Integration Cisco ASA and Websense DSS for DLP solution

[aliverlex]

Good day!

We have two cisco ASA in active-passive mode as firewall solution between Internet and LAN

ASA connects by two links to Cisco 6506 (central LAN switch)

We want to deploy DLP-solution on Websense DSS. And want to have possibility to block untrusted traffic which goes to internet.

Can we integrate websense DSS with cisco ASA using ICAP? Or with 6506?

Or is there the way to put two websense dss servers to each link from 6506 to ASA only?

Or another solution?

Thanks!

[Jennifer Halim]

Unfortunately Cisco ASA does not support ICAP, and the only integration with Websense that is supported with ASA is Web Filtering (URL Filtering):

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/access_filter.html#wp1045692

BTW, is there a need to actually integrate the Websense DLP solution into ASA as Websense should be providing the block instead of the ASA firewall. Websense being the DLP product should detect and block the outbound traffic accordingly, wouldn't it?

Cisco also has its own DLP solution called Cisco IronPort S-Series Web Security appliance:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps10142/ps10164/data_sheet_c78-586408.html

[aliverlex]

Cisco ASA should have firewall functions such as controlling inbound trafiic, websense dss - only one function - controlling outbound confidential data. It hasn't any firewall inside, as i know. So it can works as monitor (not blocks data) or can block data working "inline" or working through ICAP

If there is one ASA only it possible to "inline" websense between ASA and first corporate switch (6506 in our case)

Question - what to do with two ASA case? Which place in network is the best for dlp appliance in this case? Two dlp appliances? or is there solution with one dlp-appliance only? (two appliances is too expensive for us)

Jennifer, can you explain me some details about cisco ironport s-series. Where in network i should put it? before ASA, parallelly ASA or smwh else?

If we have 2 ASA in cluster, where to put Ironport?

Thanks a lot!

[aliverlex]

One more question about Ironport S-Series.

Is it provides web filtering and DLP-solution for web protocols only? What about E-mail? another protocols like IM?  How to protect by DLP these channels?

Thanks!

[Jennifer Halim]

It should be placed behind the ASA (before the ASA). If your ASA is running in Active/Standby mode, then there is no reason why you can't just have 1 IronPort WSA as web traffic should be redirected towards the WSA first before even hitting the ASA.

WSA only protects web traffic, so to protect email, you will need IronPort ESA.

Here is more information on ESA for your reference:

http://www.ironport.com/resources/appliance_datasheets.html

http://www.cisco.com/en/US/products/ps10339/index.html

It would be best to speak to your local Cisco AM/partner/reseller for the best solution.