topic Hi,It is not supported and i in Network Security

WCCP "Whitelist" Redirect List Using FQDN?

jaksptr99 — Tue, 12 Mar 2019 05:53:30 GMT

Hi all,

I've tried to make a redirect list to some traffic from ASA to Websense. This is part of the configuration:

......

wccp 0 redirect-list REDIRECT_WCCP group-list WEBSENSE
wccp 70 redirect-list REDIRECT_WCCP group-list WEBSENSE
wccp interface inside 0 redirect in

......

access-list REDIRECT_WCCP remark AB
access-list REDIRECT_WCCP extended deny ip host 10.xxx.xxx.xxx any
access-list REDIRECT_WCCP remark VPN
access-list REDIRECT_WCCP extended deny ip any host 211.xxx.xxx.xxx
access-list REDIRECT_WCCP remark PI
access-list REDIRECT_WCCP extended deny ip any host 117.xxx.xxx.xxx

access-list REDIRECT_WCCP extended permit ip object guest-wireless any
access-list REDIRECT_WCCP extended permit ip 10.xxx.xxx.xxx 255.255.254.0 any
access-list REDIRECT_WCCP extended permit ip 10.xxx.xxx.xxx 255.255.255.0 any
access-list REDIRECT_WCCP extended permit ip 10.xxx.xxx.xxx 255.255.254.0 any
access-list REDIRECT_WCCP extended permit ip 10.xxx.xxx.xxx 255.255.254.0 any

.......

and here is the rough topologi:

[Router]

[ASA]

[Distribution,Clients,etc] ---- [Websense]

From the configuration, it is working well with IP addresses. Note that the DENY means the packet is "Whitelisted" and will not be redirected by WCCP to Websense (WCCP will bypass certain traffic); otherwise the PERMIT means the packet will be redirected to Websense.

Now the PROBLEM is that we need to make the "Whitelist" work with FQDN/domain name, since we are connected with domain that has dynamic IP addresses that changes everytime and it willl be sometimes inaccurate hence time consuming too.

Is that any ALTERNATIVES or a simple solution for this?

Any kind of references or help will be much appreciated.

Sincerely thank you for the help.

Jack.

Hi,You would not be able to

Vibhor Amrodia — Wed, 06 May 2015 03:54:16 GMT

Hi,

You would not be able to use FQDN based ACL's with the WCCP redirect list.

Thanks and Regards,

Vibhor Amrodia

Thank you for your response.

jaksptr99 — Wed, 06 May 2015 08:31:52 GMT

Thank you for your response. Unfortunately we need FQDN to resolve some domains for Office 360 and Microsoft Lync.

Do you have any other suggestion? maybe like creating new rules or object,or maybe minor tweaking in architecture or something?

Thank you.

Jack.

Hi,It is not supported and i

Vibhor Amrodia — Wed, 06 May 2015 11:05:13 GMT

Hi,

It is not supported and i don't think there can be any workaround for this issue on the ASA device.

Thanks and Regards,

Vibhor Amrodia

ok Vibhor, after searching

jaksptr99 — Fri, 08 May 2015 03:27:14 GMT

ok Vibhor, after searching for some references, it is clear that this is not supported.

thank you.

Jack.

Hi,I a[apologize but this is

Vibhor Amrodia — Fri, 08 May 2015 13:05:23 GMT

Hi,

I a[apologize but this is not yet supported. I think this might be integrated in the ASA code but not sure about the timeline and the requirement for this feature.

Thanks and Regards,

Vibhor Amrodia

I'm having the same issues

ciscor1senb — Thu, 03 Nov 2016 14:52:06 GMT

I'm having the same issues and want to define FQDN names in ACL's to whitelist o365 domains in WCCP ACL policy. I'm running WCCP on a C3850 IOS-XE 3.07.00E. I'm wondering you can work with passthru-domain-list and apply it to the ACL WCCP policy in some way?

Re: WCCP "Whitelist" Redirect List Using FQDN?

lori_woodward@acmestores.com — Wed, 08 Aug 2018 13:53:16 GMT

Not sure if you know but it appears to be working on my ASA. I am running a 5512x with version 9.9.2(1)

But even just recently with this bug ID https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuu26174/?rfs=iqvred it states still not supported. I recently setup up some FQDN, not thinking, for a particular vendor we are having proxy issues with and it allowed me to create an object-group with FQDN and place that group in the ACL for WCCP......