topic Cisco ASA firewall and Cisco Scansafe web URL & content security scanning in Network Security

Cisco ASA firewall and Cisco Scansafe web URL & content security scanning

david.tran — Mon, 11 Mar 2019 22:17:35 GMT

I have a requirements to provide wireless access for visitors who visit the companies for a few days. These guest users will be able to browse the Internet and VPN back into their corporate securely with their own laptops, Ipad, etc...

One of the requirements is that I need to be able to control ther Internet usage and make sure whatever they download can be safely scanned through a cloud service from Cisco called scansafe. I am thinking of using Cisco ASA firewalls to accomplish this task.

I am getting conflicting information. According to this documentation, Cisco ASA and scansafe only works for http but not https:

http://www.novanet.se/ScanSafe_ASA_WiFi_Config.pdf

However, another documentation states that Cisco IOS routers and scansafe work with both http and https:

http://www.networkworld.com/community/blog/tutorial-cisco-routers-add-web-security-cisco

does it mean that by choosing to go with ASA, http(s) will not be available with scansafe?

Thanks,

Re: Cisco ASA firewall and Cisco Scansafe web URL & content secu

Marvin Rhoads — Tue, 24 Jan 2012 04:12:13 GMT

To use scansafe with https you need to be able to terminate and proxy and re-establish the clients' https requests. That's a bit beyond the scope of capability of the ASA and requires you implement a full proxy like the Ironport WSA (or a Bluecoat Proxy SG) as the WCCP destination..

Note this Cisco document which states:

HTTPS forwarding is not supported in this configuration.

Cisco ASA firewall and Cisco Scansafe web URL & content security

jbollinger — Tue, 30 Oct 2012 18:41:27 GMT

This may have been true previously however with the release of ASA version 9.0 there are direct integrations for ScanSafe.

Cisco Cloud Web Security (ScanSafe)

Cisco Cloud Web Security provides content scanning and other malware protection service for web traffic. It can also redirect and report about web traffic based on user identity.

Note Clientless SSL VPN is not supported with Cloud Web Security; be sure to exempt any clientless SSL VPN traffic from the ASA service policy for Cloud Web Security.

http://www.cisco.com/en/US/docs/security/asa/roadmap/asa_new_features.html#wp93103

Cisco ASA firewall and Cisco Scansafe web URL & content security

Marvin Rhoads — Tue, 30 Oct 2012 18:43:35 GMT

Indeed that is one of the several advantages of ASA 9.0.