Cisco Cisco Web Security Appliance S670

• The user enters valid Basic authentication credentials.

In this case, the Basic authentication credentials fail against the NTLM authentication realm. 
The Web Proxy treats the user as someone who has failed authentication and grants the user 
guest access as configured in the identity and access policy groups. The Web Proxy does not 
prompt the user to enter NTLM credentials. 

Workaround: Configure the identity group to use NTLMSSP only or Basic only. [Defect ID: 
46430] 

IronPort data security policies configured to block files based on file size do not block very 
large files, such as greater than 30 MB.

Workaround: Contact Customer Support to change the value of an internal setting. [Defect ID: 
47184] 

The policy trace feature does not display a web reputation score when authentication is 
enabled. [Defect ID: 44031] 

When Firefox version 3 explicitly forwards an HTTPS request, it does not display the website 
correctly when decryption is enabled and the website contains embedded links. This is due to 
stricter certificate trust changes in Firefox version 3. 

Workaround: Install the Web Security appliance root certificate as a trusted authority on all 
instances of Firefox 3. [Defect ID: 44071] 

Internet Explorer prompts for authentication multiple times under the following 
circumstances:

• The Surrogate Timeout global authentication setting is configured, and the Surrogate Type 

is set to cookie. (In explicit forward mode, you can configure the surrogate timeout when 
you enable secure client authentication or from the 

advancedproxyconfig > 

authentication

 CLI command.)

• A user views a file that includes links to objects coming from multiple domains.

• The surrogate used to store the authentication credentials has expired.

Workaround: Enter the user name and password each time, or use Firefox. [Defect ID: 44089]