topic Hi Adeolu,Is there any other in Network Security

Redirecting http traffic to the proxy server

rajath.poovanna — Tue, 12 Mar 2019 05:39:26 GMT

Hi,

We have a requirement to divert web traffic to blue coat proxy through firewall. Below is the setup

Requirement:

We need to divert web traffic from 10.20.200.0/23 [DMZ-STAFFNET] and point it to Bluecoat proxy to process the packets.

Now that ASA doesn't support PBR to accomplish this, how can we accomplish this ?

Hi Rajath,Is the Bluecoat

Adeolu Owokade — Sat, 21 Mar 2015 05:16:54 GMT

Hi Rajath,

Is the Bluecoat proxy WCCP-enabled? If yes, then maybe this Cisco guide will help you: http://www.cisco.com/c/en/us/td/docs/security/asa/special/wccp/guide/asa-wccp.html

Hi Adeolu,Is there any other

rajath.poovanna — Sat, 21 Mar 2015 07:46:54 GMT

Hi Adeolu,

Is there any other way to accomplish the requirement without WCCP.

best,

Rajath

Have you thought about

Andre Neethling — Sat, 21 Mar 2015 16:38:54 GMT

Have you thought about "Destination NAT" (Twice NAT) as a static NAT rule. It may work for you.

I did try creating the below

rajath.poovanna — Wed, 01 Apr 2015 04:00:29 GMT

I did try creating the below NAT rule, doing so bluecoat will only see the packets from DMZ-STAFFNET interface. Our requirement was to see the original source IP.

(DMZ-STAFFNET) to (bluecoat) source dynamic DMZ-STAFFNET interface   destination static internet proxy-server service original-http proxy-8080

So we switched to WCCP and everything is working fine for HTTP and HTTPS traffic via WCCP.

Hi,To list one limitation

Vibhor Amrodia — Wed, 01 Apr 2015 11:13:53 GMT

Hi,

To list one limitation that you might see in your scenario , You would only be able to redirect the subnets to the proxy from those subnets which are physically behind the interface where the WCCP server resides only. i.e. UNTRUST

Now , talking about the NAT , why don't you try this NAT if you don't want to NAT the Source part of the Traffic:-

(DMZ-STAFFNET) to (bluecoat) source static DMZ-STAFFNET DMZ-STAFFNET destination static internet proxy-server service original-http proxy-8080

Also , ASA now supports Policy Based routing from ASA 9.4.1 🙂

Thanks and Regards,

Vibhor Amrodia