Cisco Cisco Web Security Appliance S370 Guia Do Utilizador

When a control setting matches Monitor and the transaction is ultimately allowed, 
the Web Proxy logs the monitored setting in the access logs. For example, when 
a URL matches a monitored URL category, the Web Proxy logs the URL category 
in the access logs.

 shows the order that the Web Proxy uses when evaluating 

control settings for Access Policies. The flow diagram shows that the only actions 
applied to a transaction are the final actions: Allow, Block, and Redirect.

 shows the order the Web Proxy uses when evaluating 

control settings for Decryption Policies and 

 shows the 

order when evaluating control settings for IronPort Data Security Policies.

After the Web Proxy assigns an Identity to a client request, the Web Proxy 
evaluates the request against the other policy types to determine which policy 
group it belongs for each type. When the HTTPS Proxy is enabled, it applies 
HTTP and decrypted HTTPS requests against the Access Policies. When HTTPS 
Proxy is not enabled, by default, it evaluates HTTP and all HTTPS requests 
against the Access Policies.

The Web Proxy applies the configured policy control settings to a client request 
based on the client request’s policy group membership.

To determine the policy group that a client request matches, the Web Proxy 
follows a specific process for matching the group membership criteria. During 
this process, it considers the following factors for group membership:

Identity. Each client request either matches an Identity, fails authentication 
and is granted guest access, or fails authentication and gets terminated. For 
more information about evaluating Identity group membership, see 

.

Authorized users. If the assigned Identity requires authentication, the user 
must be in the list of authorized users in the Access Policy group to match the 
policy group. The list of authorized users can be any of the specified groups 
or users or can be guest users if the Identity allows guest access.