Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

do CSA block certains applications when learning mode enabled

do CSA block certains applications when learning mode enabled?

Our client claim that there are some services that are blocked, like network-printing, network share for windows clients.

The CSA-MC log don't show these blocked services.

Best regards

2 REPLIES
Bronze

Re: do CSA block certains applications when learning mode enable

While in learning mode, the agent is noting which applications run on the system and what those applications are allowed to do. Running the agent in learning mode for a certain amount of time allows it to learn the system's normal operating behavior and then provide security accordingly once learning mode is disabled. While in learning mode, the agent notes what applications are used to access the network and assigns those permissions automatically.

When the agent is taken out of learning mode, it will allow only those applications it previously noted to run in the manner in which they were used during the learning period. If the agent notices a new action that it has not learned taking place on the system, the agent queries the user, asking if it is okay for the application in question to access the resource in question. Once users reply to the query, the agent remembers the response and the next time the application is used, the same action is allowed or denied based on the initial response and users are not queried again.

Blue

Re: do CSA block certains applications when learning mode enable

The answer is yes, in Learn Mode it will block certain applications if the rules are set to deny.

It will answer yes to any query rules that have allow as a choice for an answer.

Tom

128
Views
5
Helpful
2
Replies