Cisco Cisco Web Security Appliance S170 Guía Del Usuario
A-6
AsyncOS 9.2 for Cisco Web Security Appliances User Guide
Appendix A Troubleshooting
HTTPS/Decryption/Certificate Problems
HTTPS/Decryption/Certificate Problems
•
•
•
•
•
•
Also see:
–
–
Accessing HTTPS Sites Using Routing Policies with URL Category Criteria
For transparently redirected HTTPS requests, the Web Proxy must contact the destination server to
determine the server name and therefore the URL category in which it belongs. Due to this, when the
Web Proxy evaluates Routing Policy Group membership, it cannot yet know the URL category of an
HTTPS request because it has not yet contacted the destination server. If the Web Proxy does not know
the URL category, it cannot match the transparent HTTPS request to a Routing Policy that uses a URL
category as membership criteria.
determine the server name and therefore the URL category in which it belongs. Due to this, when the
Web Proxy evaluates Routing Policy Group membership, it cannot yet know the URL category of an
HTTPS request because it has not yet contacted the destination server. If the Web Proxy does not know
the URL category, it cannot match the transparent HTTPS request to a Routing Policy that uses a URL
category as membership criteria.
As a result, transparently redirected HTTPS transactions only match Routing Policies that do not
define Routing Policy Group membership criteria by URL category. If all user-defined Routing Policies
define their membership by URL category, transparent HTTPS transactions match the Default Routing
Policy Group.
define Routing Policy Group membership criteria by URL category. If all user-defined Routing Policies
define their membership by URL category, transparent HTTPS transactions match the Default Routing
Policy Group.
HTTPS Request Failures
•
•
HTTPS with IP-based Surrogates and Transparent Requests
If the HTTPS request comes from a client that does not have authentication information available from
an earlier HTTP request, AsyncOS either fails the HTTPS request or decrypts the HTTPS request in
order to authenticate the user, depending on how you configure the HTTPS Proxy. Use the HTTPS
Transparent Request setting on the Security Services > HTTPS Proxy page to define this behavior. Refer
to the Enabling HTTPS Proxy section in Decryption Policies chapter.
an earlier HTTP request, AsyncOS either fails the HTTPS request or decrypts the HTTPS request in
order to authenticate the user, depending on how you configure the HTTPS Proxy. Use the HTTPS
Transparent Request setting on the Security Services > HTTPS Proxy page to define this behavior. Refer
to the Enabling HTTPS Proxy section in Decryption Policies chapter.
Different Client “Hello” Behavior for Custom and Default Categories
When scanning packet captures, you may notice that the “Client Hello” handshake is sent at different
times for custom category and default (Web) category HTTPS Decryption pass-through policies.
times for custom category and default (Web) category HTTPS Decryption pass-through policies.