Cisco ASA firewall and Cisco Scansafe web URL & content security scanning

[david.tran]

I have a requirements to provide wireless access for visitors who visit the companies for a few days.  These guest users will be able to browse the Internet and VPN back into their corporate securely with their own laptops, Ipad, etc...

One of the requirements is that I need to be able to control ther Internet usage and make sure whatever they download can be safely scanned through a cloud service from Cisco called scansafe.  I am thinking of using Cisco ASA firewalls to accomplish this task. 

I am getting conflicting information.  According to this documentation, Cisco ASA and scansafe only works for http but not https: 

http://www.novanet.se/ScanSafe_ASA_WiFi_Config.pdf

However, another documentation states that Cisco IOS routers and scansafe work with both http and https: 

http://www.networkworld.com/community/blog/tutorial-cisco-routers-add-web-security-cisco

does it mean that by choosing to go with ASA, http(s) will not be available with scansafe?

Thanks,

[Marvin Rhoads]

To use scansafe with https you need to be able to terminate and proxy and re-establish the clients' https requests.  That's a bit beyond the scope of capability of the ASA and requires you implement a full proxy like the Ironport WSA (or a Bluecoat Proxy SG) as the WCCP destination..

Note this Cisco document which states:

HTTPS forwarding is not supported in this configuration.

[jbollinger]

This may have been true previously however with the release of ASA version 9.0 there are direct integrations for ScanSafe.

Cisco Cloud Web Security (ScanSafe)

Cisco Cloud Web Security provides content scanning and other malware  protection service for web traffic. It can also redirect and report  about web traffic based on user identity. Note Clientless  SSL VPN is not supported with Cloud Web Security; be sure to exempt any  clientless SSL VPN traffic from the ASA service policy for Cloud Web  Security.

http://www.cisco.com/en/US/docs/security/asa/roadmap/asa_new_features.html#wp93103

[Marvin Rhoads]

Indeed that is one of the several advantages of ASA 9.0.