The document provides an overview of Cisco IronPort Web Security Appliance (WSA) device series specifications, including user capacity and architecture based on AsyncOS. It describes various modes of operation such as explicit and transparent modes, alongside packet flow and policy actions like monitoring, decrypting, and dropping connections. Additionally, it includes an example of log reading, detailing the information captured during a web request cycle.

1. 1
CISCO IRONPORT WSA
(Web Security Appliance)

2. Device Series
• S 170 (Upto 1,500 users)
• S 370 (1,500 – 6,000)
• S 670 (6,000 – 12,000)
• IRONPORT use AsyncOS (FreeBSD Kernel).

3. Architecture
Terms Modes
• Identity
• Policy
• Policy Action
• URL Filtering
• AVS
• Explicit Mode
• Transparent Mode

4. Packet Flow
GET
Request
Check
Identity Policy
Policy
Action
OUTPUT

5. Policy Action
• User Global Setting : Uses the action for this category in the global Decryption
policy group.
• Pass Through: Passes through the connection between the client and the server
without inspecting the traffic content.
• Monitor : The Web Proxy neither allows nor blocks the request. Instead, it
continues to evaluate the client request against other policy group control settings,
such as web reputation filtering.
• Decrypt: Allows the connection, but inspects the traffic content. The appliance
decrypts the traffic and applies Access Policies to the decrypted traffic as if it were
a plaintext HTTP connection.
• Drop: Drop the connection does not pass the connection request to the server.

6. Log Reading
• 1278096903.150 97 172.xx.xx.xx TCP_MISS/200 8187 GET http://my.site.com/ -
DIRECT/my.site.com text/plain DEFAULT_CASE_11-AccessOrDecryptionPolicy-
Identity-OutboundMalwareScanningPolicy-DataSecurityPolicy-ExternalDLPPolicy-
RoutingPolicy <IW_comp,6.9,"Skipped","-",-,-,-,"-","-",-,-,-,"-","-","-","-","-",-,-
,IW_comp,-,"-","-","Unknown","Unknown","-","-",198.34,0,-,"-","-"> -
o 1278096903.150 97 : Time Stamp since UNIX epoch
o 97 : Elapsed time (latency) in milliseconds
o 172.xx.xx.xx : Client IP address
o TCP_MISS : Transactional result code.
o 200 HTTP Response code
o 8187: Response size (Headers + body)
o GET http://my.site.com : First line of request.
o DIRECT/my.site.com : Code that describes which server was contacted for the retrieving
the request content, Types: NONE, DIRECT, DEFAULT PARENT
o Text/plain : Response body MIME Type
o AccessOrDescytptionPolicy : Access or Decryption policy name.

7. Thank You
• Feel free to contact me for any queries.