topic Re: WSA Router Identifier is taking highest IP:DMZ instead of inside in Web Security

WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Sat, 09 Mar 2019 03:43:36 GMT

WSA---->L3_SWITCH----->(inside)ASA(dmz)----

++ASA is not redirecting packets to WSA however i see The HELLOS are exchanged.

++L3 switch has a route to reach ASA DMZ interface.

++In WSA i have configured both inside and DMZ ip under WSA>transparent redirection>router ip address

WCCP-PKT:S00: Received valid Here_I_Am packet from 10.101.68.200 w/rcv_id 00000043

WCCP-PKT:S00: Sending I_See_You packet to 10.101.68.200 w/ rcv_id 00000044

Global WCCP information:
Router information:
Router Identifier: 192.168.243.254
Protocol Version: 2.0

Service Identifier: web-cache
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 0
Redirect access-list: wccp_traffic
Total Connections Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: wccp-server
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0

Could you pls let me know if iam missing something

Appreciate your help!

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

Ken Stieers — Wed, 31 Jan 2018 19:29:21 GMT

What version of ASA code are you running?

I seem to remember having an issue like this on 8.2 or 8.4???? I'll go digging in my tickets...

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Wed, 31 Jan 2018 19:33:34 GMT

Thanks for responding..

version:- 9.8(2)

Please feel free to let me know if you need any kind of information reg setup or config

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Wed, 31 Jan 2018 20:10:16 GMT

FYI here is the config in ASA:-

WSA----L3_switch-----(inside)ASA(dmz)

WSA IP:-10.101.68.200

ASA inside ip:-10.101.71.65

ASA DMZ ip:-192.168.243.254 ---->Highest ip address

Configuration:-

-----------

wccp 90 redirect-list wccp_traffic group-list wccp-server
wccp interface inside 90 redirect in

access-list wccp-server extended permit ip host 10.101.68.200 any

access-list wccp_traffic extended permit tcp host 10.101.64.112 any eq www
access-list wccp_traffic extended permit tcp host 10.101.64.112 any eq https
access-list wccp_traffic extended deny ip any any

Show command output:-

--------------------

###sh wccp 90

Global WCCP information:
Router information:
Router Identifier: 192.168.243.254
Protocol Version: 2.0

Service Identifier: 90
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 0
Redirect access-list: wccp_traffic
Total Connections Denied Redirect: 1675
Total Packets Unassigned: 0
Group access-list: wccp-server
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0

###sh wccp 90 detail:-

WCCP Cache-Engine information:
Web Cache ID: 10.101.68.200
Protocol Version: 2.0
State: Usable
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Hash Allotment: 0 (0.00%)
Packets Redirected: 0
Connect Time: 03:00:16

###sh wccp 90 view
WCCP Routers Informed of:
192.168.243.254

WCCP Cache Engines Visible:
10.101.68.200

WCCP Cache Engines NOT Visible:
-none-

##Dubugs hello packets

WCCP-PKT:D90: Sending I_See_You packet to 10.101.68.200 w/ rcv_id 00000417

WCCP-PKT:D90: Received valid Here_I_Am packet from 10.101.68.200 w/rcv_id 00000417

Configuration on WSA:-

--------------------

Allow GRE only for forward and return packet

Allow Hash only

router ip address: 192.168.243.254, 10.101.71.65

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

Ken Stieers — Wed, 31 Jan 2018 22:19:13 GMT

Looking at mine in production, the router identification is NOT the interface that is connected.

Its the highest IP on the ASA. Did a little digging, and I'm pretty sure that's just how the ASA works. (see my show wccp below)

My bug was in 9.1.1 (CSCue02226)... unrelated...

My WCCP config doesn't have a server list, I just use the password.

Are you trying to surf from 10.101.64.112

Global WCCP information:
    Router information:
Router Identifier:                   172.25.0.1
Protocol Version:                    2.0

    Service Identifier: 90
Number of Cache Engines:             1
Number of routers:                   1
Total Packets Redirected:            36880541
Redirect access-list:                WCCP_Redirect
Total Connections Denied Redirect:   609
Total Packets Unassigned:            658
Group access-list:                   -none-
Total Messages Denied to Group:      0
Total Authentication failures:       0
Total Bypassed Packets Received:     65925

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Thu, 01 Feb 2018 10:01:46 GMT

yes. I'm trying to surf from 10.101.64.112.

Could you tell me if it using DMZ IP or Inside IP to contact WSA?

because the HELLOS are exchanged, but probably the engine is rejecting the wccp GRE packets from the router id or viceversa.

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

Ken Stieers — Fri, 02 Feb 2018 00:20:59 GMT

The communication would be over the inside IP/port.

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Fri, 02 Feb 2018 05:05:46 GMT

WSA-10.101.68.200---->L3_switch----->(inside-10.101.71.65)ASA(dmz-192.168.23.254)

I have turned on captures in ASA inside interface
I see WSA is communicating with both Inside and DMZ.

First capture:- WSA--communicating with---->Inside interface of ASA
============

1: 05:47:42.409005 10.101.68.200.2048 > 10.101.71.65.2048: udp 120
2: 05:47:42.409082 10.101.71.65.2048 > 10.101.68.200.2048: udp 140
3: 05:47:52.424569 10.101.68.200.2048 > 10.101.71.65.2048: udp 120
4: 05:47:52.424630 10.101.71.65.2048 > 10.101.68.200.2048: udp 140
5: 05:48:02.380153 10.101.68.200.2048 > 10.101.71.65.2048: udp 120
6: 05:48:02.380214 10.101.71.65.2048 > 10.101.68.200.2048: udp 140

Second capture:-WSA---communicating with--->DMZ interface of ASA -===>BOLOCKED
==============
packet tracer shows:- Drop-reason: (no-route) No route to host

1: 05:47:32.393366 10.101.68.200.2048 > 192.168.243.254.2048: udp 148
2: 05:47:42.408975 10.101.68.200.2048 > 192.168.243.254.2048: udp 148
3: 05:47:52.424523 10.101.68.200.2048 > 192.168.243.254.2048: udp 148

So why WSA is talking to DMZ interface then? As far as i know by design we cannot talk/communicate to ASA's other interface IP.

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

Ken Stieers — Fri, 02 Feb 2018 10:54:07 GMT

What does the configuration on the WSA look like? Just because the ASA says that's its ID is the DMZ ip, you still configure the WSA to do WCCP with the ip of the ASA inside interface.

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Fri, 02 Feb 2018 11:56:33 GMT

I have Both inside and DMZ IP address in WSA

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

rasri8@inter-ikea.com — Fri, 02 Feb 2018 11:58:17 GMT

I gave both inside and DMZ ip address in WSA

Re: WSA Router Identifier is taking highest IP:DMZ instead of inside

Ken Stieers — Fri, 02 Feb 2018 12:48:07 GMT

The wsa should only have the ASA inside ip...