Cisco Cisco Web Security Appliance S690 User Guide

After the Web Proxy assigns an Identity to a client request, it evaluates the request against the other 
policy types to determine which policy group it belongs for each type. Any request that does not get 
terminated due to failed authentication gets evaluated against the Routing Policies to determine from 
where to fetch the data.

Once the Web Proxy assigns a Routing Policy group to a request, it fetches the content from the location 
configured for the policy group, either from a configured proxy group or directly from the server.

To determine the policy group that a client request matches, the Web Proxy follows a specific process 
for matching the group membership criteria. During this process, it considers the following factors for 
group membership:

Identity. Each client request either matches an Identity, fails authentication and is granted guest 
access, or fails authentication and gets terminated. For more information about evaluating Identity 
group membership, see 

Authorized users. If the assigned Identity requires authentication, the user must be in the list of 
authorized users in the Routing Policy group to match the policy group.

Advanced options. You can configure several advanced options for Routing Policy group 
membership. Some options (such as proxy port and URL category) can also be defined within the 
Identity. When an advanced option is configured in the Identity, it is not configurable in the Routing 
Policy group level.

The information in this section gives an overview of how the appliance matches client requests to 
Routing Policy groups. For more details about exactly how the appliance matches client requests, see 

The Web Proxy sequentially reads through each policy group in the policies table. It compares the client 
request status to the membership criteria of the first policy group. If they match, the Web Proxy applies 
the policy settings of that policy group.

If they do not match, the Web Proxy compares the client request to the next policy group. It continues 
this process until it matches the client request to a user defined policy group. If it does not match a user 
defined policy group, it matches the global policy group. When the Web Proxy matches the client request 
to a policy group or the global policy group, it applies the policy settings of that policy group.

 shows how the Web Proxy evaluates a client request against the Routing Policy 

groups.