Mobile Web Security

[Steven Williams]

What is the piece of the WSA product that allows my mobile clients to be monitored and protected from the web threats when not on the local network? Is it just WSA cloud security?

How does this work? Do I push my local network WSA policy to a web based controller to replicate my organization policy and they sync to the cloud for it?

[Ken Stieers]

You can get mobile clients covered a couple of ways:

1. in a 'hybrid' mode, where you put the web client module on them (part of Anyconnect), which redirects traffic to the Cisco Cloud Web Security.  There is a seperate license for this.

2. When vpn'd in via Anyconnect, you can tell the ASA to change the client's proxy settings to go to the WSA and they'll use the WSA's explicit mode to get filtered (explicit mode is always enabled on a WSA, even if you're using WCCP...)  This doesn't cover then when they aren't VPN'd in...

[Steven Williams]

So we cant "make" mobile users use the VPN, so we need to make sure when they are not on VPN they are protected.

[Ken Stieers]

Hybrid mode then...

We've played with the "Start Before Login" stuff in Anyconnect but we haven't forced it either...

[Steven Williams]

We thought about it but eventually feel that Microsoft Direct Access will drive that "always on the network" feature for our mobile clients.