Cisco Cisco Web Security Appliance S670 User Guide

For descriptions of these fields, see 

.

For configuration instructions, see 

 and 

Also see:

 

KerbTray or klist (both part of the Windows Server Resources Kit) for viewing and purging a Kerberos 
ticket cache. 

 for viewing and editing an Active directory. Wireshark is a 

packet analyzer you can use for network troubleshooting.

When certain user agents or applications fail to authenticate and are denied access, they repeatedly send 
requests to the Web Security appliance, which in turn repeatedly sends requests to the Active Directory 
servers with machine credentials, sometimes to the point of impacting normal operations. 

For best results, bypass authentication with these user agents. See 

. 

LDAP servers do not support NTLMSSP. Some client applications, such as Internet Explorer, always 
choose NTLMSSP when given a choice between NTLMSSP and Basic. When all of the following 
conditions are true, the user will fail authentication: