Other Decryption Rule Guidelines
- Users and groups
-
If you add a group or user to a rule, then change your realm settings to exclude that group or user, the rule has no effect. (The same applies to disabling the realm.) For more information about realms, see Create an LDAP Realm or an Active Directory Realm and Realm Directory.
- Categories in decryption rules
-
If your decryption policy has a Decrypt - Resign action but web sites are not being decrypted, check Category page on rules associated with that policy.
In some cases, a web site redirects to another site for authentication or other purposes and the redirected site might have a different URL categorization than the site you're trying to decrypt. For example, gmail.com (Web based email category) redirects to accounts.gmail.com (Internet Portals category) for authentication. Be sure to include all relevant categories in the SSL rule.
NoteIn order to fully process traffic based on URL category, you must also configure URL filtering. See the URL Filtering chapter.
- Query for URLs not in the local database
-
If you create a Decrypt - Resign rule and users browse to a web site whose category and reputation are not in the local database, data might not be decrypted. Some web sites are not categorized in the local database and, if not, data from those web sites is not decrypted by default.
You can control this behavior with the setting System > Integration > Cloud Services , and check Query Cisco cloud for unknown URLs.
For more information about this option, see Cisco Clouds.