topic Re: WCCP Redirection on Firepower FTD 4110 in Network Security

WCCP Redirection on Firepower FTD 4110

vantom85cisco — Fri, 21 Feb 2020 16:08:28 GMT

Hi Folks,

I have one Q regarding WCCP, currently we have FTD as internet facing FW with 3 interface:

Inside: connected with another DC FW

Outside: to internet

DMZ : DMZ servers and WSA

With above design we have WSA in transparent mode and any request to internet should be redirected by FTD to WSA then to internet excluding any (80,443 as well) requests to DMZ servers .

how can i configure WCCP on FTD ,Or is there any other suggestion based on best practise .

Thanks

Re: WCCP Redirection on Firepower FTD 4110

Terry Grant — Thu, 23 Aug 2018 13:29:04 GMT

You have to use Flex Config. FMC has a template you can copy and modify. I just did this with 2110, but not tested yet.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/flexconfig_policies.html?bookSearch=true

Re: WCCP Redirection on Firepower FTD 4110

vantom85cisco — Thu, 23 Aug 2018 18:25:49 GMT

Actually am facing some challenges to customize it ,can you paste what you have done please and replace password or ip with x.x.x.x

Re: WCCP Redirection on Firepower FTD 4110

Terry Grant — Thu, 23 Aug 2018 18:59:17 GMT

I made a copy of the WCCP template and used it as it was, even used the same variable names. Use the insert button to enter your variables. Create your ACLs before editing the flex config so they are available to assign when you insert the variable. Here is a screenshot, again I have not tested this config yet.

Re: WCCP Redirection on Firepower FTD 4110

Terry Grant — Wed, 29 Aug 2018 12:30:28 GMT

I was able to do some testing and got the WCCP redirection working, with some TAC help. The out of the box template had to be modified for this use case.

This was an FTD 2110 deployment, the client was not ready to use native URL filtering on the FTD, they wanted to continue to use a third party appliance via WCCP redirection.

I used two FlexConfig objects to deploy the configuration for service 0 (http) and service 70 (https). The FlexConfig deployed this CLI configuration to the FTD.

wccp 0 redirect-list WS-Redirect group-list WS-Gateway
wccp 70 redirect-list WS-Redirect group-list WS-Gateway
wccp interface inside 0 redirect in
wccp interface inside 70 redirect in

Re: WCCP Redirection on Firepower FTD 4110

Scott_22 — Fri, 05 Apr 2019 20:40:27 GMT

When you created your variables, did you have to add one for the inside interface?

Re: WCCP Redirection on Firepower FTD 4110

Terry Grant — Mon, 08 Apr 2019 12:38:35 GMT

No I didn't, the variable $interfacename was already in the template, just supply the appropriate name in the variables list of the template. In this use case I used the security zone to reference the appropriate interface.

Re: WCCP Redirection on Firepower FTD 4110

zac ragoonath — Tue, 15 Aug 2023 21:34:15 GMT

Can you post a pic where you set the service = 0 please?