Cisco Web Security Appliance Reviews

Cisco Web Security Appliance is used for security, proxying, and obviously proxy caching to save circuit bandwidth, but it is also used for security features because it is integrated into our ecosystem.

SSL decryption was one of the features we wanted to experiment with but did not get around to because of time constraints. 

What we liked best about it was the ability to apply policy to either a user ID or an IP-based network. Your customers are either people or machines. We chose not to create a service account for the server/machine, we had to have an IP address, based on a subnet and then applied policy to that.

The reporting needs improvement. We were using a stripped-down version of Splunk at the time, and as far as I recall, there was no easy way for us to send those logs to our enterprise Splunk. It kept pushing us to use the smaller version. That was probably just a sales team thing, but other than that, the product was great, but the reporting was definitely an issue.

I would like to see Risk API included, as well as the ability to automate adding things to the blacklist and whitelist without having to do it manually and having it report into the Cisco WSA cloud via risk API.

We started Cisco Web Security Appliance in 2013, we were Websense and we carried it until 2020. I had been working with it for seven years. To be clear, we decided to abandon Cisco WSA in favor of Zscaler.

We used their appliances on-premises.

We last used it approximately 18 months ago.

It was very stable. We enjoyed working with it. What we liked best about the WSA was the ability to block uncategorized traffic. 

Uncategorized is usually where you'll find your zero-day issues. A brand new website from a bad actor or bad country is unlikely to be categorized in the Cisco URL database, so we chose to block it. 

There are advantages and disadvantages to blocking that. If you block that, you are blocking a lot of things, and it becomes more of an administrative headache.

As long as you start using this Cisco WAS, URL reporting system, then there is a way around that. Because you could submit this URL we believe is business and whatever, or marketing.

Outside of that, you had to create a white list, which we were able to do due to our flexibility. If something was quick, this is an emergency, this is a valid site, it's not malware, it's not bad, you can add it to that list in your text file.

We had 50,000 people using this solution in our organization.

Cisco Web Security Appliance is a scalable solution.

Technical support was very good. 

I would rate them a five out of five.

Positive

We used to use Websense, but it was more political. The support model for Websense revolved primarily around two individuals. That person, or two people, did not want to share the responsibilities for whatever reason, so that's part of it.

When WSA was rolled out, it was given to a support team of about 20 people; the way we implemented it went beyond that. It also provided, the flexibility to apply those various policies, which was definitely beneficial.

It made use of the Cisco ecosystem. We were a large Cisco shop, like most companies, with our routers, like firewalls, not today, because we are moving, but it was good back then.

The initial setup is dependent on your knowledge of how to deploy proxy. Back when I was an engineer, I was the one who actually deployed it. I'm now a director, so my role is different, but I carried over my knowledge from my previous engagement. For me, it was easy based on what I knew.

If it wasn't parked in the ELA, which obviously has other things baked into it, such as support, NOS engineers, TAC, ECS, high-touch for example. Our ELA cost was in the multi-millions, so if it was separate, I could break down the costs, and based on that, I believe the return on investment would have been easier.

It's well worth the money. 

Based on my experience with Cisco WSA, I believe it was well worth the investment. The problem is that I don't know how much it cost.

I'm sure there was a breakdown somewhere, but we only saw one ELA cost.

At the time, licensing fees were paid on an annual basis.

I don't recall the cost; it was included in our ELA.

To be honest, nobody should consider on-premises anymore. It's a different world. There is now a cloud presence, and if Cisco WSA cloud presence matches what I know of Zscaler, you can basically go anywhere in the world and your laptop is forced to use it. Then you have coverage and monitoring.

If it meets your requirements, the person who is interested should use it. If it does not meet your personal criteria, they should look for a different solution; today is a different world, and I believe everyone works from home.

We are no longer working on-premises. If you work from home, you have two options: force people to connect to the network via VPN.

If you force people to use the VPN, you can force them to use a WSA in Cisco on-premises. I'm not familiar with the WSA cloud, but if you could force them to go directly to the cloud from your home, it's well worth considering. That's fantastic, in my opinion. Cloud definitely alters the dynamic here. It's borderless nowadays, with thoughts on everyone flowing through the inside. They need to be more open about borderless, and it appears that they are.

I would rate Cisco Web Security Appliance an eight out of ten, because, for one thing, we had issues with the reporting and didn't like the stripped-down version of the reporter. The other is that they were not in the cloud at the time, but I believe they are now.

We were configuring the computers, using it as a proxy. What I did was I configured the different URL categories and custom categories, and assigned them to a specific group of people through their Active Directory group. It was working in conjunction with Active Directory.

We didn't use WSA, it was used only in our customers premises 

It works really well. It operates beautifully once everything is configured. 

It also allows you to decrypt SSL traffic, and that's a really important feature as well, which is something I also configured.

The solution is easy to set up.

The virtual machine is quite scalable.

It's stable. 

I didn't use the full potential of WSA, so I cannot really say what features may be lacking or missing. 

The WSA should have a Firewall like feature built in, that would allow for more control with different ports other than 80, 443 or HTTP and HTTPS.

I've been using the solution for three years. 

The customer prior to where I configured the physical appliance, never complained about it not working. It's been three years or so and it's still operating as smoothly as it operated on the first day. There weren't any breakdowns or lags or anything like that.

I'm not really sure about the scalability. If I could compare, cloud solutions like Umbrella and Zscaler are far better than WSA. Maybe the virtual machine of WSA is more scalable than the physical appliance as the physical appliance is bound to the specification that it has. Whereas you can scale the virtual machine as much as you can and allows you your underlying hypervisor. 

We have about 1,500 people using the solution.

I've never had to use technical support.

The implementation was very straightforward. The interface is really intuitive. I don't know about the new one, however. They released an interface, however, it wasn't fully released. It was a demo. Those interfaces were really good.

Getting up and running from start to finish takes about eight hours. 

The setup was pretty fast as the features that I used were pretty straightforward and all I had to do was handle custom URLs. It wasn't too complex a configuration.

The solution's cost depends on how many users you purchase. It was maybe $3 or $5 per user, which is a bit expensive. Other solutions are expensive, especially the cloud ones. It's still on par with the others, however, lowering the expenses would be also a great thing. It's absolutely worth the cost.

The last version of the solution we used was on a virtual machine. Prior to that, I worked on a physical appliance. It was WSA S190.

The company decided to go with WSA mainly due to the fact that, in one case, financial institutions usually prefer on-prem deployments over the cloud. I also had a good experience with WSA and the customer was okay to have it on on-prem. 

If you're a customer with a lot of sites, then an on-prem solution like WSA is not a good option. For a big customer, you have to purchase one for each site and that's expensive. Going for a cloud solution where you have centralized management of all your policies is the better option. It's also less expensive than an on-prem Solution

As for a small customer with two or three sites in a small region, it would be okay to have one WSA centralized. This was the case with my last customer, which has 1,500 users. Their sites are all close to each other so that wouldn't be a problem. There wouldn't be a problem using one centralized WSA in one site as it wouldn't cause latency or stuff like that. If the sites are scattered all around, I wouldn't recommend WSA as it becomes too expensive. A cloud solution like Umbrella or Zscaler is preferred in this case.

I'd rate the solution nine out of ten. It operates well, however, the on-remises version is limited in terms of scaling.

We primarily use the solution for security and controlled internet access. We just finished deploying one for one of our clients that actually bought both devices. That was just before COVID that we implemented it, so we just finished it now.

There are different types of groups with different types of access depending on the policies for those departments or users. We've got the administrator, the normal users, and then the management. We allow certain users to have access to all of the sites as they do research as well as marketing. We also use those features to actually define the policies so that they can have access to those sites for advertising as well.

Most of the features are great. They've got great filtering. That's what the client was looking at in terms of users when they go out to the internet, to make sure that when they access, they access the sites that actually have been filtered by Cisco to make sure that those sites are secure and they don't have malware that they can download from those sites.

The stability is good.

It's a scalable product.

Technical support has been helpful.

The pricing is reasonable.

We just deployed it. I would just like to have more filters. However, I need more time to give a report to see what limitations may exist. 

During the setup, we had issues with updating the rules.

I would like more automation. When it's on a failover, everyone will think that they'll filter nicely.

We've been using the solution for almost four years now.  

We've been running the latest solution for eight months now and it is totally stable. There are no bugs or glitches and it doesn't crash or freeze. It's reliable. 

It is scalable. The clients that we have sold a few of those boxes to, did find integrating with AV software a bit expensive. However, it is possible to expand it.

Technical support is great. They're always on par. They're fine. So far, from what we've seen, they've always managed to respond.

It's a bit on the expensive side, I must say, however, when you look at the trends of the market, if you look where other services are going, the pricing is very close.

While the first assumption from clients is "Oh, Cisco devices are expensive," when you compare it with other devices, it's almost a tie. In general, the pricing of Cisco devices is not that bad.

We are a Cisco partner and a reseller.

We're integrating with the Cisco ISE as well. We bought the licenses for malware as well and then integrated them with the AD. That's been the new authentication for the users when they go into the internet with a specified group. 

I’d recommend the solution. The support from Cisco is excellent. Through my years working with Cisco, I would always recommend Cisco, any product that they provide, thanks to my years of experience.

I have, for the past six or seven years, deployed different types of deployments and I would say Cisco support is excellent. I have met a lot of good, skilled people in terms of support along the way. Especially on ISE as that's one of the more difficult products.

It works very well for what the client actually wants to achieve. You have put the policies in place according to the client’s needs. ISE helps ensure the policies are in place and working. We have logs, we have evidence.

As long as you put ISE in, it's going to tell you all the issues that you're having with your AD. If it's not configured properly, even if you’ve been running it for 15 years, you'll know. We can show how things may not be configured properly and how to fix them.

I'd rate the solution eight out of ten.

Cisco Web Security Appliance can be used as a proxy for sending all traffic to the internet. In that case, I can apply security policies and provide anti-malware, protection, and attack prevention with this security appliance. Additionally, there is some advanced functionality, such as security orchestration and security incident management appliance integration. You are able to have full protection and incident management.

This solution can be deployed in the cloud or on-premise.

I am using a virtual infrastructure which is the easiest infrastructure.

The most valuable feature of Cisco Web Security Appliance is the provided anti-malware functionality and URL categorization. I can block access to malicious websites. 99 percent of the cases are related to a malicious website. If I cannot browse those malicious websites, then we are 99 percent protected. 

We have SSL decryption and we receive full visibility of what is happening on the network. With SSL decryption, most of the traffic is encrypted and if I had the traffic recorded, I could see what is happening inside that traffic.

The solution could improve the graphical user interface. It is not up to the regular standard of what we would expect from Cisco. Additionally, they need to improve the categorization when blocking in the settings. The CLI could have a better view than the graphical user interface but I did not investigate further.

I have been using Cisco Web Security Appliance for approximately seven years.

The solution is stable and has high availability.

I rate the stability of Cisco Web Security Appliance a nine out of ten.

The scalability of Cisco Web Security Appliance is high.

I rate the scalability of Cisco Web Security Appliance a ten out of ten.

Cisco is the best support team available on this planet. I am happy with the support I have received.

I have worked with Cisco Firepower and the Cisco DNA Center Platform. It is a stable solution, but they are working on improving it.

The initial setup is complex. The is not much flexibility when creating policies. As per the design guide, they have provided a lot of limitations for creating policies. For example, if I create 30 access policies, 30 customization decryption policies, and 30 custom complex policies, there is a complexity in the qualification. If the policy is complex then CP gets high, which is a problem. 

Following the best practice guide, I have to follow that constraint. However, customers, are not happy with the restriction and policies. They want to create as much policy as possible. 

The implementation took approximately two weeks or ten working days.

I do the implementation of this solution.

There is a subscription-based license needed to use this solution.

I rate Cisco Web Security Appliance a nine out of ten.

I am a reseller and work with clients to set up web and email security. Most of my clients focus on web security where they connect with proxy servers to view security items that relate to antivirus, threat defense, and anti-malware. 

The solution is used to enforce security when accessing the web and as a transparent proxy for smartphones and tablets. 

The solution provides good web reputation and anti-malware protection. 

URL filtering and parameter controls are not used in business or enterprise implementations but are good. 

The transparent proxy is quite difficult to enforce on smartphones and tablets because it is on a sticker implementation rather than a line mode. The WCCP ID is the biggest IP address of the appliance but it is not able to be reached by the user. 

The addition of inbound features such as a reverse proxy and load balancers would be very useful.

Reporting could be improved so that a central management solution is not required. 

I have been using the solution for more than ten years.

The virtual appliance is very easy to implement and is stable with no crashes. 

Power outages may affect the hardware appliance because its hard disk is encrypted. 

There are some issues with scalability when adding new devices that are related to clustering and load balance in the Active Directory. 

Technical support is quite good compared with other solutions. 

I rate support a ten out of ten. 

Positive

The initial setup for a basic implementation with direct access to the proxy is straightforward. 

I rate setup a ten out of ten. 

We implement the solution for our customers. 

For a security solution, there isn't an ROI but you can evaluate how much data or money you will lose if attacked.  

The licensing options begin with 100 users and this is a high threshold for smaller networks that might only have 25-75 users. 

It would be a benefit to offer one-year licenses in addition to the already available multi-year packages. 

The premium or bundle licenses require additional support from third-party vendors to ensure there are no disruptions in service for customers. 

It is important to be confident in the solution even though it is new because any challenges are minor. 

The solution is one of the best enterprise-based products in the market and is not expensive compared to others. 

The solution is not perfect because it has transparent proxy issues so I rate it a nine out of ten. 

We are just using the solution for internal purposes. When we need to browse the internet, our staff will either be allowed or refused access to the internet. All of the internet is accessed via the server.

The bandwidth limit is useful. The categories are pre-defined by Cisco. 

It's a very user-friendly product and is easy to set up.

The product is stable.

It's a scalable product.

It should have a user-based quota, per-user quota, that can be defined on the appliance. That way, if a user reaches their quota individually, they should be blocked for the next day. 

One major feature that is still not in this product and that should be implemented by Cisco is that it should have a live graph. We'd like to see, for example: What is the user consumption at the right now? What is the bandwidth, when bandwidth is used by the user? There is no current graph of it and I would recommend it should be in the product.

I've been using the solution for five years. 

The product is stable. I have not seen any issues in five years. We have not had any unintentional reboots or downtime. It is very reliable and is a stable product.

We haven't had any issues with scalability.

In my first company, there were 2,000 people on the solution. In my latest organization, we have 15,000 people on it. 

We've reached out to support for day-to-day challenges. They've been very helpful and responsive and we have been happy with their level of service. 

Positive

The solution is very easy to set up. It's user-friendly. The process isn't difficult. It took us about a day to set up.

You do need to pay for a license. It's not cheap or expensive. It's mid-level in terms of price. 

We did look at other solutions. We conducted a comparison of options and did a POC. In the end, we found this product very helpful. We looked at, for example, Fortigate, among others. 

We're a customer and end-user.

I'd advise users to give the solution a try. It's a very easy-to-use product and everything is working without any issue with the appliance. I would recommend others to use it.

I'd rate the solution nine out of ten.

We use Cisco Web Security Appliance for proxy purposes, for enterprises.

The best feature of Cisco Web Security Appliance is its policy framing. It also has a good UI and it can handle traffic well. Cisco Web Security Appliance is a good product.

As Cisco Web Security Appliance is eight years old, though it's simple to access its UI, the UI needs a little bit of updating. If it could be more interactive similar to the latest gen solutions, that would improve the product. Adding a few more integrations would also make Cisco Web Security Appliance better.

Cisco Web Security Appliance is a web appliance, so I don't see much scope for adding other features to it.

I've been using Cisco Web Security Appliance for one year.

Cisco Web Security Appliance is a stable solution.

As Cisco Web Security Appliance is an appliance, it doesn't scale. You need to size it based on your requirements, so if you're a small-scale customer, you'll size based on that. A large-scale customer gets a larger appliance and would need to size in advance, so you cannot scale that. Instead, you'll have to add boxes to add more load, so you can add to the cluster.

The initial setup for Cisco Web Security Appliance was pretty easy. It usually takes just a day or two to complete the deployment if you have all the information, but it's mostly the customers performing the initial setup because it's all done remotely.

I have no information on the licensing costs for Cisco Web Security Appliance.

I have customers that have thousands of users of Cisco Web Security Appliance, for example, five thousand users. I manage the migration for multiple customers.

My advice to anyone who wants to use Cisco Web Security Appliance is that it's a product that's easy to grasp if you know about proxy or any other firewall solution because it's pretty similar to other network security products in the market. If you have zero knowledge of network and security, it'll be difficult for you to understand Cisco Web Security Appliance.

My rating for Cisco Web Security Appliance is seven out of ten. It's a stable solution. It's not the best product, but it's a good product, and because it's on-premise and its visibility or availability on the cloud is minimal, many customers or companies prefer using it.

We primarily use the solution to verify the identity of users that are connecting to the network. It's used to check the compliance of their systems before they are able to connect.

There isn't that much to it. It's not overly complex.

The scalability is good.

The deployment process is very simple.

Technical support is okay.

The stability could be better. 

The solution needs to be more user-friendly and easier to navigate. It's not so easy right now. 

I've been using the solution for five years at this point. I've used it for a while. 

The stability is lacking and is something that should be looked at. We don't find it to be very stable.

The solution offers good scalability. If a company need sot expand it, it can do so. It's not a problem.

We have about 50,000 users on the solution currently.

We've contacted technical support in the past and they have been fine. Cisco has relatively good technical support.

We did not previously use a different solution.

The solution is very easy to implement. It's not overly complex or too difficult. Our deployment took about six months.

We have five team members that can handle setups and maintenance tasks. They are engineers.

While we did do some of the initial setup ourselves, we did also have a consultant come in to assist in certain areas from time to time. 

There is a one-time licensing fee that needs to be paid. 

We are using the latest version of the solution, however, I cannot speak to the exact version number.

I would rate the solution at a seven out of ten. It's an okay solution that needs better stability.

I would recommend the solution to other companies and organizations.