WSA Virtual Appliance deployment in monitor mode

[mehedimec]

Hi Team,

Our router does not support WCCP and we also do not have L4 switch. We are planning to deploy the WSA virtual appliance as a tapping device in monitoring mode. For that we are considering to mirror our network traffic in a specific port (e.g. 37008) and want WSA will listen on that port. Is it possible to deploy WSA in such way? I do not find any option to mention a listening port in WSA GUI. 

For your information, I just configured it partially from system setup wizard and in the transparent redirection device option (in connection setting) I have selected Layer 4 switch or no device option.

[balaji.bandi]

have you configured we traffic tap settings

check under network --> web traffic tap

enable and select the interface to tap the traffic.

[Ken Stieers]

That's not what the tap does.

The tap lets you send traffic that the WSA gets OUT to another device. That traffic is UNENCRYPTED so that the WSA does decryption and can feed something like a DLP appliance.





Taken from the user guide.


Web Traffic Tap feature allows you to tap the HTTP and HTTPS web traffic that passes through the appliance
and copy it to a Web Security appliance interface in-line with the real time data traffic. You can select the
Web Security appliance interface to which the tapped traffic data is sent. If the tapped traffic includes HTTPS
data, the appliance decrypts them based on the decryption policies before sending them to the tap interface.
See Decryption Policies , on page 216.
The selected tap interface must be directly connected to an external security device for analysis, forensics,

and archiving. Alternatively, it may be connected to a L2 switch on a dedicated VLAN.

[Ken Stieers]

WCCP, Policy Based Routing or explicit forwarding are your only options to get traffic to the WSA.

What firewall are you using?

What router are you using?

[mehedimec]

We are using MikroTik Router and are not currently using any firewall device 

We are deploying the WSA (virtual appliance) for research purpose and our intention is to monitor the inbound and outbound traffic without blocking any malicious or suspicious traffic. Is not there any scope to listen from any specific switch port (port no. 37008) where mirror traffic are sent? if not then what will be the option to send traffic through WSA?