topic Config transparent Proxy with LDAP authen with L4 switch? in Web Security

Config transparent Proxy with LDAP authen with L4 switch?

digital09_ironport — Tue, 12 Jun 2007 15:50:24 GMT

How to config policy based routing on L4 switch if wsa run in transparent mode with LDAP authentication?

Async OS: 5.1.0-420

Thank you,
Thanapol

Re: Config transparent Proxy with LDAP authen with L4 switch?

jowolfer — Tue, 12 Jun 2007 21:43:25 GMT

Thanapol,

As long as the packets are properly getting to the WSA, it just needs to be setup for transparent mode + LDAP authentication turned on.

For specifics on how to set up a specific L4 switch, you will most likely need to research instructions for the specific switch you are using, since they are all different.

If you tell me what switch you are using, I may be able to provide some guidance for where to look.

Re: Config transparent Proxy with LDAP authen with L4 switch?

digital09_ironport — Tue, 12 Jun 2007 22:41:49 GMT

Josh,

I'm using CISCO Catalyst 4507 supervisor IV with IOS 12.2 (31)

Thank you,
Thanapol

L4TM

ezekiel_ironport — Tue, 09 Oct 2007 19:18:23 GMT

Dear All,

Please correct me if I am wrong. In order to do L4TM, I must need either:

1) Network TAP connected to T1/T2.
2) L4 switch connected to P1.
3) WCCP v2 connected to P1.

Thanks,
ezekiel

Re: Config transparent Proxy with LDAP authen with L4 switch?

jowolfer — Tue, 09 Oct 2007 23:20:22 GMT

Ezekiel,

I wanted to add some clarification to your comments:

1) Network TAP connected to T1/T2.

This will work good. You will need to tap one direction of traffic to the T1 port and the other direction in to the T2 interface.

2) L4 switch connected to P1.

This will NOT work. Further explaination below. What you can do is use a switch that supports port spanning / port mirroring. You'll need to send a COPY of all traffic going to gateway to the T1 interface.

The L4TM will need to be in 'duplex' mode - Configurable in the GUI.

3) WCCP v2 connected to P1.

WCCP cannot be used at all with the L4TM, because WCCP doesn't 'copy' the traffic, it redirects it.

------------------------------------------
L4TM information
------------------------------------------

The L4TM can be thought of as a completely seperate appliance that operates primarily via the t1 / t2 interfaces.

The L4TM is a sniffer application, meaning that you cannot redirect traffic to it (such as L4 switching PBR or WCCP), but you can send a copy of traffic to it (port mirroring or physical tap).

If you are blocking with the L4TM, the WSA will use M1/P1 to send the TCP RST packets. This is the ONLY use for the M1/P1 interfaces that the L4TM will use.

The P1 interface is intended to be used for Web proxy traffic and the L4TM does not listen on this interface.

Re: Config transparent Proxy with LDAP authen with L4 switch?

ezekiel_ironport — Wed, 10 Oct 2007 09:37:41 GMT

Thanks Josh.