This is not a supported feature. But you might be able to make it work anyways.  It all depends on which version of code you are using.  With the older codes, you would be able to upload the image into the PAC file hosting service on the WSA and use it to serve the image.  The newer codes will only accept a legitimate PAC file into that PAC hosting service.  It will upload just fine but the serving will not work. I recommend you contact Cisco TAC to discuss this further.  They are able to upload the file of your choice into the directory of the default logo so that you can serve it from there.   Your mileage may vary on this as this is not a supported feature. ... View more

I'm not of aware of how to forward it to the security logs.  More so, I am not even 100% sure that it needs to be in the security logs.  Have you tested this?  Is this DC with the centralized repository added currently?  If it is, we should be able to review the logs to see if it got any user mappings from this DC. ... View more

As soon as you enable external authentication, all local accounts will be disabled except for the 'admin' account.  Local accounts will be checked in the event that the external authentication server is down.   ... View more

This is not possible. You can however create policies specific to certain appliances only. ... View more

If you are on version 8.5.X, that version of AsyncOS was overhauled, and a new version of FreeBSD was used (AsyncOS is built on FreeBSD).  8.5.X is using FreeBSD 9.2 for the very first time.  This is an open bug where S160's and S170's took a hit on disk performance (a major one) presumably due to the FreeBSD upgrade. You can either go back to version 8.0.X, or take measures to I/O utilization on the S170 until the bug is fixed.  Increasing auto updates to a higher time value is common (default is 5m.  I recommend 4h or so). It all depends on what you can get away with depending on your traffic load. -Vance ... View more

Just make sure the same features are present when you get the renewal license.  If you get 1 addition feature such as Web Reputation (when you didn't have it before), this can affect the way policies behave. ... View more

If you can forward event ID 4768 into the security events, this will work.  Just add that DC instead of all 50. -Vance ... View more

Not sure this belongs in the Cisco Web Security forums as this pertains to the Cisco Ironport product, as well as Cisco Cloud Web Security.  This will probably get more attention in Firewall forums as the Firewall team supports WCCP on the FW. But many things can go wrong at this point.  It'd probably be best if you started with a packet capture on your Blue Coat to see what it is doing. In the packet capture, you should be looking for 2 things: -TCP 3 way handshake (source IP client, destination IP web server) + HTTP request method/response -TCP 3 way handshake (Blue COAT IP, destination IP webserver) + HTTP request method/response   ... View more

You can block the social networking category, and add the URL to the specific page you want into a custom URL category, and allow that. There are many different ways to achieve this.  It all depends on what you need.   ... View more

The error message is probably correct - You are probably trying to upload a Server Certificate.  You can verify using openssl using the following command:   openssl x509 -noout -text -in <certificate file name>   The x509 constraint should state "CA: TRUE" If it is False or it doesn't show at all, there is the problem.   ... View more

The HTTP 307 redirect is likely coming because you are using authentication.  The way the WSA performs NTLM authentication is to redirect the browser to access the WSA directly, so that NTLM authentication can happen.  Once authenticated, another 307 will redirect it back to the original website. If you are looking for a 100% transparent deployment, you may want to consider deploying the Cisco Context Directory Agent so that the WSA can ask the agent which user is logged onto that IP (instead of doing the NTLM authentication). The term Transparent really just means the browser does not have a proxy setting.   ... View more

Yes - The S160 will run the 8.0.X versions.  Versions 8.0.X are FCS (limited availability).  It's not declared as stable, and is meant more for testing.  If you wish to use it, open up a TAC case and ask them to provision your appliance for that version. ... View more

You can create a sub interface by going to the SSH and using the 'etherconfig' command, and adding a new interface and specify it to use a specific VLAN.  Not sure if it can work for your purposes though. ... View more