Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

IWSVA logs traffic by IP address rather than user name

    • Updated:
    • 6 Jul 2017
    • Product/Version:
    • InterScan Web Security Virtual Appliance 6.0
    • InterScan Web Security Virtual Appliance 6.5
    • Platform:
    • N/A N/A
Summary
The logs on the web console of IWSVA, for example the Internet Access Logs, show traffic logged under the IP address of a client computer rather than the user name of a user logged on to the machine.
Details
Public
There are several scenarios where this can happen.

Scenario 1:
The IP address of the client computer is on the LDAP Authentication Whitelist. No user identification will be done for IP addresses on this list. (It can be accessed from the web console under Administration > IWSVA Configuration > User Identification > Authentication White list.)

Scenario 2:
The IP address of the client computer is on the Approved Server IP List. No user identification will be done for IP addresses on this list. (It can be accessed from the web console under HTTP > Configuration > Access Control Settings > Approved Server IP List.)

Scenario 3:
The accessed URLs are HTTPS websites and IWSVA is not able to get the user from the traffic because it is encrypted. This happens in the following circumstances.
  1. HTTPS encryption is enabled, but not applied to the category to which the URL belongs. Decryption needs to be enabled for each category individually on each HTTPS decryption policy in order for IWSVA to decrypt HTTPS traffic.
  2. The URL is on the list of global trusted URLs. (This list can be accessed from the web console under HTTP > URL Access Control > Global Trusted URLs.)
Scenario 4:
The traffic is not coming from a browser but from some application, for example a Webex client. By default IWSVA does not authenticate non-browser traffic, therefore the user cannot be identified. (To change the behaviour, refer to this article.)

 

Premium
Internal
Rating:
Category:
Configure; Troubleshoot
Solution Id:
1116734
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.