Migration from Proxy Blue Coat to Cisco WSA S395

[ezzaariyouness]

I'm working on Migration from Proxy Blue Coat to Cisco WSA S395 .

I'm looking if there is A migration Tools for that or some steps or methodologies  that can help me on that .

Thank You in advanced .

Best Regards

Younes 

[amojarra · Accepted solution]

Hi @ezzaariyouness 

There is no migration tools or convertor ( at least good one), you can use some WSA's API but in general it is best to do it manually, 

Also there are some logic deferences between BlueCoat and WSA, like in ID profile, which we usually go with IP address and define the Usernames or groups in Access/Decryption policy.

Maybe you are already aware of this guide, just in case please allow me to share it: 

https://www.cisco.com/c/en/us/support/docs/security/secure-web-appliance/220375-use-secure-web-appliance-best-practices.html

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[ezzaariyouness]

Ok thank You, @amojarra 

[fw_mon · Accepted solution]

Hello @ezzaariyouness 

I've done a couple such migrations, there are no policy convertion tools AFAIK. Be ready to simplify your BlueCoat policy because WSA doesn't support multiple Web Access Layers and work based on "First Match Wins" principle. Also all your Deny-actions will be final (force_deny) with no way to allow them after the first match. Beware of best practices limitation - it is better to use no more than 20-40 policies. From the other side it is a good way to get rid of all your old objects and rules and modernize the web protection policy.

[ezzaariyouness]

Thank You for your explanation.