https://community.cisco.com/t5/web-security/logging-of-https-websites-in-wsa/m-p/2808074#M6263 <P>I guess you're running in explicit mode?</P> <P>There are a few differences between explicit and transparent client HTTP requests:</P> <P>1. An explicit request has a destination IP address of the configured proxy. A transparent request has a destination IP address of the intended web server (DNS resolved by the client).</P> <P>2. The URI for a transparent request does not contain the protocol with the host:</P> <TABLE border="1"> <TBODY> <TR> <TD><STRONG>Transparent</STRONG></TD> <TD>GET / HTTP/1.1</TD> </TR> <TR> <TD><STRONG>Explicit</STRONG></TD> <TD>GET <A href="http://www.google.com/" target="_blank">http://www.google.com/</A> HTTP/1.1</TD> </TR> </TBODY> </TABLE> <P><BR />Both will contain an HTTP Host header that specifies the DNS host.</P> <P>So when in explicit mode, the proxy will actually see the destination URL, even when you passthrough the request.</P> Wed, 20 Jan 2016 09:19:20 GMT Erik Dahle 2016-01-20T09:19:20Z https://community.cisco.com/t5/web-security/logging-of-https-websites-in-wsa/m-p/2808073#M6262 <P>Currently I have all HTTPS decryption using passthrough and when I look at the web tracking on the WSA it only shows the IP address. My understanding of this is since the traffic isn't being decrypted it can't get the web address. But if I look in the access logs I do see the web address. Can anyone shed some light on how this works?</P> Tue, 19 Jan 2016 21:55:28 GMT https://community.cisco.com/t5/web-security/logging-of-https-websites-in-wsa/m-p/2808073#M6262 dkorell 2016-01-19T21:55:28Z https://community.cisco.com/t5/web-security/logging-of-https-websites-in-wsa/m-p/2808074#M6263 <P>I guess you're running in explicit mode?</P> <P>There are a few differences between explicit and transparent client HTTP requests:</P> <P>1. An explicit request has a destination IP address of the configured proxy. A transparent request has a destination IP address of the intended web server (DNS resolved by the client).</P> <P>2. The URI for a transparent request does not contain the protocol with the host:</P> <TABLE border="1"> <TBODY> <TR> <TD><STRONG>Transparent</STRONG></TD> <TD>GET / HTTP/1.1</TD> </TR> <TR> <TD><STRONG>Explicit</STRONG></TD> <TD>GET <A href="http://www.google.com/" target="_blank">http://www.google.com/</A> HTTP/1.1</TD> </TR> </TBODY> </TABLE> <P><BR />Both will contain an HTTP Host header that specifies the DNS host.</P> <P>So when in explicit mode, the proxy will actually see the destination URL, even when you passthrough the request.</P> Wed, 20 Jan 2016 09:19:20 GMT https://community.cisco.com/t5/web-security/logging-of-https-websites-in-wsa/m-p/2808074#M6263 Erik Dahle 2016-01-20T09:19:20Z