cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5503
Views
0
Helpful
4
Replies

Cisco WSA : Is it possible to use web proxy in transparent mode without WCCP router ?

stephane.walker
Level 1
Level 1

Hello !

I would like to use Cisco WSA as a web proxy in a transparent way (without any configuration in client's web browsers) but i don't have a WCCP router. So, is it possible ? 

If yes, how to do this ? 

Thank you,

Stephane Walker

1 Accepted Solution

Accepted Solutions

Artur Nowicki
Cisco Employee
Cisco Employee

Hi Stephane

The only alternative to WCCP is PBR (Policy Based Routing). With a simple configuration on the router you can redirect traffic defined as interesting by access list to WSA. On the WSA you need to configure transparent mode (Security Services -> Web Proxy -> Edit Settings -> Proxy Mode: Transparent). You also need to assure that proxy is listening on the port 80 and that HTTPS proxy is enabled (on port 443) if you want to redirect the HTTPS traffic as well. 

Sample configuration for Cisco router

 

!
access-list 110 permit tcp any any eq www
!
route-map proxy-redirect permit 10
match ip address 110
set ip next-hop xxx.xxx.xxx.xxx
!
interface ethernet0/1
ip policy route-map proxy-redirect
!

 

xxx.xxx.xxx.xxx is the proxy IP in such case and access-list 110 defines web traffic (HTTP TCP/80) as interesting.


The biggest disadvantage of such solution is lack of failure detection. If the proxy will go down for some reason router will keep redirecting the traffic causing internet access outage.

Routers other than Cisco equipment should also have an option to configure policy based routing.

/Artur

Ps. It's not possible to place the WSA in-line between clients and the internet.

View solution in original post

4 Replies 4

Artur Nowicki
Cisco Employee
Cisco Employee

Hi Stephane

The only alternative to WCCP is PBR (Policy Based Routing). With a simple configuration on the router you can redirect traffic defined as interesting by access list to WSA. On the WSA you need to configure transparent mode (Security Services -> Web Proxy -> Edit Settings -> Proxy Mode: Transparent). You also need to assure that proxy is listening on the port 80 and that HTTPS proxy is enabled (on port 443) if you want to redirect the HTTPS traffic as well. 

Sample configuration for Cisco router

 

!
access-list 110 permit tcp any any eq www
!
route-map proxy-redirect permit 10
match ip address 110
set ip next-hop xxx.xxx.xxx.xxx
!
interface ethernet0/1
ip policy route-map proxy-redirect
!

 

xxx.xxx.xxx.xxx is the proxy IP in such case and access-list 110 defines web traffic (HTTP TCP/80) as interesting.


The biggest disadvantage of such solution is lack of failure detection. If the proxy will go down for some reason router will keep redirecting the traffic causing internet access outage.

Routers other than Cisco equipment should also have an option to configure policy based routing.

/Artur

Ps. It's not possible to place the WSA in-line between clients and the internet.

Thank you for your answer Artur, it helped a lot.

Stephane

I have an additional question, is it possible to use Cisco ASA as a wccp router ?

Hi Stephane

Yes, you can use Cisco ASA as WCCP redirecting device. You need to remember that WCCP redirection is supported only on the ingress of an interface. The only topology that the ASA supports is when client and cache engine are behind the same interface of the ASA and the cache engine can directly communicate with the client, without going through the ASA.

Details:

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116046-config-wccp-asa-00.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_wccp.html

/Artur

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: