https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024083#M8959 <P>I currently use two proxies<BR />One is the Web Content gateway ( Forcepoint ), which transparently directs traffic to ironport.<BR />Forcepoint authorizes users using NTLM and Kerberos and sends it to the parent proxy that is Ironport.<BR />I don't know how to set up ironicport to be able to read this information. It ends with a message all the time<BR />407 / Proxy Authentication Required</P> Wed, 05 Feb 2020 13:35:06 GMT Ceez 2020-02-05T13:35:06Z https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024076#M8958 <P>HI,</P><P>How to enable "Read authentication from child/downstream proxy" on Ironport WSA 11.8?</P><P>&nbsp;</P> Wed, 05 Feb 2020 13:29:40 GMT https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024076#M8958 Ceez 2020-02-05T13:29:40Z https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024083#M8959 <P>I currently use two proxies<BR />One is the Web Content gateway ( Forcepoint ), which transparently directs traffic to ironport.<BR />Forcepoint authorizes users using NTLM and Kerberos and sends it to the parent proxy that is Ironport.<BR />I don't know how to set up ironicport to be able to read this information. It ends with a message all the time<BR />407 / Proxy Authentication Required</P> Wed, 05 Feb 2020 13:35:06 GMT https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024083#M8959 Ceez 2020-02-05T13:35:06Z https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024113#M8961 <P>or how to enable "Send authentication to parent proxy"? then it will change the proxy order.</P> Wed, 05 Feb 2020 14:02:56 GMT https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024113#M8961 Ceez 2020-02-05T14:02:56Z https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024123#M8962 What ip does the WSA see requests coming from? If its the Forcepoint box youre out of luck.<BR /><BR /><BR />If the forcepoint box sends the request as if it came from the workstation you might be able to use CDA or ISE-PIC to send passive auth to the WSA and get names in reports/logs<BR /><BR /><BR /> Wed, 05 Feb 2020 14:12:35 GMT https://community.cisco.com/t5/web-security/enable-read-authentication-from-child-proxy/m-p/4024123#M8962 Ken Stieers 2020-02-05T14:12:35Z