The subnets can be consolidated if they are adjacent... it will take CIDR notation. You may want to figure out why each subnet needs to exempted from auth... You can also decide not to do auth on other criteria, it may make sense to not auth certain sites, or certain user agents... ... View more

12.x is stable... I concur with Dennis' assessment of the SMA, don't go if you don't have to... Ken ... View more

Yes. You have "incoming relays". That relay needs to save the originating address to a header, then you tell the ESA which header that is... Go to Network/Incoming Relay, and set them up there. You can tell it what header to look in specifically or where in the list of headers to start... Online help has info too... ... View more

Https dns traffic is still port 53, isnt it? Possibly just add that to the wccp and proxy config? ... View more

We used the defaults(90/50), but also quarantine all "Marketing" and "Bulk" as defined by the Graymail filters... I'd have to go do some analysis, but the stuff that's missed by the "spam" definition is probably getting caught by that... Ken ... View more

Are you pulling all of that out of the api, or are you keeping data and building historical stats? ... View more

Umbrella uses Anyconnect's "Trusted Network" definition/detection. I suspect that the CWS/Scansafe client does too... ... View more

I would leave the default log in place and then build a second log subscription that gets sent to syslog. I'd have to test it, but my assumption would be that if you send to syslog, the log doesn't stay around for the SMA to pick it up. ... View more

No, not really.   The new gui is on a different web server than the old gui, but since they want both to be available they can't be on the same ports, and they decided the new gui would be accessed through the "system" name, no matter what you put on the interface.    Trailblazer basically puts a proxy in the middle so the names all get straightened out but they picked a DIFFERENT port (4431)...    Hopefully when they abandon the legacy interface this should get straightened out...    ... View more

So, the ESA is basically using a tweaked version of OpenSSL, and the config is using OpenSSL cipher strings.  Based on your document, something like this:   TLS1.2:SHA256:SHA384:!MD5:!NULL:!EXPORT:!DES:!3DES:@STRENGTH   might get you close with out having to acutally spell our that list of ciphers.     https://www.openssl.org/docs/man1.0.2/man1/ciphers.html   download a copy of openssl, run the following command to see what pops out:   openssl -ciphers TLS1.2:SHA256:SHA384:!MD5:!NULL:!EXPORT:!DES:!3DES:@STRENGTH ... View more

You're talking about spoofing: Here's a whitepaper on ways to address this. https://www.cisco.com/c/en/us/products/collateral/security/email-security-appliance/whitepaper_C11-737596.html ... View more

I don't have any syslog pushes, so I don't see anything in my system logs... so maybe? Do you have the option to rollover a syslog push? That might kick it? Otherwise maybe a packet capture? ... View more