Cisco WSA - dedicated real IP

[galin.gospodinov]

Hello community, 

Is it a best practice to configure dedicated real IP address on P2 port on cisco WSA or we should use NAT ?

If it is OK to dedicate real IP address, what are the security protections that can be enabled on Cisco WSA ?

Thank you!

[Ken Stieers · Accepted solution]

You can do it either way... I used NAT.
As far as I know there aren't any extra security protections/configurations to put on the WSA because you're exposing one of the interfaces to the open internet.


________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.

[galin.gospodinov]

Thank you, Ken!

What is the best practice - dedicated real IP or NAT ?

[Ken Stieers]

I don't know if it is written down anywhere, but I would say NAT...
There isn't really any reason to directly expose the outbound interface to the internet. From the outside, the WSA is just another box surfing the web.


________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.

[amojarra · Accepted solution]

Hi @galin.gospodinov 

As Ken mentioned, the best practice is to use private IP address in your P2 interface and NAT the IP in your Firewall/router. 

in this case, you can block all the unwanted traffic, and just allow TCP/80,443 (due to your network needs and design) to the internet

please allow me to share the firewall configuration guide : 

https://www.cisco.com/c/en/us/support/docs/security/secure-web-appliance/218441-configure-firewall-for-secure-web-applia.html

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++