Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.
One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.
Course Of The Month
1 day, 19 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
web usage reports after PAT to external scansafe web proxy service
Posted on 2012-12-23
Hi We recently put a NAT /PAT inside to outside interface (on ASA firewall) and port 80/http to 8080 port forward -direct to Cisco's scansafe proxy servers IP address on the web.
We have some "exceptions" for http sites we dont want filtered - these are ok and also listed in the ASA firewall
We did this to solve a number of problems
1. Apple IPAD's - wifi - avoid manual proxy in browser
2 avoid manual proxy entry for all different types of browser
basically now proxy config is all in the ASA firewall.
Problem is now that due to the ASA NAT the scansafe reports show only the "outside" IP as the no1 user - basically the only user. - so now i cant get meaningful web usage reports.
Before with proxy ticked in users client browser - THe reports showed individual usage.
I want to keep what we have done on the ASA - I dont want to do a PAC file etc.
Does anyone know how I can go about getting the Scansafe to show individual web usage again? - something i can do on ASA?
Thanks
We have some "exceptions" for http sites we dont want filtered - these are ok and also listed in the ASA firewall
We did this to solve a number of problems
1. Apple IPAD's - wifi - avoid manual proxy in browser
2 avoid manual proxy entry for all different types of browser
basically now proxy config is all in the ASA firewall.
Problem is now that due to the ASA NAT the scansafe reports show only the "outside" IP as the no1 user - basically the only user. - so now i cant get meaningful web usage reports.
Before with proxy ticked in users client browser - THe reports showed individual usage.
I want to keep what we have done on the ASA - I dont want to do a PAC file etc.
Does anyone know how I can go about getting the Scansafe to show individual web usage again? - something i can do on ASA?
Thanks
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
1 Comment
Active today
looks similar to this issue raised
using syslog and do manual mapping - doesnt seems operationally friendly
https://supportforums.cisco.com/message/194755#194755
"Another way might be to add an access-list on the inside interface and add logging to " ip any any " which would be logged to the syslog server. But this might cause a lot of traffic for the syslog server."
also saw in scansafe help doc stating below
https://scancenter.scansafe.com/portal/static/help/ScanCenterHelp/WSAAP3.html
(in case you need) online help - https://scancenter.scansafe.com/portal/static/help/ScanCenterHelp/
"Cisco ASA 5500 Series Adaptive Security Appliances with version 8.3 or later of the operating system can be configured to enable user names, internal IPs, and domain groups to be sent via PIM to Cisco Cloud Web Security without needing to make end-user changes. There are several ways to achieve this but Cisco recommends using explicit proxy, PAC file or WPAD."
using syslog and do manual mapping - doesnt seems operationally friendly
https://supportforums.cisco.com/message/194755#194755
"Another way might be to add an access-list on the inside interface and add logging to " ip any any " which would be logged to the syslog server. But this might cause a lot of traffic for the syslog server."
also saw in scansafe help doc stating below
https://scancenter.scansafe.com/portal/static/help/ScanCenterHelp/WSAAP3.html
(in case you need) online help - https://scancenter.scansafe.com/portal/static/help/ScanCenterHelp/
"Cisco ASA 5500 Series Adaptive Security Appliances with version 8.3 or later of the operating system can be configured to enable user names, internal IPs, and domain groups to be sent via PIM to Cisco Cloud Web Security without needing to make end-user changes. There are several ways to achieve this but Cisco recommends using explicit proxy, PAC file or WPAD."
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Powerful tools can do wonders, but only in the right hands. Nowhere is this more obvious than with the cloud.
Both in life and business – not all partnerships are created equal.
As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’
As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses
Course of the Month1 day, 19 hours left to enroll
717 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.