Cisco Web Security Appliance (WSA) and Email Security Appliance (ESA) are dedicated hardware or virtual appliances that protect a company's network from threats arriving via the internet and email. For the 350-701 exam, understanding how these appliances filter malicious traffic and enforce security policies is critical because they are cornerstone technologies for defending against phishing, malware, and data loss in any organisation.
Jump to a section
A simple way to picture Cisco WSA and ESA
4 million pieces of mail enter the city's main sorting facility every day. This is like the Cisco Email Security Appliance (ESA). It works like a massive automated private mailbox service that scans every letter and parcel for dangerous content before it reaches your home. The facility has a team of inspectors who check for known contraband (like malware signatures), suspicious sender addresses (spam domains), and unusually shaped packages that might hide a device (URL reputation). They also encrypt sensitive documents so that even if a letter is lost, it cannot be read. The service gives each business a unique private mailbox ID (email encryption) and forwards clean mail to its intended recipient.
Now consider the 50,000 delivery trucks entering the city's industrial zone daily. This is the Cisco Web Security Appliance (WSA). It acts like a customs checkpoint at the city gate for all internet traffic. Every truck (web request) must stop and present its cargo (URL requested). The inspector checks a global database of known smuggler trucks (threat intelligence), verifies the driver's identity (user authentication), and decides whether to let the truck pass, inspect it more closely (SSL decryption), or turn it away (block malicious sites). The checkpoint also keeps a log of every truck that passes, which the city security team reviews monthly (detailed reporting).
These two systems protect different entry points into the city, but they work together. If the customs checkpoint finds a new type of smuggler truck, it shares that information with the mail sorting facility, and vice versa. In a company, this means the WSA and ESA share threat data via Cisco Talos, the central intelligence hub. They block attacks before anyone in the office even knows a threat existed.
The Cisco Web Security Appliance (WSA) is a security device that sits between a company's internal users and the public internet. Think of it as a security guard standing at the office door to the Internet, inspecting every single web request before it leaves or arrives. When an employee tries to visit a website, the request first goes to the WSA. The WSA checks that website against several databases. First, it categorises the site: is it a social media site, a news site, a known malware distribution site? This categorisation comes from Cisco Talos, which is a global threat intelligence team that analyses billions of web requests daily. The WSA uses this to block categories the company has forbidden, like gambling or adult content. Second, it checks the reputation of the web server’s IP address or domain. A site that has been reported for hosting malware gets a low reputation score, and the WSA blocks it. Third, the WSA can inspect the actual content of the web page — the files it tries to download, the code it runs. This is called web filtering. It can block file types (like executable .exe files) or scan them for viruses using an integrated antivirus engine.
A key feature of the WSA is SSL decryption. Many websites now use HTTPS, which encrypts the data between the user and the site. If the WSA cannot see the encrypted data, it cannot inspect it for threats. So the WSA acts as a middleman: it presents a special certificate to the user's browser, intercepts the encrypted traffic, decrypts it, inspects the content, then re-encrypts it and forwards it to the original destination. This is called a man-in-the-middle (MITM) proxy, but in a legitimate corporate security context. Without this, malware can hide inside encrypted connections.
Now, the Cisco Email Security Appliance (ESA) is the counterpart for email traffic. It sits at the edge of the company's email system, typically between the internet and the company's mail server (like Microsoft Exchange or Google Workspace). Every email passing into or out of the organisation must go through the ESA. It performs several layers of filtering:
First, it checks the reputation of the sending server. Cisco Talos maintains a list of known spam and malware sending IP addresses. If the email comes from a known bad address, the ESA drops it immediately without even processing it further.
Second, it checks the email for spam using advanced algorithms that analyse the content, headers, and patterns. This is called anti-spam filtering.
Third, it scans attachments for viruses and malware using multiple antivirus engines.
Fourth, it analyses URLs in the email body. Many phishing emails contain links to malicious sites. The ESA can rewrite those URLs so that when the user clicks them, the request first goes through the ESA for a real-time reputation check. This is called URL reputation filtering.
Fifth, it can apply Data Loss Prevention (DLP) policies. For example, if an email contains a credit card number or social security number, the ESA can block it from leaving the company.
The ESA also provides encryption. If an email contains sensitive data, the ESA can automatically encrypt it so that only the intended recipient can read it, even if the email is intercepted in transit.
Both appliances work together in a coordinated defence. They both rely on the same threat intelligence feed from Cisco Talos. If the WSA sees a new malicious download site, it shares that information with the ESA so it can block emails containing links to that site. This integrated approach is called Cisco Security Intelligence Operations (SIO).
For the exam, understand that the WSA and ESA are not general-purpose firewalls — they are specialised web and email gateways. They are also available as virtual machines (called vWSA and vESA) for cloud deployments.
Traffic interception
The WSA intercepts all web requests from users either by acting as a proxy (users configured to send traffic to it) or by transparently redirecting traffic via the network firewall. For the ESA, the MX record in DNS points to the ESA's IP address so all inbound email arrives at the ESA first.
Reputation check
Both appliances query Cisco Talos for the reputation of the connecting IP address (for email) or domain (for web). If the reputation is below a threshold, the traffic is blocked immediately without further analysis, saving processing resources.
Content inspection and policy enforcement
The WSA inspects the URL and file content using anti-malware engines and URL filtering databases. It enforces policies like blocking specific file types (e.g., .exe) or categories (e.g., adult content). The ESA inspects email headers, body, and attachments using anti-spam, anti-virus, and DLP engines.
SSL decryption (WSA only)
For HTTPS traffic, the WSA performs man-in-the-middle decryption by presenting its own certificate to the client and then re-encrypting the traffic to the destination server. This allows the WSA to inspect the encrypted content for threats.
Action and logging
Based on policy evaluation, the appliance takes action: allow, block, quarantine (for email), or rewrite (for URLs). All actions are logged centrally for monitoring, reporting, and forensics. The logs are sent to a SIEM or the Cisco ESA/WSA reporting interface.
You are the sole IT security administrator for a medium-sized law firm with 200 employees. The firm handles confidential client contracts, financial data, and personal identification information. You need to protect the firm from phishing attacks that are becoming increasingly sophisticated, and from employees accidentally visiting malicious websites that could install ransomware.
Step one: Deploying the ESA in the DMZ. You log into the Cisco ESA management interface via a web browser. The first task is to configure the incoming mail processing. The ESA needs to know which domain names the firm owns (e.g., "lawfirm.com") and which mail server (Exchange) should receive the clean emails. You set the ESA's public IP address as the MX record for the domain — this tells the entire internet that all email for the firm should be sent to the ESA first. Then you configure the listening port (port 25 for SMTP).
Step two: Enforcing anti-spam and anti-malware policies. You navigate to the Mail Policies section. You create a policy called "Executive Staff" that applies to all partners and senior lawyers. For this group, you enable advanced malware protection, which includes file type blocking (blocking executable files and macro-enabled Office documents) and URL rewrites. For regular staff, you create a less restrictive policy but still with strong spam filtering. You set the action for spam to "Send to Quarantine" — this means suspicious emails are held in a special folder for you to review daily, so no one accidentally deletes legitimate emails.
Step three: Deploying the WSA for web security. You connect the WSA to the network and configure its proxy settings. You configure the firm's firewall to redirect all web traffic (ports 80 and 443) to the WSA. Alternatively, you can push an automatic proxy configuration (PAC) file to all employee computers via Group Policy. The WSA enforces a policy that blocks access to:
All websites classified as "Malicious"
Categories like "Phishing" and "Spyware"
File-sharing sites (to prevent data leakage)
Any site with a low reputation score (below 50 out of 100)
Step four: Enabling SSL decryption. You generate a certificate from the WSA and install it on all employee computers so they trust the WSA as a proxy. This allows the WSA to inspect all HTTPS traffic. You also configure an exception list so that banking websites and healthcare portals (like the firm's insurance provider) are not decrypted, to avoid legal and privacy issues.
Step five: Monitoring and reporting. You configure the ESA and WSA to send logs to a central Security Information and Event Management (SIEM) system. You set up daily email reports showing how many emails were blocked as spam, how many attachments were quarantined, and how many web requests were blocked. You also configure alerts for unusual activity, such as a user visiting 50 suspicious websites in five minutes, which could indicate a compromised endpoint.
Real result: Two weeks later, a partner clicks a link in an email that appears to be from a client. The ESA had rewritten the URL because the original link pointed to a phishing site. The partner was redirected to a block page saying "This site is malicious." The partner calls you, and you check the ESA logs to confirm the block. Without the ESA, the partner would have given credentials to the attacker.
The 350-701 exam tests your understanding of Cisco WSA and ESA in several specific ways. You must know the core functions of each appliance, the key features they share, and how they differ from each other and from other security products. Here is exactly what you need to focus on:
Exam topics to memorise:
The primary role of WSA: web proxy, URL filtering, malware protection, SSL decryption, application visibility and control (AVC).
The primary role of ESA: email security gateway, spam filtering, virus filtering, email encryption, DLP, email authentication technologies (SPF, DKIM, DMARC).
Cisco Talos: the threat intelligence feed shared by both appliances. Know that Talos provides reputation scores for IPs, domains, and URLs.
The difference between a transparent proxy (WSA) and a forward proxy (WSA can do both). The exam may ask which traffic flow method is used in a given scenario.
Features unique to WSA: SSL decryption, acceptable use policy (AUP) enforcement, bandwidth usage control.
Features unique to ESA: outgoing email filtering, encryption, email quarantine, bounce verification.
Common trap patterns:
Trap: The exam presents a scenario where a user's computer is infected with malware, and asks which appliance would have prevented it. Many candidates choose the ESA, but the answer is the WSA because the infection came from a malicious website.
Trap: They ask what feature prevents users from uploading sensitive data to a cloud service. The answer is DLP on the WSA, not the ESA. The WSA monitors web traffic, so it blocks the upload in the HTTP/HTTPS request.
Trap: They question which appliance inspects SSL traffic. The answer is WSA, not ESA (though ESA can also do SSL inspection on email content, but the primary SSL decryption is a WSA feature).
Trap: They ask about email authentication methods. The correct answer is SPF, DKIM, and DMARC. Do not confuse these with web security protocols like HTTPS or SSL.
Trap: They describe a phishing attack and ask which feature blocked it. The answer is URL reputation filtering on the ESA, which rewrote the link.
Key definitions to memorise for the exam:
Cisco WSA: A proxy-based web gateway that filters outbound and inbound web traffic, inspects content, and provides malware protection.
Cisco ESA: An email gateway that filters inbound and outbound email traffic, stops spam and malware, and enforces data protection policies.
Cisco Talos: A group of threat researchers who provide real-time intelligence feeds to Cisco security products, including WSA and ESA.
Mail Transfer Agent (MTA): The ESA functions as an MTA, accepting emails via SMTP and routing them to the internal mail server.
Proxy service: The WSA acts as an HTTP/HTTPS proxy, intercepting and inspecting web requests.
The exam loves to test your ability to pick the correct device (WSA vs. ESA) for a given security requirement. For example: "Which appliance would you deploy to block employees from visiting gambling websites?" Answer: WSA. "Which appliance would you deploy to prevent confidential financial data from being sent via email?" Answer: ESA (with DLP).
Cisco WSA filters web traffic using URL reputation, content inspection, and SSL decryption, while Cisco ESA filters email traffic using anti-spam, anti-malware, and DLP.
Both appliances rely on Cisco Talos for real-time threat intelligence feeds that update reputation scores for IPs, domains, and URLs.
SSL decryption on the WSA is essential for inspecting encrypted HTTPS traffic, which constitutes the majority of modern web traffic.
The ESA functions as a Mail Transfer Agent (MTA) and can enforce email authentication standards like SPF, DKIM, and DMARC.
Data Loss Prevention (DLP) policies on the ESA monitor outgoing emails to prevent sensitive data (e.g., credit card numbers) from leaving the organisation.
The WSA and ESA can operate in transparent proxy mode or explicit proxy mode, depending on network configuration requirements.
Both appliances support integration with Cisco Identity Services Engine (ISE) for user-based policies, enabling individual user blocking based on identity.
Email quarantine on the ESA holds suspicious emails for administrator review, preventing false positives from disrupting business communications.
These come up on the exam all the time. Here's how to tell them apart.
Cisco WSA
Inspects web traffic (HTTP/HTTPS).
Uses URL filtering and SSL decryption.
Enforces acceptable use policies for internet browsing.
Cisco ESA
Inspects email traffic (SMTP, SMTPS).
Uses anti-spam, DLP, and email authentication.
Enforces data loss prevention for outgoing emails.
Cisco Talos (shared)
Provides real-time reputation scores for IPs and domains.
Uses global threat telemetry from millions of sensors.
Updates every few minutes for fast threat response.
Traditional antivirus signatures
Relies on locally stored virus definition files.
Detects only known malware based on file hashes.
Updates daily or weekly, leaving gaps for zero-day threats.
Proxy mode (transparent)
Requires no client configuration; traffic redirected via network.
Users may not know they are being proxied.
Can be harder to troubleshoot when issues arise.
Proxy mode (explicit)
Requires browser proxy settings or PAC files on each device.
Users are aware of the proxy and can sometimes bypass it.
Easier to apply per-user proxy rules.
Mistake
The WSA and ESA are the same thing because they both scan for malware.
Correct
The WSA scans web traffic (HTTP/HTTPS) and the ESA scans email traffic (SMTP, SMTPS). They are separate appliances with different protocols and functions. They share threat intelligence but handle different data flows.
Beginners hear 'malware protection' and assume all security appliances do the same thing, ignoring the distinct protocols (web vs. email).
Mistake
The ESA can stop all phishing attacks because it filters incoming emails.
Correct
The ESA can filter known phishing emails using signatures and reputation, but advanced phishing (like spear-phishing with personalised content) may bypass filters. It reduces risk but does not eliminate it. User training is still needed.
Marketing materials make security products sound invincible, but real-world attacks are constantly evolving.
Mistake
SSL decryption on the WSA is optional and rarely needed.
Correct
SSL decryption is critical because most modern malicious traffic is encrypted. Without it, the WSA cannot inspect the content of HTTPS requests, leaving the network vulnerable.
Many people think HTTPS means 'safe' and do not realise that encryption hides malicious payloads too.
Mistake
The WSA and ESA only work on physical hardware, not in the cloud.
Correct
Both are available as virtual appliances (vWSA and vESA) that run on hypervisors like VMware or in public cloud platforms like AWS and Azure.
Older materials might only mention physical appliances, but the exam covers cloud and virtual deployments.
Mistake
The WSA is only for blocking bad websites, not for allowing good ones.
Correct
The WSA can also enforce acceptable use policies (e.g., block social media during work hours) and provide bandwidth management, not just threat prevention.
People think of security as only 'block bad things', but it also includes behaviour control and performance optimisation.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Cisco WSA (Web Security Appliance) protects users from malicious web traffic, while Cisco ESA (Email Security Appliance) protects against malicious emails. They work on different protocols (HTTP/HTTPS vs SMTP) and have different filtering engines.
Yes, the exam objective (5.2) explicitly requires you to describe both appliances. You must understand their individual roles, common features like Cisco Talos integration, and when to deploy each one.
The WSA uses URL filtering based on Cisco Talos reputation scores, categorising websites into groups (malicious, phishing, etc.). It also inspects the content of the web page and blocks downloads of malicious files.
SSL decryption allows the WSA to inspect encrypted HTTPS traffic. The WSA acts as a middleman — it decrypts the traffic, inspects it for threats, then re-encrypts it and forwards it to the destination. This is necessary because most malicious web traffic now uses encryption.
The ESA can stop many — not all — phishing emails. It uses algorithms to analyse email content and headers, but sophisticated spear-phishing may bypass filters. URL rewriting is a key feature: the ESA changes links in emails so that clicks are checked in real-time against threat databases.
Cisco Talos is a threat intelligence team that collects data from millions of sensors worldwide. Both WSA and ESA use Talos feeds to get up-to-date reputation scores for IPs, domains, and URLs, enabling them to block known threats in real time.
You've finished Cisco WSA and ESA. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?