The Email Security appliance connects to the Cisco Aggregator Server every 30 minutes (non-configurable),
either directly or through a web proxy, using the port specified for URL filtering services
from Cisco Aggregator Server it obtains web interaction tracking data.
You have to check on the firewall policies and allow aggregator.cisco.com on port no 443
Problem will be solved