We are currently using a WSA in Cloud Connector Mode to identity and authenticate users.  We are having significant issues with non-Windows clients.   Our WSA is bound to AD and authenticates users against Active Directory.  Our Mac users log into AD (via Kerberos) and I can see they are properly issued tickets via Kerberos.   However, when they attempt to access the Internet they are prompted for authentication credentials because the WSA in Cloud Connector mode only supports NTLM authentication, not Kerberos.   We would very much like to get SSO working for our non-Windows clients through the WSA.  Any recommendations?   ... View more

We are transitioning from the on-premise Ironports to the WSA + CWS.   On the current Ironports we use several different identities and apply different access polices based off the identity.  For example, some identities are defined by active directory group, IP subnet, etc.  Different rule sets are applied based off which identity is used.  In addition, we also use identities that are established based off a Custom URL list and browser user-agent.   There doesn't seem to be any way in the WSA / CWS to identify and establish a policy based off user-agent or custom URL lists.  While I can create these identities within WSA there doesn't appear to be any means of applying a filter/rule to them.   I would like to be able to define an identity in the WSA and then apply a rule to that identity in CWS.  However, it appears that only IP subnet/address and Active Directory are supported "Who" types in the CWS.   Any recommendations?     ... View more

We have a gateway connected via MGCP for several FXO ports. We use local configuration for when the gateway cannot connect to the CUCM server. When I configure my dial-peer section I've been placing the FXO ports with "service mgcpapp" at the top of the list.  However, after the router downloads its configuration from CUCM it is moving several of these statements to the bottom of the list. Thus, when a new call comes it isn't being sent to CUCM. I've tried erasing and reentering all dial-peer statements a few times (in the correct order) but it just gets reordered later.   Thanks in advance ... View more

Today we brought up a new 7.5 media server and VSOM server (same box, e-series hardware).   We can log into the VSMC without any issues but cannot log into the VSOM server (same server just different URL) under any credentials.   I've tried the supposed default of root/secur4u but that does not work.  I could wipe out the VM and start over (nothing has been configured yet) but I'd like to avoid the time investment to do so only to find out that I'm in the same situation as now.   Any recommendations?   EDIT:  Resolved.  The new default credentials for VSOM 7.5 are 'admin/admin'.   ... View more

We have several systems on our network that utilize a hosted service to check gift card balances, etc.  These devices normally use a custom TCP port to access the hosted server w/o issue. However, occasionally these devices attempt to verify the hosted provider's server's certificate and hit TCP 80 (which we redirect to our Ironport) by sending a request to Verisign's CRL servers.  This causes the Ironport to force an authentication requirement and causes the devices to fail. Has anyone come up with a strat to deal with this?  There are too many addresses within Verisign's CRL server list to add manually (and querying the A records isn't possible). I've tried manually bypassing auth for the following but it still fails 1/2 the time (until the terminal attempts to connect to one of the allowed systems). verisign.com, verisign.com, .verisign.net, verisign.net, 199.7.80.0/24, 199.7.78.0/23, 199.7.48.0/20, 199.7.71.0/24, 199.7.72.0/22, 199.7.76.0/24, 199.16.80.0/20 Any ideas of a better way to approach this? ... View more