topic Re: Backup the virtual WSA appliance running under VMware in Web Security

Backup the virtual WSA appliance running under VMware

SIMMN — Mon, 06 Feb 2023 16:58:42 GMT

According to the WSA document, quoted below:

Do not take backup (snapshot) of the virtual appliance using VMware or any other third-party tools, or
restore a virtual appliance from a snapshot. Alternatively, you can take backup of the configuration using
the System Administration > Configuration File menu in the user interface or using the saveconfig
CLI command. You can then load it on another spawned virtual appliance.

I can only backup the configuration and I assume if the appliance went down, I would have to spin-up a new appliance to restore the configuration backup. But why?

Is there a way to do appliance level backup and restore with the v14.5 WSA?

Re: Backup the virtual WSA appliance running under VMware

Ken Stieers — Mon, 06 Feb 2023 17:07:15 GMT

No. There is no supported way to backup/restore the app. Just the configuration.

If HA is a requirement, you can spin up as many WSA vms as you need. WSA vms are licensed per user, so build what you need.

Re: Backup the virtual WSA appliance running under VMware

SIMMN — Mon, 06 Feb 2023 17:45:08 GMT

Okey, good to know. But feels like the WSA/ESA AsyncOS is somehow band-aided and outdated over the years from feature set perspective...

Re: Backup the virtual WSA appliance running under VMware

Ken Stieers — Mon, 06 Feb 2023 17:55:15 GMT

Or you're expressing a need for a feature that after over a decade of being deployed, and millions in service (CES is just ESA vms), it turns out they don't actually need it...

Re: Backup the virtual WSA appliance running under VMware

amojarra — Wed, 08 Feb 2023 08:54:57 GMT

Hello @SIMMN

WSA has a feature for failover, which one WSA went down the other WSA will be in production (Using the Common Address Redundancy Protocol (CARP)

in case if you want both Appliance are holding same configuration you might need to back-up and restore manually or simple use SMA for central configuration and management

steps for adding failure has been covered in USerGuide :

User Guide for AsyncOS 11.0 for Cisco Web Security Appliances - Connect, Install, and Configure [Cisco Secure Web Appliance] - Cisco

also I believe it could be nice if you take a look at this link to have this feature works properly on a Virtual WSA:

Ensure Proper Virtual WSA HA Group Functionality in a VMware Environment - Cisco

regarding cloning a virtual machine and keeping it as Failover, you still need some manual configuration, when one WSA is down, and also it is not recommended.

on the other hand there are couple of actions which I am just listing here, you might be interested in them, which are related to load balance and failover

[1] you can use Transparent deployment, hosting two or more WSAs, then let the router decide when any device is down and not sending the traffic to that WSA

[2] using PAC file and configuring both (or more) WSA's as proxy server there. (in this case there will be delay till browser makes the decisions to mark first proxy as down and redirect traffic to another WSA for all new sessions- it depends on the browser )

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++ If you find this answer helpful, please rate it as such ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++