Using WCCP to redirect 80 and 443 traffic to a BlueCoat ASA

Scott P123 — Tue, 12 Mar 2019 06:56:10 GMT

The site that I support needs to implement WCCP to redirect all 80 and 443 traffic to a BlueCoat ProxySG. We have implemented the following configuration, and it is functional on 443, but is not redirecting any 80 traffic. A capture is also included. Any help would be greatly appreciated.

ASA Config:

wccp 90 redirect-list WCCP_Users group-list WCCP_Proxy

wccp interface inside 90 redirect in

access-list WCCP_Proxy line 1 extended permit ip host 10.10.10.1 any

access-list WCCP_Users line 1 extended permit ip 10.20.0.0 255.255.255.0 any

Global WCCP information:

Router information:

Router Identifier: 10.30.1.1

Protocol Version: 2.0

Service Identifier: 90

Number of Cache Engines: 1

Number of routers: 1

Total Packets Redirected: 22536

Redirect access-list: WCCP_Users

Total Connections Denied Redirect: 0

Total Packets Unassigned: 84

Group access-list: WCCP_Proxy

Total Messages Denied to Group: 0

Total Authentication failures: 0

Total Bypassed Packets Received: 3069

Proxy Config:

Proxy1#sh wccp configuration

WCCP Configuration

;Version 1.3

State: Enabled

Version: 2

Service-group: 90

Password:

Priority: 220

Protocol: TCP

Ports-to-redirect: (all)

Interface: 0:0

Weight: 0 on 0:0

Assignment-type: Hash

Primary-hash: source-ip

Alternate-hash:

Forwarding-type: GRE

Returning-type: GRE

Home-routers: 10.30.1.1

Multicast-ttl: 1

Router-affinity: None

Capture:

1: 12:00:55.715203 10.20.0.20.59818>23.15.7.128.80: S 2155722468:2155755468(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>

Thank you in advance for the help.

Hi Scott,

Akshay Rastogi — Sat, 28 Nov 2015 16:48:51 GMT

Hi Scott,

Check the configuration/settings on bluecoat for the http traffic as ASA redirect the traffic on the basis of information exchanged between proxy server and ASA through 'i see you message'. If bluecoat shares that it could handle redirection for http then ASA would redirect the same.

Hope it helps.

Regards,

Akshay Rastogi

Remeber to rate helpful posts.

The below ACL will be more

Kias — Fri, 26 Aug 2016 07:06:38 GMT

The below ACL will be more precise

access-list wccp-http extended deny ip host <wccp server ip> any
access-list wccp-http extended permit tcp object-group <LAN subnet> any eq www

access-list wccp-https extended deny ip host <wccp server ip> any
access-list wccp-https extended permit tcp object-group <LAN subnet> any eq https

access-list wccp-server extended permit ip host <wccp server ip> any

topic Using WCCP to redirect 80 and 443 traffic to a BlueCoat ASA in Network Security

Using WCCP to redirect 80 and 443 traffic to a BlueCoat ASA

Hi Scott,

The below ACL will be more