{"id":936,"date":"2019-10-21T23:00:50","date_gmt":"2019-10-21T22:00:50","guid":{"rendered":"http:\/\/www.balajibandi.com\/?p=936"},"modified":"2019-10-24T11:13:14","modified_gmt":"2019-10-24T10:13:14","slug":"add-amp-feature-to-wsa-sma","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=936","title":{"rendered":"Add AMP Feature to WSA \/ SMA"},"content":{"rendered":"\n

AMP – Advanced Malware Protection<\/p>\n\n\n\n

WSA – Web Security Appliance ( Aka – Ironport)<\/p>\n\n\n\n

SMA – Security Management Appliance ( Centralised Management to push policies geographically located WSA)<\/p>\n\n\n\n

Background Story – One of the Client place – having major impact due to Webroot, keep having issue with proxy, not able to process some request due to Webroot bug, Cisco not have much influence here, The Only Option leave as a Cisco customer- AMP is the solution, where cisco have Full control to diagnosis the issue.<\/p>\n\n\n\n

SMA – 11.5.1-115 – Current running version<\/p>\n\n\n\n

WSA – 11.5.2-020 for Web – Current Running version<\/p>\n\n\n\n

Step 1 : Get the AMP License – either from smart License, only higher version only support smart license, so i have to contact cisco Licnese team to get feature keys.<\/p>\n\n\n\n

Step 2 : Apply the Feature keys individual kit. ( this only by login to each kit)<\/p>\n\n\n\n

\"\"
3 – Enter the feature key and submit the key<\/figcaption><\/figure>\n\n\n\n

Step 3 – now you can see the feature keys for AMP ( due to confidential i have removed other information)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 4 – Disable WebRoot and Enable AMP on WSA<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Click Submit and commit the changes.<\/p>\n\n\n\n

Step 5 : we going to enable same on SMA – Enable AMP and Disable Webroot.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"


<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Click Submit and commit the changes.<\/p>\n\n\n\n

Step 6 : Make sure you configure AMP Enginer get updates from Internet automatically.<\/p>\n\n\n\n

Navigate to Security Services > FileReputation and Analysis Under \u201cAdvancedMalwareProtection,\u201dclick\u201c Edit the GlobalSettings\u201d<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Note: By default, it will be – on port tcp\/32137 (if you have External Perimeter blocking this port AMP will not get updates). – so change the port accordingly, i have changed to 443 port<\/p>\n\n\n\n

Save and commit the changes<\/p>\n\n\n\n

You can view the AMP in Global Policy Under Access Polices<\/p>\n\n\n\n

Web Security Manager>Access Policies you will need to configure Advanced Malware Protection under the Anti-Malware and Reputation Column. Click on the blue \u201cAdvanced Malware Protection”<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Block instead of Monitoring ( Monitor not going to block)
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Step 7 : you can view the reports on SMA<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Sample report like below :<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You can view-blocking from the user<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I hope you enjoyed the document —-!<\/p>\n\n\n\n

Happy Labbbbbbbbbing! <\/p>\n\n\n\n

    <\/ul>\n","protected":false},"excerpt":{"rendered":"

    AMP – Advanced Malware Protection WSA – Web Security Appliance ( Aka – Ironport) SMA – Security Management Appliance ( Centralised Management to push policies geographically located WSA) Background Story – One of the Client place – having major impact due to Webroot, keep having issue with proxy, not able to process some request due […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,2],"tags":[],"class_list":["post-936","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=936"}],"version-history":[{"count":4,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/936\/revisions"}],"predecessor-version":[{"id":957,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/936\/revisions\/957"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=936"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}