topic Re: Transparent redirection ASA & WSA in Network Security

Transparent redirection ASA & WSA

Tuba — Sun, 29 Sep 2019 14:51:06 GMT

Should I enable the proxy manually in the client machine when I configured Transparent redirection in ASA?

I know In Transparent Mode, the client is unaware of the presence of the web proxy. but my ASA is not redirecting traffic to WSA unless I configure the proxy in a machine.

Appreciate your help.

Re: Transparent redirection ASA & WSA

Marius Gunnerud — Sun, 29 Sep 2019 14:56:51 GMT

You should not have to enable the proxy on the machine. Have you double checked your configuration on the ASA, that the ACL IPs are correct and being matched on?

Check out this link for configuration tips:

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117810-configure-wsa-00.html

Re: Transparent redirection ASA & WSA

Oleg Volkov — Sun, 29 Sep 2019 17:33:40 GMT

Hi.

We need configure WCCP group on WSA and ASA, also we need configure routes on WSA.

And also You need create ACL for permit traffic to WSA throught WCCP

If You need, I can assist You.

PS.

ASA and WSA must be in single L2 segment - inside.

Re: Transparent redirection ASA & WSA

balaji.bandi — Sun, 29 Sep 2019 18:19:07 GMT

As suggested other post, you need to setup WCCP and redirection,

If you WSA behind ASA both the interface you need to have correct FW rules and configured correctly.

Re: Transparent redirection ASA & WSA

Tuba — Mon, 30 Sep 2019 13:00:43 GMT

WSA

access-list ACL-IRONPORT-WSA extended permit ip host 10.0.254.14 any
access-list ACL-IRONPORT-WSA extended permit ip host 10.0.254.13 any

Network

access-list ACL-WEB extended permit tcp 10.0.254.8 255.255.255.248 any eq www
access-list ACL-WEB-TRAFFIC extended permit tcp 10.0.254.8 255.255.255.248 any eq 443

wccp web-cache redirect-list ACL-WEB-TRAFFIC group-list ACL-IRONPORT-WSA
wccp 90 redirect-list ACL-WEB-TRAFFIC group-list ACL-IRONPORT-WSA
wccp interface FW_EXT_Core web-cache redirect in
wccp interface FW_EXT_Core 90 redirect in

Re: Transparent redirection ASA & WSA

Oleg Volkov — Mon, 30 Sep 2019 16:31:35 GMT

Can You show settings on WSA (WCCP)?

Re: Transparent redirection ASA & WSA

Tuba — Mon, 30 Sep 2019 17:36:53 GMT

name WCCP

Dynamic 90

ports 80,443

hash only

GRE only

Also, I removed web cache configurations and attached the image of WSA.

Re: Transparent redirection ASA & WSA

Oleg Volkov — Tue, 01 Oct 2019 09:50:23 GMT

Please provide me

sh wccp 90 and

sh wccp 90 detail from asa.

And do packet tracer like:

packet-tracer input inside tcp <inside host IP> 4567 77.88.8.8 80