Your organization has subscribed to the Cisco Cloud Web Security (CWS) service. You
have been assigned the task of configuring the CWS connector on the ISR-G2 router at a
branch office. Details of the configuration requirements include:
. Content scanning should be enabled for traffic outbound from FastEthernet0/1
. Explicitly specify 8080 for both the http and the https ports
. The primary CWS proxy server is proxy-a.scansafe.net
. The secondary CWS proxy server is proxy-b.scansafe.net
. The unencrypted license key is 0123456789abcdef
. If the CWS proxy servers are not available. web traffic from the branch office should be
denied
. After configuration. use show commands to verify connectivity with the CWS service
and scan activity You can access the console of the ISR at the branch office using the icon
on the topology display. The enable password is Cisco!23
With Firepower Threat Defense, which two interface settings are required when
configuring a routed interface? (Choose two.)
A.
Speed
B.
Duplex
C.
Media Type
D.
Redundant Interface
E.
EtherChannel
CWS connector configuration for ISR-G2:
parameter-map type content-scan global
server scansafe primary name proxy-a.scansafe.net port http 8080 https 8080
server scansafe secondary name proxy-b.scansafe.net port http 8080 https 8080
license 0 0123456789abcdef
server scansafe on-failure block-all
!
interface fa0/1
content-scan out
!on some IOS-es the above command might be:
cws out
1
0
source interface fa0/1 under parameter-map type content-scan global is missing
4
0
Diagram shows the outside interface as fa0/1. Therefore, shouldn’t the source interface be OTHER that fa0/1? When doing CWS, you are not sourcing the traffic from the outside interface, but rather from the inside interface. Therefore, I think that the source interface command should be: source interface fa0/0 (if the diagram shows inside interface to be fa0/0)
0
1
“source interface” – this command configures an interface or an IP address as the source from which packets to Cloud Web Security will originate from the device. The IP address that is configured in this command must be the IP addresses that is associated with the interface on which “content-scan out/cws out” command is configured.
0
0
R1#config t
R1(config)#parameter-map type content-scan global
R1(config-profile)#server scansafe primary name proxy-a.scansafe.net port http 8080 https 8080
R1(config-profile)#server scansafe secondary name proxy-b.scansafe.net port http 8080 https 8080
R1(config-profile)#license 0 0123456789abcdef
R1(config-profile)#source interface fastethernet 0/1
R1(config-profile)#server scansafe on-failure block-all
R1(config-profile)#exit
R1(config)#int fa0/1
R1(config-if)#content-scan out
R1(config-if)#exit
R1(config)exit
R1#copy run start
R1#show content-scan summary
R1#show content-scan statistics
!
!when i do show content-scan summary
it says interface are down-n-down
I am thinking I need to go to interface mode n do the following
shut
duplex full
speed 100
no shut
!
then put the rest of template on after interface is up n up
0
0
Hi Wayne, could you turn on the interface by changing the duplex and speed? Regards
0
0