Cisco Cisco Web Security Appliance S690 User Guide

Create as few Active Directory realms as is practical. Multiple Active Directory realms require 
additional memory usage for authentication.

If using NTLMSSP, authenticate users using either the Web Security appliance or the upstream 
proxy server, but not both. (Recommend Web Security appliance)

If using Kerberos, authenticate using the Web Security appliance. 

For optimal performance, authenticate clients on the same subnet using a single realm.

Some user agents are known to have issues with machine credentials or authentication failures, 
which can negatively impact normal operations. You should bypass authentication with these user 
agents. See 

. 

Create an authentication realm. 

Configure global authentication settings.

Configure external authentication.

You can authenticate users through an external LDAP or 
RADIUS server.

(Optional) Create and order additional 
authentication realms. 

Create at least one authentication realm for each 
authentication protocol and scheme combination you 
plan to use.

(Optional) Configure credential encryption.

Create Identification Profiles to classify users and client 
software based on authentication requirements.

Create policies to manage Web requests from the 
users and user groups for which you created 
Identification Profiles.