Solved

Using WCCP on a Cisco ASA 5510 to route traffice to a BlueCoat

Posted on 2008-10-21
3
8,943 Views
Last Modified: 2011-10-19
I am trying to utilize Bluecoat web filtering by using WCCP from a Cisco Firewall ASA 5510.  Are there any suggestions as to setup or configurations?  Attached you will find a simple diagram of my infrastructure.


Simple-Diagram-RevA.pdf
0
Comment
Question by:DomacVin
3 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 125 total points
ID: 22791768
0
 
LVL 4

Assisted Solution

by:th3w01f
th3w01f earned 125 total points
ID: 22945436
Here is a working config.

I was reading the deployment guide for WCCP on the ASA and I found this.
WCCP redirect is supported only on the ingress of an interface. The only topology that the security appliance supports is when client and cache engine are behind the same interface of the security appliance and the cache engine can directly communicate with the client without going through the security appliance.

My testing showed this to be true; the only way I was able to get WCCP working on the ASA was to have the cache attached to the same interface that the client traffic entered the ASA (inside). There does not appear to be a way to get WCCP working for a device attached to a DMZ port when client traffic enterers the ASA from the inside interface.

ASA Configuration;

access-list wccp extended permit tcp host 192.168.31.32 any log debugging (192.168.31.32 is my client machine)
access-list wccp extended permit tcp 192.168.12.0 255.255.255.0 any log debugging (192.168.12.0/24 is my server subnet)
wccp 90 redirect-list wccp
wccp interface inside 90 redirect in
wccp interface SHNet 90 redirect in (this is the port that my server subnet is connected to)
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Is this network design suitable? 3 62
Cisco 2800 SNMP - false power supply alert? 3 45
How to make my old USB printer wireless? 71 151
Packet Tracer Router to Router 10 56
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now