topic Thanks - could you clarify in Network Security

WCCP failure - packets forwarded

edw — Tue, 26 Mar 2019 00:55:42 GMT

Hi,

I've set-up WCCP which has been working great. However I have found out that when the proxy is offline that traffic is being forward out of the appliance regardless. What I want is my traffic to be filtered by the proxy and if the proxy is offline no traffic is passed ? Is this possible ?

Thanks

Hi,Not available currently

Vibhor Amrodia — Fri, 24 Apr 2015 05:06:57 GMT

Hi,

Not available currently.

This is the enhancement:- CSCtl20957 and will hopefully be integrated in future.

https://tools.cisco.com/bugsearch/bug/CSCtl20957/?reffering_site=dumpcr

Thanks and Regards,

Vibhor Amrodia

Thanks - unfortunately I don

edw — Fri, 24 Apr 2015 14:34:12 GMT

Thanks - unfortunately I don't have access to that bug.

What do users do at present to deal with this, just let unfiltered traffic through ?

Thanks

Hi,If you want , i can

Vibhor Amrodia — Fri, 24 Apr 2015 18:07:39 GMT

Hi,

If you want , i can provide a Workaround for this as well.

You can create an outbound ACL on the Outside interface allowing only the WCCP services for the Source as WCCP server IP and denying the rest of the WCCP services traffic.

Also at the end , put a permit ip any any.

Thanks and Regards,

Vibhor Amrodia

Thanks - could you clarify

edw — Mon, 27 Apr 2015 14:50:20 GMT

Thanks - could you clarify this a bit more ?

At present I have a ACL for redirecting traffic to the proxy. I have outbound ACL for all traffic allowed including the proxy and internal clients.

My understanding is in the outbound ACL I have to have a ACL for the client to be allowed to use HTTP and also the proxy to use HTTP. If I remove the client ACL it stops the client flow-through whether going through the proxy or not.

Thanks

Ed

Thanks - could you clarify

edw — Mon, 27 Apr 2015 14:51:46 GMT

Thanks - could you clarify this a bit more ?

At present I have a ACL for redirecting traffic to the proxy. I have outbound ACL for all traffic allowed including the proxy and internal clients.

Thanks

Ed

Thanks - could you clarify

edw — Mon, 27 Apr 2015 14:54:13 GMT

Thanks - could you clarify this a bit more ?

At present I have a ACL for redirecting traffic to the proxy. I have outbound ACL for all traffic allowed including the proxy and internal clients.

Thanks

Ed

Hi,I think the ACL you are

Vibhor Amrodia — Tue, 28 Apr 2015 04:17:28 GMT

Hi,

I think the ACL you are pointing at is the ACL on the Inside interface.

I was recommending to put an acl on the Outside interface in the OUT direction and only allow the traffic out only from the source which is the IP address of the proxy.

So something like this:-

access-list wccp-fail-close permit tcp host <wccp server ip> any eq 443

access-list wccp-fail-close permit tcp host <wccp server ip> any eq 80

access-list wccp-fail-close deny tcp any any eq 443

access-list wccp-fail-close deny tcp any any eq 80

access-list wccp-fail-close permit ip any any

Thanks and Regards,

Vibhor Amrodia

Thanks - sorry about the

edw — Tue, 28 Apr 2015 13:12:47 GMT

Thanks - sorry about the duplicate replies, my browser went nuts.

My understanding for this is that I can only have one ACL per interface ? I currently have inbound ACLs on three interfaces. One per interface. Would I have to change my outside interface (internet facing) to have a ACL which is in the OUT direction and lose my IN direction ACL ?

Thanks

Hi,This Outbound ACL that you

Vibhor Amrodia — Tue, 28 Apr 2015 13:40:03 GMT

Hi,

This Outbound ACL that you are referring to is on which interface ? Inside ? Correct ?

I was recommending you an ACL in OUT direction on the outside interface where the connection will be sourced from the proxy IP to the internet.

If you have an ACL on the inside for the Outbound traffic , that would not affect the traffic or this workaround.

You can check the order in which the ACL are used using Packet Tracer:-

https://supportforums.cisco.com/document/29601/troubleshooting-access-problems-using-packet-tracer

Thanks and Regards,

Vibhor Amrodia