Cisco Cisco Web Security Appliance S360 Guía Para Resolver Problemas

Contributed by Vladimir Sousa and Siddharth Rajpathak, Cisco TAC
Engineers.
Aug 12, 2014

How do you block Windows Live Messenger on the Cisco Web Security Appliance?

Cisco Web Security appliance (WSA) running AsyncOS 5.6.x and above, and Windows Live Messenger.

To be able to block Windows Live Messenger on the Cisco Web Security appliance (WSA), we must first
make sure that direct Internet connections from users to external servers over TCP port 1863 are blocked. This
is because Windows Live Messenger will try first to connect using this port, even if Microsoft Internet
Explorer (IE) is explicitly configured to use a proxy.

If Windows Live Messenger is configured to inherit proxy settings from Internet Explorer, then it is possible
to block this connection by matching its request using an HTTP user−agent string "Windows Live Messenger"
and blocking HTTP protocol on the corresponding Access Policy.

Please follow the steps below.

Choose Web Security Manager > Identities and click Add Identity.

Name : Windows Live Messenger
Insert Above : Set to order 1
Define Members by Subnet : Blank or Define a IP address range/subnet
Define Members by Authentication : You may choose to use authentication to be able to log the
requests by username
Advanced : Click Advanced, then click None Selected for User Agents and under Custom User
Agents type: Windows Live Messenger & then click Done

Click Submit to configure this Identity.

1. 

Choose Web Security Manager > Access Policies and click Add Policy.

2.