-> -

투명 - 통과

125254337.373 690 192.168.30.103 TCP_MISS/200 2044 TCP_CONNECT tunnel://192.168.34.32:443/ - DIRECT/192.168.34.32 - PASSTHRU_WBRS-DefaultGroup-test.id-NONE-NONE-Routing <Sear,9.0,,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-> -

투명 - 삭제

1252543418.175 430 192.168.30.103 TCP_DENIED/403 0 TCP_CONNECT tunnel://192.168.34.32:443/ - DIRECT/192.168.34.32 - DROP_WBRS-DefaultGroup-test.id-NONE-NONE-DefaultRouting <Sear,-9.1.0,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-, ->

명시적 - 암호 해독

25254358.405 10.66.71.105 TCP_CLIENT_REFRESH_MISS_SSL/200 40 CONNECT tunnel://www.example.com:443/ - DIRECT/www.example.com - DECRYPT_WBRS-DefaultGroup-test.id-NONE-NONE-Routing <Sear,5.0,-,-,-,-,,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-, -,-,-,-> -

125254359.535 1127 10.66.71.105 TCP_MISS_SSL/200 2061 GET https://www.example.com:443/sample.gif - DIRECT/www.example.com image/gif DEFAULT_CASE-test.policy-test.id-NONE-NONE-NONE <Sear,5.0,0,-,-,-,-,-,-,-,-,-,-,-,-,-,-, 0,-,-,-,-, 0,-,-,-,-,-, 0,-,-,-,-,-,-,-,-,-, 0, 0, -,,-,-,-,-> -

명시적 - 통과

1252543491.302 568 10.66.71.105 TCP_CLIENT_REFRESH_MISS/200 2256 CONNECT tunnel://www.example.com:443/ - DIRECT/www.example.com - PASSTHRU_WBRS-DefaultGroup-test.id-NONE-NONE-Routing <sear,9.0,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-> -

명시적 - 삭제

125254368.375 1 10.66.71.105 TCP_DENIED/403 1578 CONNECT tunnel://www.example.com:443/ - NONE/- - DROP_WBRS-DefaultGroup-test.id-NONE-NONE-NONE <Sear,-9.1,,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-,-, -