Deploying Web Security (2012 San Diego)

For Your Reference There are (many...) slides in your print-outs that will not be presented. They are there “For your Reference” For Your Reference BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 3

Angel “Aloisius” Some slides have this friendly guy in the right corner Those slides are meant to be non-standard advices BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 4

Agenda Overview Web Security Web Security with Cisco Ironport Web Security ‒ Critical Functionalities ‒ Places in the Network ‒ Authentication Web Security with Cisco Scansafe ‒ Critical Functionalities ‒ Places in the Network ‒ Authentication The Road to Hybrid Security BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 5

Cisco Web Security Appliance Web Proxy incl. Caching (http,https, ftp, ftp over http) Rich security functionalities Reputation filtering Malware scanning URL Filtering Application visibility & control HTTPS inspection Authentication Reporting and tracking L4TM ...more to come! BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 10

Web Application Control Many Applications work on top of HTTP traffic Applications are detected and controlled by special Signatures Those Signatures are downloaded dynamically via regular Signature Updates from Cisco No reboot or manual installation required! BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

About Reputation Cisco SIO gathers statistical informations from Cisco Products and other resources Cisco SIO correlates informations Updated informations are delivered back to appliances Each IP / URL gets a score, ranging from -10 to +10 External Outbreak Intelligence feeds Web Email ASA IPS BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 12

About Reputation Malicious websites are tracked globally through SIO WSA evaluates each webrequest against the defined reputation score Reputation score and action is configured on WSA BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

Network Participation Admin can define the level of participation Requested URL with result is sent back User information and internal networks are not sent Disabled: No information is sent to Cisco SIO Database Limited: Server URL of request, hash of path segments Standard: Server URL and all path segments are sent back BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

Explicit Proxy Client requests a website Browser connects first to WSA WSA connects to website Firewall usually only allows webtraffic for proxy Web Security Appliance Internet Web server Internet ASA 5500 Firewall BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

How does the Browser find the Proxy? Automatic Configuration via PAC File function FindProxyForURL(url, host) { return "PROXY 192.168.1.80:3128"; } function FindProxyForURL(url, host) { return "PROXY 192.168.1.80:3128; 192.168.1.81:3128"; } http://www.findproxyforurl.com/ BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

WPAD Server WPAD Server hosts PAC file as wpad.dat File is retrieved via HTTP and Javascript „Automatic Settings“ creates a lookup on a server called „wpad“ BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

WPAD and Windows 2008 Starting with W2008 DNS Server, its no longer availible to name a specific Server to „WPAD“ Locked down via Registry More details found here: http://technet.microsoft.com/en-us/library/cc441517.aspx BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 23

Explicit Deployment - Summary Requires Client Settings in the Browser Proxy resolves hostname of target web server Redundancy can be achieved via PAC files ‒ WSA can host PAC files No involvement of network equipment necessary BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

Transparent Proxy via WCCP Client requests a website Browser tries to connect to Website Network Device redirects traffic to WSA using WCCP WSA proxies the request Web Security Appliance Internet Web server Internet ASA 5500 Firewall BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 25

Background on WCCP WCCPv1 developed in 1997 by Cisco Systems and publicly released in July 2000 WCCPv2 published as an IETF draft in July 2000 to make the specification open and remove the requirement for licensing ‒ Enhancements Configurable WCCP Router ID WCCP Variable Timers – Improved Failover Improved Interaction between WCCP and NetFlow WCCPv3 is an internal specification targeted at IPv6 that was never released BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

Details AssignmentThe WCCP assignment method is used to determine which WCCP traffic and which WCCP device is chosen for the destination traffic.WCCP can use two types of Assignment Methods: Hash and Mask. Hash Based Assignment Uses a software based hash algorithm to determine which WCCP appliance receives traffic. In hardware based platforms the Netflow table is used to apply hardware assistance. Mask Based Assignment Uses the ACL TCAM to assign WCCP entities. This method is fully handled by hardware. BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

Gory Details for HASH and MASK For Your Reference Hash - Combines packet’s src/dest IP addrs and src/dest ports into 8-bit value. Complex function: The first packet must be sent to software, a Netflow entry is then created for subsequent packet rewrite Mask – Selects up to 7 bits from src/dest IP addrs and src/dest ports. With this mode, the ACL TCAM can be programmed immediately and the first packet can then be hardware switched. Hash table and Mask/value sets are supplied by the WCCP client to the router HASHING MASKING XOR (IP_DA IP_DA IP_SA L4_proto port_DA port_SA WSA1 0…011 0…...0 1……….1 1.……….1 0..……..0 IP_SA WSA2 xxxx00 xxxx TCP 80 xxxx WSA1 port_DA Hash WSA3 xxxx01 xxxx TCP 80 xxxx WSA2 WSA4 xxxx10 xxxx TCP 80 xxxx WSA3 port_SA) index xxxx11 xxxx TCP 80 xxxx WSA4 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 28

DetailsRedirect and Return Redirect Method ‒ WCCP GRE - Entire packet WCCP GRE tunneled to the WCCP Client (WSA, Cache,…) ‒ Layer 2 - Frame MAC address rewritten to MAC of WCCP Client Return Method The Return method determines how the traffic will be sent back from the router to the WCCP appliance if the traffic could not be serviced. Referred to as “Proxy Bypass” ‒ WCCP GRE – Packet WCCP GRE returned router ‒ WCCP Layer 2 – Frame rewritten to router MAC BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

How WCCP registration works 1. Registration 2. „Here I am“ 3. „I see you“ WCCP Server WCCP Client The WCCP client registers at the WCCP Server Both, Server and Client need to use the same WCCP Service Group ID One WCCP Server usually can server multiple Clients Server and Client exchange „here i am“ and „I see you“ Packets to check availability UDP/2048, unicast Multicast possible Traffic is redirected from Server to one or multiple Clients using the „hash“ or „mask“ algorithm BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 32

WCCP Protocol  When a WCCP client fails, the portion of the load handled by that client is automatically redistributed to the remaining WCCP clients in the service group  If no other WCCP clients are available in the service group, the service group is taken offline and packets are forwarded normally Buckets 86–128 Buckets 129–170 Buckets 1–85 Buckets 86–170 Buckets 171–255 A B X C BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 33

Using WCCP for Traffic Redirection WCCPv2 support is availible on many Cisco Platforms: L3 Switches, Routers, ASA 5500 Security Appliance Cisco Ironport WSA supports all redirect and assign methods (software implementation) Method to use will be negotiated BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 34

Using WCCP for Traffic Redirection (2)Performance Considerations: MASK (HW) > HASH (SW) L2 (HW) > GRE (SW) Use GRE if WSA is located in other subnet Check if Device can do GRE in HW User L2 if WSA and WCCP Device are in same subnet BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 35

WCCP ProtocolService Group The routers/switches and WCCP clients participating in a WCCP service constitute a Service Group Up to 32 routers per service group Up to 32 WCCP clients per service group Each service group is established and maintained using separate protocol message exchanges Service definition must be the same for all members of the service group BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

Current (Cisco) Service GroupsID Product Name Protocol Port0 ACNS web-cache 6 8053 ACNS DNS 17 5360 ACNS ftp 6 2161 WAAS tcp-promiscuous 6 062 WAAS tcp-promiscuous 6 070 ACNS https-cache 6 44380 ACNS rtsp 6 55481/82 ACNS wmt 6 (81), 17(82) 175583 ACNS rtspu 6 55489 WAFS cifs-cache 6 139, 44590-97 ACNS custom 6 User Defined98 ACNS custom-web-cache 6 User Defined99 ACNS reverse-proxy 6 80 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 37

WCCP with L3 Switch (3560/3750)L2 Redirect Internet sdm prefer routing ip routing ip wccp 91 redirect-list wsa VLAN10 ip access-list extended wsa permit tcp any any eq www permit tcp any any eq 443 ! VLAN10 Interface Vlan10 ip address 172.16.10.10 255.255.255.0 ip wccp 91 redirect in BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

WCCP with L3 Switch (3560/3750)L2 Redirect Internet  Recommendations: Assign seperate VLAN for the connection to the WSA!  Redirect ACL only allows „permit“ VLAN40 statements on 3560/3750 Series! No easy way to exclude WSA from redirect looping... VLAN10  If 3560/3750 is stacked, configure WCCP on the Stack Master! BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 39

WCCP with L3 SwitchL2 Redirect - Verificationmunlab-3560X#show ip wccp 91 detailWCCP Client information: WCCP Client ID: 172.16.10.100 Protocol Version: 2.0 Version & State State: Usable Redirection: L2 Packet Return: L2 Assignment Packets Redirected: 0 Method Connect Time: 01:02:16 Assignment: MASK Assignment Mask SrcAddr DstAddr SrcPort DstPort Method ---- ------- ------- ------- ------- 0000: 0x00000000 0x00000526 0x0000 0x0000 Value SrcAddr DstAddr SrcPort DstPort CE-IP ----- ------- ------- ------- ------- ----- 0000: 0x00000000 0x00000000 0x0000 0x0000 0xAC100A64 (172.16.10.100) 0001: 0x00000000 0x00000002 0x0000 0x0000 0xAC100A64 (172.16.10.100) 0002: 0x00000000 0x00000004 0x0000 0x0000 0xAC100A64 (172.16.10.100) BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

WCCP with L3 Switch (CAT6500) L2 or GRE Redirect WAN CAT6500 with Sup2T/720/32 and PFC3 allows r1 r2 redirect of L2 and GRE in Hardware Si Si Redirect-in and Redirect-out is supported Permit and Deny ACE is allowed Very scalable and flexible WAN r1 Si Si r2 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 41

WCCP with L3 Switch (CAT6500) L2 or GRE Redirect Ingress - L2 redirection + Hash Assignment (Requires Software Processing) Ingress - L2 redirection + Mask Assignment (Full Hardware Processing - recommended) Egress - L2 redirection + Hash Assignment (Requires Software Processing) Egress - L2 redirection + Mask Assignment (Requires Software Processing) First packet is process switched, creates netflow entry. Subsequent packets are HW switched Ingress - L3 (GRE) redirection + Hash Assignment (Requires Software Processing) Ingress - L3 (GRE) redirection + Mask Assignment (Full HW Processing - Sup32/Sup720 only) Egress - L3 (GRE) redirection + Hash Assignment (Requires Software Processing) Egress - L3 (GRE) redirection + Mask Assignment (Requires Software Processing) BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

WCCP with ASA  ASA allows only „redirect in“ Client and WSA must be on same interface No DMZ Deployment possible.... Internet  Inside ACL is checked before redirection Destination Server must be allowed in ACL  Redirection Method is GRE based  Redirect ACL allows permit and deny  No TCP Intercept, Inspect Engine or internal IPS is applied to the redirected flow.  IPS HW Module however does inspect trafficaccess-list WCCPRedirectionList extended deny ip 172.16.10.0255.255.255.0 172.16.10.0 255.255.255.0access-list WCCPRedirectionList extended permit tcp any any eq wwwaccess-list WCCPRedirectionList extended permit tcp any any eq https!wccp 90 redirect-list WCCPRedirectionListwccp interface INSIDE 90 redirect in BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

WCCP with ASA in transparent mode firewall transparent hostname munlab-asa2 Upstream L3 Router ip address 172.16.10.33 255.255.255.0 ! interface Ethernet0/0VLAN20 172.16.10.0 /24 description OUTSIDE INTERFACE nameif OUTSIDE security-level 0 ! WCCP interface Ethernet0/1 description INSIDE nameif INSIDE security-level 100 ! wccp 92 redirect-list WCCPREDIRECTLISTVLAN10 172.16.10.0 /24 wccp interface INSIDE 92 redirect in Same L3 Network but different VLAN BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 44

WCCP with ASA – Virtual Context Virtual Firewalls with shared VLAN Internet  Virtual Firewalls share same VLAN  Each Context builds a WCCP VLAN50 172.16.10.0 /24 connection to the WSA  Each Context is using a different Service ID  Single WSA serving multiple Firewall ContextVLAN10 172.16.10.0 /24 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 45

WCCP with Router – ISR, ISRG2  Redirect is GRE and Hash  Done in SW  Allows for DMZ-Design e2 e1  Supports „permit“ and „deny“ Statements in the redirection ACL ip cef ip wccp version 2 ip wccp 91 redirect-list <redirect-ACL> ! interface e1 ip wccp 91 redirect in BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 46

WCCP For Your Reference Router Redirect and Return Support WCCP GRE Redirect WCCP L2 RedirectIP Software: 7200, ISR Software: NoneForward Hardware: 6500/PFC3, 7600(PFC3) Hardware: 6500/PFC3, 6500/Sup2 (ODM ACL Merge),Return 7600/PFC3, ASR, 4500, 3750, 3560WCCP Software: 7200, ISR Not supportedGRE Hardware: ASRReturnWCCP L2 Software: 7200, ISR Software: 7200, ISRReturn Hardware: 6500 (IOS 12.2(33)SXH, ASR, 4500, 3750, 3560) (Not supported by WAAS)Native Software: 7200, ISR Not supportedGRE Hardware: 6500/PFC3, 7600/PFC3, ASRReturn BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 47

WCCP For Your Reference Platform Recommendations Function Software ASR 1000 Cat 6500 Cat 6500 ASA 5500 Support / ISR & 7200 Sup720 Sup32 Sup2 Cat 4500 Cat 3750 RecommendAssignment Hash Only Mask Only Mask or Hash / Mask or Hash Mask only Mask only Hash only Mask / MaskForwarding GRE Only L2 or GRE / L2 L2 or GRE / L2 L2 or GRE / L2 only L2 only GRE Only or GRE or GRE L2Forwarding Full extended Full extended Full extended Full extended No Redirect Extended FullRedirect List ACL ACL ACL ACL List Support ACL (no extended deny) ACLDirection In or In only In or Out / In In or In only In only In only Out / In Out / InReturn IP Forward , IP Forward, L2, GRE, nGRE, L2, IP Forward or IP Forward IP Forward GRE L2 or GRE WCCP GRE, or & IP Forward / L2 / IP or L2 / IP or L2 / IP generic GRE No GRE Forward Forward Forward BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

Transparent Redirection and HTTPSSymptoms: Successfully configured WCCP on the L3 Device Successfully connect to HTTP sites Cannot connect to HTTPS Sites Switching to explicit Proxy works fine for HTTP and HTTPSSolution: Activate HTTPS Proxy Not necessary to decrypt the requests BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 49

Transparent Deployment - Summary No client settings necessary Client resolves hostname of target web server -> improved performance! Traffic gets redirected by the network Requires involvement of the network department Requires HTTPS Proxy activation for HTTPS requests Allows for redundancy by defining multiple WSA to redirect Selection of the right device to redirect is critical BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

Deploying using external Loadbalancer Leveraging Cisco ACE Scalable up to 16 Gig Throughput in a Internet single ACE Appliance / Module and beyond the limitations of WCCP (32 WCCP Clients max) Provides intelligent L7 loadbalancing (i.e. URL based decission) ‒ Use CMD :“predictor hash url“ on ACE PBR Can be deployed transparently with Policy based Routing (PBR) If WSA is using IP-Spoofing, enable MAC- sticky on ACE Enable HTTP Probes on ACE BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 51

General Consideration - Upstream Proxy WSA can be deployed behind an Internet existing Proxy To get the value of webreputation, WSA should be placed behind an existing proxy (close to the Proxy client...) Depending on the upstream WSA proxy, check connection limits! BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 52

Policy - Authentication Policy objects can be managed from central access policy screen First step is to define the Identity: ”For whom does this policy apply?” BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

Authentication User Web Security Appliance User Directory Authentication Protocols Directory: LDAP or NTLM Method: Basic: Credentials are sent unencrypted NTLMSSP: Challenge-Response Tracking the User IP based Surrogates Cookie based Surrogates BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 55

Surrogates For Your Reference Surrogates define how Users are tracked once the have authenticated IP Address Tracks user by IP Can cause problems if clients change ip frequently or in virtual environments (Citrix) Authentication stays with WSA Works well with decryption Cookie Recommended in terminalserver environments Authentication stays with the client Does not work when using decryption based on authentication Can be a problem with transparent deployment BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

Proxy and Authentication Types For Your Reference Proxy Type Authentication Browser to WSA WSA to Auth ServerExplicit Basic LDAP (or NTLM Basic)Transparent Basic LDAP (or NTLM Basic)Explicit NTLM NTLMSSP (Active Directory)Transparent NTLM NTLMSSP (Active Directory) BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 57

HTTP Response Codes For Your Reference 200 – OK Request was sent successfully 301 – Moved Permanently The Resource has permanently moved to a different URI 401 – Unauthorized Web Server requires Authentication 403 – Forbidden Access denied 404 – not found The Server cannot find the requested URI 407 – Proxy Authentication required The request first requires authentication with the proxy BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

NTLM Authentication NTLM requires Account in the AD Domain Credentials to create a computer account are used only once, not stored on appliance Currently only one domain is supported via NTLM BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 59

LDAP Authentication LDAP queries on port 389 or 636 (Secure LDAP), 3268 (AD GC Server) Need to know the Base DN Name Parameter Can connect to multiple different domains BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 60

Authentication against LDAP  Knowing the LDAP Base DN is fundamental  Use an LDAP Browser to find out ‒ Recommendation: Apache Directory Studio BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 61

Authentication in Explicit Deployment User Web Security Appliance User Directory http error 407 Proxy sends http response 407 (proxy auth. request) Client recognizes the proxy Client will then accept a http response 407 from the proxy Works for HTTPS Client sends a CONNECT request to the proxy Client will then accept a 407 response from the proxy BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

Authentication in Transparent Deployment User Internet Web server Internet User Directory Web Security Appliance Client is not aware of a proxy -> http response 407 cannot be used Need to use http response 401 – basic authentication Client needs to be first redirected to the wsa BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 65

Authentication in Transparent Deployment What the client thinks What is really happening 1 The client sends a request to the remote HTTP The client request is rerouted to the WSA server 2 The client receives a “307” from the remote server The client receives a “307” from the WSA, spoofing redirecting the client to the WSA the remote server, redirecting the client to the WSA 3 The client connects to the WSA The client connects to the WSA 4 The client receive a “401” authentication request The client receive a “401” authentication request from the WSA from the WSA 5 The client authenticates with the WSA The client authenticates with the WSA 6 The client receive a 307 from WSA, redirecting it The client receive a 307 from WSA, redirecting it back back to the remote server to the remote server 7 The client connects back to the remote server The client continues to use the WSA as a transparent proxy BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 66

IE8/IE9 with Single-Sign On SSO on WSA correctly configured but Clients still get prompted Check if WSA Redirect Name is listed in „Trusted Sites“ Check „Security Settings“ on Trusted Sites and set to „Automatic Logon with current user name and password“ BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 67

Transparent User Identification (TUI)Web Security Release 7.5 1. Client logs on to the AD Domain 2. Client request a Web Site 3. Traffic is transparently redirected to the WSA 4. WSA needs to authenticate and queries the AD Agent for the User/Group 5. AD Agent looks up the IP and delivers User/Group 6. Request is proxied and forwarded to the Internet 4 WSA 6 AD Controller w/ Agent 5 Internet 3 1 2 Switch w/ WCCP AD User BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 68

Transparent User Identification (TUI) For Your Reference  Web Security Release 7.5 – Config AD Agentadacfg client create -name adagent -ip 127.0.0.1 -secret mysecretadacfg client create –name mywsa –ip 172.16.16.100/32 –secretmysecretadacfg dc create –name mydc -domain mydomain.com –host dc11.mydomain.com –user admin –password password BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 69

Transparent User Identification (TUI) For Your ReferenceWeb Security Release 7.5 - Config Enable TUI in the Authentication Realm Specify the Agent via Radius Edit the Identity to activate TUI BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

Transparent User Identification (TUI)Web Security Release 7.5 – Verification accesslogs Add custom field “%m” (=Authentication Method) to the access_log In the Access_logs: Check for SSO_TUI BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 71

Transparent User Identification (TUI)Web Security Release 7.5 – Verification GUI Go to Webtracking User was identified transparently BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

Demo – WSA with Transparent UserIdentification

TUI – Summary & Caveats Uses an Agent running on a Server in the AD Domain Same Agent is also used for Identity based Firewalling on the ASA Allow all applications on the client to work with authentication without starting a browser first Does support IPv6 for Client registration and RADIUS messages Does not work if Client is NATed after AD Authentication but before reaching the WSA If Client cannot be identified, fallback to previous authentication mechanism like Basic or NTLM BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 74

Cisco Ironport WSA & IPv6 Support Current version of WSA does not yet support IPv6 Support is planned for Q4CY2012 IPv6 Support for explicit mode WCCP depends on implementation of ISR, ASA and Switches, will be done in a later release WSA will listen for connections both on IPv4 and IPv6 Admin can configure, if IPv4 or IPv6 should be preferred Depending on Configuration, A-record or AAAA-record will be delivered IPv6 Internal IPv6 Internet IPv4 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 75

Sizing for WSA Main Parameters for sizing are “requests per second” and “ # HTTP Requests” Rule of thumb: Each request/s is approx. 80-90 Kbps of HTTP traffic Each Mbps of HTTP translates to approx. 10 requests/s 100 Mbps of sustained HTTP traffic is approx. 1000 requests/s To find out the request rate on a WSA: use the “rate” CLI command Those parameters allows a quite correct sizing depending on features together with the Cisco SE BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 76

WSA 7.5 Sustained System Capacity (RPS)(along with Peak RPS) Features S670 S370 S170 Proxy 1200 650 150 (3500) (3300) (310) Proxy, CIWUC, AVC 800 650 150 (3100) (2100) (310) Proxy, CIWUC, AVC, WBRS 800 650 150 (3100) (2100) (310) Proxy, CIWUC, AVC, WBRS, NTLM, Webroot, Sophos, 700 400 100 (1050) (490) (230) Proxy, CIWUC, AVC, WBRS, NTLM, Webroot, Sophos, 700 400 100 Adaptive Scanning (940) (440) (210) Proxy, CIWUC, AVC, WBRS, NTLM, Webroot, McAfee 600 290 90 (850) (300) (100) Proxy, CIWUC, AVC, WBRS, NTLM, Webroot, McAfee, 600 290 90b Adaptive Scanning (770) (270) (90) BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public

Sample Design using WSA with Explicit and Transparent mode WCCPv2 on ASA Clients connect via PAC-File to P1 Interface P2 Guests are connecting via WLAN in DMZ transparently Guests via WLAN, transparent P1 via WCCP on ASA Interface P2 is used for WCCP with ASA Interface P2 has by default ACL Clients, Explicit mode, using PAC files configured Needs to be adjusted via „advancedproxyconfig“ on WSA BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 78

Summary – Cisco Ironport Web Security Appliance Scalable On-premise Solution ‒ S170 : up to 1000 Users, S370: up to 10000 Users, S670: more than 10000 Users Many functionalities in one single appliance ‒ Reputation, malware filtering, SSL decryption, URL Filtering Can be deployed explicit or transparent mode (WCCP) ‒ Transparent: right sizing of network hardware no client settings necessary high scalability careful with non-browser Web applications that require authentication (TUI might help) ‒ Explicit: requires client settings High Availability with PAC files or Loadbalancer BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 79

Agenda Overview Web Security Web Security with Cisco Ironport Web Security ‒ Critical Functionalities ‒ Places in the Network ‒ Authentication Web Security with Cisco Scansafe ‒ Overview and Critical Functionalities ‒ Places in the Network ‒ Authentication The Road to Hybrid Security BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 80

Websecurity through Cloudservice Hosted Websecurity through Cisco Scansafe Cloud Service Central reporting and administration through Scancenter Portal BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 81

Data Flow with ScanSafe Client requests are redirected to a Internet proxy in the cloud Requests are checked and filtered Clean requests are directed back to the client Web requests Allowed traffic User Filtered traffic BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 82

Scalability & Reliability Billions of web requests per day <50 ms latency High-Availability Infrastructure Parallel Processing BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 83

Outbreak Intelligence SWF Scanlet <html> Phishing JAVA Scanlet Scanlet Win EXE <js> Scanlet Archive Context META Scanlet Scanlet Scanner <swf> Multiple<web> AV Script MF Scanlet Scanlet <pdf> File Anomaly PDF Scanlet  Paralell Processing in the Scantower Scanlet provides maximum performance <jpg>  Scanlets provide scanning for malware through code anomaly analysis BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 84

Challenge:Branch Office with local Breakout Corporate Internet Network VPN Webtraffic destined for the central DC is sent via VPN Tunnel Normal Webtraffic goes directly to the Internet bandwidth saving in the central site But how to secure the webtraffic? BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 86

Port Forwarding / Transparent Proxy Firewall directs web traffic to ScanSafe security service via Transparent Proxy / Port Forward (no browser changes required) Internet Available with certain perimeter devices that have the ability to forward traffic based on port or protocol Provides Site/External IP granularity Cisco ASA v8.3+ is capable of forwarding traffic BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 87

ASA 8.3 Port Forwarding Config For Your Referenceobject network scansafe-protected-networkSubnet 0.0.0.0 0.0.0.0!object network scansafe-proxyhost x.y.z.w!object service original-httpservice tcp destination eq www!object service proxy-8080service tcp destination eq 8080!nat (INSIDE,OUTSIDE) source dynamic scansafe-protected-network interfacedestination static scansafe-protected-network scansafe-proxy serviceoriginal-http proxy-8080 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 88

Port Forwarding Known limitations HTTP only Non standard HTTP ports must get a dedicated Internet NAT Rule No direct failover of Scansafe towers (static configuration) For user granularity, PIM can be used Website exceptions must also be defined statically using the IP BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 89

Browser Redirection via GPO / PAC Proxy Settings are pushed to browsers via Active Directory GPO Browsers connect through Firewall Internet on port 8080 to Web Security AD Server Service Firewall blocks all other GET requests Provides Site/External IP granularity GPO Update BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 90

PIM – Passive Identity Management PIM is a small EXECUTABLE, run by Login Script or GPO Runs GPRESULT API to get identity Internet Information, contacts ScanSafe and downloads Identifier Does not work for Opera or other Browsers Requires no client installation Provides only End User/Group granularity Provides no traffic redirection AD Server with PIM BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 92

How Does PIM Work in Detail? For Your Reference PIM adds -XS headers to the browser’s user agent string Included in this string is a unique hash that identifies the user in our Scanning tower This detail is encrypted Upon logon, PIM sends an out-of-bound request to the scanning tower and uploads the group information for that user These groups are automatically created in ScanCenter Following registration, each time a request to the Web is made, only the hash is sent to us along with the request and we can indentify the user and apply the correct policy according to the relevant group/s BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 93

Standalone Connector Proxy Settings are pushed to browsers via AD,GPO or PAC file Forwards web traffic to ScanSafe on port Internet 8080/443 to the Cloud based Tower Connector Connector receives Client info and queries Active Directory Server for Group Information, then proxies to ScanSafe upstream Set Firewall to block all other GET requests Provides IP/End User/Group granularity Scalable up to 10000 Users per Connector, AD Server depending on which HW it is installed BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 94

ISR G2 with integrated Connector Connector is integrated into Cisco ISR G2 Router Platforms No need to install Connector seperatly in Internet branch networks Redirect of the webtraffic is happening transparently for the user on the router Provides Scantower redundancy Provides User granularity  Authenticate User via NTLM (transparent authentication) or Basic (Prompt for Credentials) AD Server  NTLM works without prompting for IE, Firefox and Google Chrome 95 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 95

ISR G2 with integrated ConnectorSimple Configparameter-map type content-scan global server scansafe primary name proxy100.scansafe.net port http 8080 https8080 license 0 68668486389366986986968689698668 source interface FastEthernet8 timeout server 60 timeout session-inactivity 120 user-group munlab username tmayer server scansafe on-failure block-allinterface FastEthernet8 description $WAN-Interface$ ip address dhcp client-id FastEthernet8 ip nat outside content-scan out 96 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 96

ISR G2 with integrated Connector For Your ReferenceSolution Guidewww.cisco.com/en/US/docs/security/web_security/ISR_SS/ISR_ScanSafe_SolutionGuide.pdf 97 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 97

For Your Sizing and scalability Reference for ISR with Connector ScanSafe Users Supported per ISR G2 Platform 3945E 3925E 3945 3925 2951 2921 2911 2901 1941 1921 891Phase II Phase I No Auth 5000 5000 1200 900 600 500 400 350 350 300 120 Web Proxy 1200 1200 1200 900 600 500 400 350 350 300 120 HTTP Basic 1200 1200 1200 900 600 500 400 350 350 300 120 NTLM 1200 1200 1200 900 600 500 400 350 350 300 120 BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 98

Roaming User Installs a Network Driver which binds to all connections (LAN, Wireless , 3G) Automatic Peering Identifies nearest ScanSafe Datacenter and whether a connection is possible. AD information can be remembered from Proxy Firewall Hotspot when the user was last on the corporate network using the GPRESULT API (group policy) Client with Websecurity BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 99

Web Security & AnyConnect Supported on Windows & MAC OS X Client settings are controlled via Profile Profile can be centrally distributed via the Scancenter Portal BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 100

Web Security & AnyConnect Single and modular client VPN (SSL, IKEv2, Always-On,...) 802.1x (Wired, Wireless, MACSEC...) Websecurity Posture for VPN Telemetry (SIO) All modules can be used independently or all together If VPN Module is used, profile management can be done centrally through ASA BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 101

How Does it Work? Authenticates and directs your external client Web traffic to our scanning infrastructure Automatically connect to nearest Scantower SSL encryption of all Web traffic sent improves security over public networks (example: Firesheep Plugin for FF) BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 102

Web Security & AnyConnectConfiguration for Web Security with VPN Configured through a profile, downloaded from ASA at connect VPN is lower in the stack than the Websecurity Module Split tunnel Scansafe gateways in the VPN Internet Config (on the ASA) Corporate traffic Exclude Corporate adresses from beeing forwarded to the scansafe towers Client with Websecurity BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 103

AnyConnect Profile Configuration For Your Reference Exceptions for internal networks & public websites to be excluded from scanning Exceptions for authorized internal proxies Static Exceptions like VPN Gateways BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 105

AnyConnect Profile Configuration For Your Reference Automatic selection of nearest Scantower Activate Beacon Checking, Deploy public key BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 106

Web Security Config on Scansafe Portal For Your Reference Using AnyConnect without VPN Scancenter Portal provides hosting of PAC file and / or Client Profile Differentiate Usergroups due to usage of group keys Upload Client Profile Specify Client Profile Key for Authentication BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 109

Beacon Server for the AnyConnect Web Security module Beacon Server runs on an internal Server Client gets public key from Beacon Server during deployment If the client has reachability to the Beacon Server, client module is deactivated BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 110

Demo – AnyConnect with Web Security

Scansafe & IPv6 Support Current version of ScanSafe does not yet support IPv6 IPv6 traffic scanning can be excluded by adding “::/0” to Static Exceptions Full IPv6 Support will be added end CY 2012 in two phases: IPv6 Internal IPv6 IPv4 Internet AC 3.1 or Standalone / integrated Connector Internet AC 3.1 or Standalone / integrated Connector BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 112

Easy ID Clientless User authentication via webbrowser User authenticates via Webportal Policies are applied from Scancenter Portal verifying User Name and Group through AD Connection AD Connection is done via LDAPS query from Scancenter to the LDAP Directory at customer site Scancenter is sending a cookie that is used for subsequent authentication BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 113

Secure Mobility Future – Hybrid Security Internet traffic secure through Remote User w/ web security cloud service AnyConnect Corporate traffic secure Client 3.0 through tunnel and WSA Consistent Policy and Monitoring Internet Cisco ASA Cisco WSA Corporate Network BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 115

Hybrid Security –what has been done and what lies ahead Unification of URL Databases Connector Integration in ISR G2 Router Unification of features – Q1/Q2 CY2012 Application visibility and control Connector Integration in ASA – Q3 CY2012 Connector Integration in WSA Provide common management Provide common logging and reporting BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 116

Demo – ASA with integrated Connector

Summary Cisco Web Security Solution leverages a comprehensive architected featurelist to protect the dynamic environment from the ubiquitios web 2.0 world..... Or... Cisco Web Security Solution simply ROCK!  BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 118

Complete Your OnlineSession Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Passport points for each session evaluation you complete. Complete your session evaluation online now (open a browser through our wireless network to access our Don’t forget to activate your portal) or visit one of the Internet Cisco Live Virtual account for access to stations throughout the Convention all session material, communities, and on-demand and live activities throughout Center. the year. Activate your account at the Cisco booth in the World of Solutions or visit www.ciscolive.com.BRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 119

Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more! Follow Cisco Live! using social media: ‒ Facebook: https://www.facebook.com/ciscoliveus ‒ Twitter: https://twitter.com/#!/CiscoLive ‒ LinkedIn Group: http://linkd.in/CiscoLIBRKSEC-2101 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 120

Deploying Web Security (2012 San Diego)

by Cisco Security on Jun 19, 2012

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Deploying Web Security (2012 San Diego) Presentation Transcript