Hi Jason, Yes, WSA supports NTLMSSP authentication in transparent proxy mode using WCCP. With the problem you are facing, in most cases the issue is due to client machines cannot resolve the redirect hostname used in the WSA authentication. You will need to modify your DNS record if the redirect hostname is not resolvable by clients. Redirect hostname can be found in the WSA authentication settings.   Hope this helps.   Thanks, Donny (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!) ... View more

Hi, The certificate required in the WSA for HTTPS proxy is root certificate. Please see the previous discussion about the same topic   https://supportforums.cisco.com/discussion/11723386/how-setup-ssl-certificate-ironport-wsa   Thanks, Donny   ... View more

  Hi Habibi, Ultra Surf uses random ports to connect to the Internet where WSA only looking at port 80 and 443. Make sure you block the unused ports in the firewall and block the category Filter Avoidance in the decryption and access policies. Hope this helps.   Regards, Donny   (*If you have received the answer to your original question, and found this helpful/correct - please mark the question as answered, and be sure to leave a rating to reflect!) ... View more

Hi, For Apple devices, you can push the profile with the certifcate too.   Thanks, Donny ... View more

Hello Markus, Glad to know you could find local support to get this issue solved. For sure this information can be used as assistance in case someone else gets into the same problem. Thanks for sharing. Regards, Donny ... View more

Aqeel, The answer to your query will cover a few pages if not more. If you are deploying the S170 for the first time (new purchase), you need to contact your vendor or Cisco partner to provide you with guideline and assistance with the deployment. To start with, some information has to be collected about the users, current infrastructure, etc. in order to help design the security policy in the S170. Regards, Donny ... View more

Hi Faiz, Just on the capacity side, you could have had assistance from your Cisco partner's channel to assist with the measuring parameters to support planning the WSA deployment. Unfortunately, measuring the WSA usage based on number of users may not help much as far as I know, but the number of connections will do. Feel free to reach out to your Cisco contacts for better deployment planning or open a support case with Cisco TAC. Thanks, Donny ... View more

Hi Markus, Can you share the whole access log (there should be more entries) from grep so we can look at the details from all teamviewer traffic? ... View more

Hi, If you are using authentication in your identity, disable authentication and try again. thanks, Donny ... View more

Hi Parosh, The WSA itself does not have the configuration for clustering or active/passive stand-by failover. Depending on your deployment method, there are a number of methods to achive the similar objective from the configuration outside the WSA. In the urgent need of getting the assistance, I suggest you log a case with TAC for quick clarification or contact your Cisco System Engineer, I guess as Cisco Partner you have access to these people. thanks, Donny ... View more

Hi Jernef, Is this a fresh set up or a clone? Does it take any 1 or 3 digit service ID? I cannot reproduce this in my lab box. Thanks, Donny ... View more

Hi Jannis, If you only would like to find the category of multiple URLs in one go so you can then compare to your policy (so you know which one is allowed and which one is blocked), you can use this portal (Cisco CCO ID is required to log in). https://securityhub.cisco.com/web/submit_urls Under Lookup or Submit URLs tab you can enter multiple URLs  and select the AsyncOS version to get their categorizations. On the scripting side, maybe it can be done outside the WSA so your client will send the request of the multiple URLs to the WSA and WSA returns their categories (with block page or response from WSA). Perhaps a scripting master here can add more information to your query. Thanks, Donny ... View more