topic Using Web Tracking in Web Security

Using Web Tracking

Shao-Yu Chen — Wed, 22 Jan 2014 18:46:56 GMT

Been playing with Ironport for few month now, and still trying to understand the in and out. By looking at Web Tracking Results, how can I be so sure that the user X is successfully login to a website XYZ.com and able to jump from pages to pages with no problem. Clicking on the Display Details..., I can see more on the URL details and end with XYZ.com/.../members-login, XYZ.com/.../link/id/####, and XYZ.com/.../#.jpg. And under Disposition column, Allow is displayed for each website results. But the user X is saying the sub pages are "BLOCKED" and asking for access.

Without remoting user X computer, not knowing users member login, but I do know the web results showed up all allowed from Web Tracking for the last two weeks. Does that mean everthing is good? Is there another feature on Ironport that I can verify and say "Dude, nothing is blocked for this site!". Thank you for the help and educate me a little.

Using Web Tracking

donnylee — Tue, 28 Jan 2014 11:42:06 GMT

As long as the traffic to site is not by-passed in the WSA, it will be logged.

This also means it will show up in reporting.

If you do not see anything "blocked" in report for mr. X's traffic in the last two weeks, I'd assume he has been a good user

You can also use Policy Trace under System Administration menu in GUI, fill in the details and test to confirm if the site will be blocked by your policy.

Hope this helps.

- Donny

Using Web Tracking

Shao-Yu Chen — Wed, 29 Jan 2014 17:57:17 GMT

While using Policy Trace I have noticed something. I removed myself from an active directory group, but the Policy Trace still shows I am in that group. Where can I verify that the Ironport is synced with active directory?

Using Web Tracking

donnylee — Wed, 29 Jan 2014 23:14:37 GMT

Depending on the surrogate type used, your IP address may still be recognized after you've been removed from AD.

You may check or flush yourself out from the surrogate list, this can be done from CLI mode using command authcache'

However, I personally find policy trace as a simulator, and I'd double-confirm by sending real traffic and check the access log to confirm if my policy is working correctly.