User Guide for Asyncos 12.0 for Cisco Web Security Appliances - GD (General Deployment)
Total Page：16
File Type：pdf, Size：1020Kb
User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) First Published: 2020-01-15 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version. Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) © 2020 Cisco Systems, Inc. All rights reserved. CONTENTS CHAPTER 1 Introduction to the Product and the Release 1 Introduction to the Web Security Appliance 1 What’s New in AsyncOS 12.0 1 Related Topics 2 Using the Appliance Web Interface 2 Web Interface Browser Requirements 2 Enabling Access to the Web Interface on Virtual Appliances 3 Accessing the Appliance Web Interface 4 Committing Changes in the Web Interface 5 Clearing Changes in the Web Interface 5 Supported Languages 6 The Cisco SensorBase Network 6 SensorBase Benefits and Privacy 6 Enabling Participation in The Cisco SensorBase Network 7 CHAPTER 2 Connect, Install, and Configure 9 Overview of Connect, Install, and Configure 9 Comparison of Modes of Operation 10 Task Overview for Connecting, Installing, and Configuring 13 Connecting the Appliance 13 Gathering Setup Information 15 System Setup Wizard 17 System Setup Wizard Reference Information 18 Network / System Settings 18 Network / Network Context 19 Network / Cloud Connector Settings 20 User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) iii Contents Network / Network Interfaces and Wiring 20 Network / Layer 4 Traffic Monitor Wiring 21 Network / Routes for Management and Data Traffic 21 Network / Transparent Connection Settings 21 Network /Administrative Settings 22 Security / Security Settings 23 Upstream Proxies 23 Upstream Proxies Task Overview 24 Creating Proxy Groups for Upstream Proxies 24 Network Interfaces 25 IP Address Versions 25 Enabling or Changing Network Interfaces 26 Configuring Failover Groups for High Availability 27 Add Failover Group 28 Edit High Availability Global Settings 29 View Status of Failover Groups 29 Using the P2 Data Interface for Web Proxy Data 29 Configuring TCP/IP Traffic Routes 30 Outbound Services Traffic 31 Modifying the Default Route 32 Adding a Route 32 Saving and Loading Routing Tables 32 Deleting a Route 32 Configuring Transparent Redirection 33 Specifying a Transparent Redirection Device 33 Using An L4 Switch 33 Configuring WCCP Services 34 Increasing Interface Capacity Using VLANs 38 Configuring and Managing VLANs 38 Redirect Hostname and System Hostname 40 Changing the Redirect Hostname 41 Changing the System Hostname 41 Configuring SMTP Relay Host Settings 41 Configuring an SMTP Relay Host 42 User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) iv Contents DNS Settings 42 Split DNS 42 Clearing the DNS Cache 43 Editing DNS Settings 43 Troubleshooting Connect, Install, and Configure 44 CHAPTER 3 Connect the Appliance to a Cisco Cloud Web Security Proxy 45 How to Configure and Use Features in Cloud Connector Mode 45 Deployment in Cloud Connector Mode 45 Configuring the Cloud Connector 46 Controlling Web Access Using Directory Groups in the Cloud 49 Bypassing the Cloud Proxy Server 49 Partial Support for FTP and HTTPS in Cloud Connector Mode 49 Preventing Loss of Secure Data 50 Viewing Group and User Names and IP Addresses 50 Subscribing to Cloud Connector Logs 50 Identification Profiles and Authentication with Cloud Web Security Connector 51 Identifying Machines for Policy Application 51 Guest Access for Unauthenticated Users 52 CHAPTER 4 Intercepting Web Requests 53 Overview of Intercepting Web Requests 53 Tasks for Intercepting Web Requests 53 Best Practices for Intercepting Web Requests 54 Web Proxy Options for Intercepting Web Requests 55 Configuring Web Proxy Settings 55 Web Proxy Cache 57 Clearing the Web Proxy Cache 58 Removing URLs from the Web Proxy Cache 58 Specifying Domains or URLs that the Web Proxy never Caches 58 Choosing The Web Proxy Cache Mode 59 Web Proxy IP Spoofing 60 Web Proxy Custom Headers 61 Adding Custom Headers To Web Requests 61 User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) v Contents Web Proxy Bypassing 62 Web Proxy Bypassing for Web Requests 62 Configuring Web Proxy Bypassing for Web Requests 62 Configuring Web Proxy Bypassing for Applications 62 Web Proxy Usage Agreement 63 Domain Map 63 Domain Map for Specific Applications 63 Client Options for Redirecting Web Requests 65 Using PAC Files with Client Applications 65 Options For Publishing Proxy Auto-Config (PAC) Files 65 Client Options For Finding Proxy Auto-Config (PAC) Files 66 Automatic PAC File Detection 66 Hosting PAC Files on the Web Security Appliance 66 Specifying PAC Files in Client Applications 67 Configuring a PAC File Location Manually in Clients 67 Detecting the PAC File Automatically in Clients 68 FTP Proxy Services 68 Overview of FTP Proxy Services 68 Enabling and Configuring the FTP Proxy 68 SOCKS Proxy Services 70 Overview of SOCKS Proxy Services 70 Enabling Processing of SOCKS Traffic 70 Configuring the SOCKS Proxy 71 Creating SOCKS Policies 71 Troubleshooting Intercepting Requests 72 CHAPTER 5 Acquire End-User Credentials 73 Overview of Acquire End-User Credentials 73 Authentication Task Overview 73 Authentication Best Practices 74 Authentication Planning 74 Active Directory/Kerberos 75 Active Directory/Basic 76 Active Directory/NTLMSSP 77 User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) vi Contents LDAP/Basic 77 Identifying Users Transparently 78 Understanding Transparent User Identification 78 Rules and Guidelines for Transparent User Identification 80 Configuring Transparent User Identification 81 Using the CLI to Configure Advanced Transparent User Identification Settings 81 Configuring Single-Sign-on 82 Creating a Service Account in Windows Active Directory for Kerberos Authentication in High Availability Deployments 82 Authentication Realms 84 External Authentication 84 Configuring External Authentication through an LDAP Server 85 Enabling RADIUS External Authentication 85 Creating an Active Directory Realm for Kerberos Authentication Scheme 85 How to Create an Active Directory Authentication Realm (NTLMSSP and Basic) 89 Prerequisites for Creating an Active Directory Authentication Realm (NTLMSSP and Basic) 89 About Using Multiple NTLM Realms and Domains 89 Creating an Active Directory Authentication Realm (NTLMSSP and Basic) 89 Creating an LDAP Authentication Realm 91 Using Multiple NTLM Realms and Domains 96 About Deleting Authentication Realms 96 Configuring Global Authentication Settings 96 Authentication Sequences 101 About Authentication Sequences 101 Creating Authentication Sequences 102 Editing And Reordering Authentication Sequences 103 Deleting Authentication Sequences 103 Failed Authentication 103 About Failed Authentication