Cisco WSA S300V not blocking Google and Google based applications

[sundarajay16]

Hi,

I've blocked Google and Google based websites in the Cisco Iron port WSA S300V for the users whom I don't want them to access. But still, Google, YouTube, Gmail, Google maps, Google Drive, etc., are allowed by the WSA S300V. Can anyone shed some light about this issue.

Note:I've blocked them via application filtering as well as Web filtering.

Thanks,

Ajay Sundar

[Jernej Vodopivec]

Hi Ajay,

you mentioned that you defined policy "for some" users. Maybe the problem is particular user don't hit the right policy.

I'd first check in tracking logs which policy did user hit when he/she opened google.com.

If user hit the right policy where google is blocked then you should investigate content rules and if user didn't hit the right policy then you should investigate the identity policy issue.

You can also run simulation with Policy Trace Tool which identity policy would hit and which access policy would hit particular connection to get better view what's happening (under system administration menu in ESA).

Did you find the reason why access to gooogle etc pages are not blocked?

[sundarajay16]

Hi Jernej,

Thank you for your reply. Since the websites like Google, YouTube, Gmail, etc, were https websites, they're not blocked in the access policy. The same is getting blocked after I created a decryption policy.

Thanks,

Ajay Sundar.N

[Jernej Vodopivec]

Hi Ajay, now we know what is the issue :)

HTTPS decryption definitely helps to make life easier for you if you want to use these features. And it also helps you to define policy for micro apps, scan HTTPS content with AV etc.

But you should also be able to block google.com by using custom URL categories without HTTPS decryption.

For example:

- create customer URL policy: "blockGoogle"

- add one entry: ".google.com"

- define BLOCK action at access policy

Have you succeeded to block google.com without using HTTPS decryption?

[sundarajay16]

Hi Jernej,

Yep, I had defined a custom URL category for Google.com, youtube.com, etc. Yet the websites were working in https. So, I made a decryption policy which resulted the blocking of those websites.

[mplaksin0]

Try to make a policy trace and look the results (system administration --> policy trace).

But i think that you are having a problem with the decription policies.

[Raadr]

The key is to put "." as well.

Block ".google.com" and "google.com" both and enable decryption as well for this policy.