topic Using WCCP to redirect traffic to a Palo Alto Web Proxy in Network Security

Using WCCP to redirect traffic to a Palo Alto Web Proxy

Chess Norris — Thu, 22 Jan 2026 12:15:02 GMT

Hello,

If we want to use WCCP on a FTD firewall to redirect web traffic to a Palo Alto Web Proxy, is that possible?

I know that Palo Alto doesn't support WCCP but since it would be a Cisco device doing the re-direction, does the receiving device need to support WCCP as well?

Thanks

/Chess

Re: Using WCCP to redirect traffic to a Palo Alto Web Proxy

balaji.bandi — Thu, 22 Jan 2026 12:22:07 GMT

As per i know both the devices need to support WCCP.

what is the use case here, May be you can try PBR to re-route the traffic

Since you cannot use WCCP, you should use one of the following standard methods to send traffic from your Cisco FTD to the Palo Alto proxy.

Policy-Based Routing (PBR): Configure a PBR rule on the Cisco FTD (or an upstream router) to match web traffic (ports 80/443) and change the next-hop to the Palo Alto's interface IP. This is the most common substitute for WCCP as it does not require protocol negotiation.

or you can use PAC or WPAD file if you like to Proxy explicitly

Re: Using WCCP to redirect traffic to a Palo Alto Web Proxy

Chess Norris — Thu, 22 Jan 2026 12:27:25 GMT

Thank you. Yes, in that case I guess we need to use PBR which should work.

We have not decided yet if we should go for a transparent or explicit proxy solution. I guess there are advantages and disadvantages with both.

/Chess

Re: Using WCCP to redirect traffic to a Palo Alto Web Proxy

balaji.bandi — Thu, 22 Jan 2026 12:32:38 GMT

Sure always Pros and cons of every deployment, this is based on requirement of business.

Re: Using WCCP to redirect traffic to a Palo Alto Web Proxy

Cristian Matei — Sun, 25 Jan 2026 10:50:13 GMT

Hi,

@Chess Norris As for palo's proxy (transparent vs. explicit proxy), for transparent you need SSL/TLS decryption, just to keep that in mind.

Instead of doing PBR on the FTD, I would put Palo in-line (south or north) to FTD. In both cases, if all web traffic is inspected by Palo, on FTD I would configure prefiler policy for web traffic, to avoid double trouble / aka FTD will not perform any inspections above layer 4.

Thanks,

Cristian.

Re: Using WCCP to redirect traffic to a Palo Alto Web Proxy

Chess Norris — Sun, 25 Jan 2026 10:25:14 GMT

Thank you for the feedback. Much appreciated.

/Chess