WSA S370 SW:7.5

[ibrahim_hassan]

Dears,

         i have S370 with software 7.5 , i created one decryption policy above the global decryption policy that refer to Identity defined with IP addresses.

when the user try to download micosoft updates or Symatec update the site is blocked.

when i made policy trace i found it match on global policy.

note that we are not enable any authentication.

Thanks,

Ibrahim

[Luis Silva Benavides]

Hi Ibrahim,

Certain HTTPS websites / applications will not work when the WSA is using HTTPS decryption. In these cases, the destination will need to be set to HTTPS "Pass Through". This is done via a custom category and HTTPS policy.

Please see the instructions below:

Creating a custom category to match the desired HTTPS site:
1. Go to the GUI -> 'Web Security Manager' -> 'Custom URL Categories' -> 'Add Custom Category...' button.
2. Give the new category a name, such as "HTTPS Passthrough".
3. Under the 'Sites' section, add the website domain / FQDN.

Example:
website.com, .website.com

These two values would include traffic to website.com, a.website.com, www.website.com<http://www.website.com>, so forth.

Setting custom categories to HTTPS Pass through:
The custom category created will need to be appropriately configured in the HTTPS decryption policies.

1. Go to the GUI -> 'Web Security Manager' -> 'Decryption Policies'
2. Click on the 'URL Categories' for the rule you wish to modify.
3. Locate the custom category you wish to modify and set it to 'Pass Through'.

NOTE: You may desire to create a new decryption policy rule at the top of your rules list, instead of modifying the existing policies.


External Link: https://ironport.custhelp.com/app/answers/detail/a_id/1394

Thanks,

Luis Silva

"If you need PDI (Planning, Design, Implement) assistance feel free to reach"

http://www.cisco.com/web/partners/tools/pdihd.html