Ironport S360 with CDA session timeouts???

[Admin Eastland]

Earlier this year we started using CDA for authentication mappings to our Ironport. Apparently the surrogate type we were using was not supported, and CDA was the solution for this.

Every so often I have noticed that if I search for a webpage (say a Cisco support topic) and I navigate to that 443 page it does not load. If I go back and click on some port 80 type page and immediately go back to the 443 page it will load.

It seems as if there is some sort of issue with the authentications/re-authentications for CDA getting passed to the WSA.

Any ideas of how to correct this behavior. Being that this is so random I'm not sure how to isolate it.               

[Vance Kwan]

Based on your description, if the CDA for some reason was querying slow for a user-to-IP mapping, theoretically this makes sense.  But I cannot see why it would matter if it is port 80 or port 443 traffic.  When authentication is needed, there would not be any decryption involved as the WSA would simply query the CDA again to find out who is on a specific IP address.

How often does this occur?  Issues like this can get very difficult to track down, and will likely need a packet capture while the issue is occuring to determine where the slow down is.

-Vance