topic Re: WCCP with https redirection on ASA in Network Security

WCCP with https redirection on ASA

mrbzumrbzu — Mon, 11 Mar 2019 17:47:08 GMT

Hi All,

I have tried the wccp http redirection on firewall with squid server and it runs ok then i have tried the wccp https redirection on firewall, its not working. the request goes straight through the firewall. Is the wccp supports https redirection or is only working for http only... your answer will be appriciated.

Regards

Re: WCCP with https redirection on ASA

aresiusxp — Tue, 18 May 2010 14:34:43 GMT

Were you able to make it work? Maybe you can help me.

https://supportforums.cisco.com/message/3074818#3074818

I'm sorry i don't an answer to your question.

Re: WCCP with https redirection on ASA

Panos Kampanakis — Tue, 18 May 2010 16:50:11 GMT

It should work with https also.

Make sure your wccp service is configured for both port 80 and 443, or else the ASA will not redirect https.

The ASA will talk to the engine and agree on the ports supported on the service and then redirect.

I hope it helps.

Re: WCCP with https redirection on ASA

mrbzumrbzu — Wed, 19 May 2010 08:07:24 GMT

Hi PK,

thanks for reply. Is i have to use the dynamic service numbers? dynamic service numbers are from 0-254 so 443 doesn't in the range

I have created access list for redirection for https traffic and applied it on webcache but it didn't work and firewall passes this to the internet. Please help me to understand the service numbers and how to implement them. it will be very grateful.

Patricio,

PK is right, routing on your squid box will solve the problem. add the router (firewall outside interface) pointing to the the firewall inside interface IP.

Regards

Re: WCCP with https redirection on ASA

mrbzumrbzu — Wed, 19 May 2010 08:31:40 GMT

Hi PK,

I have found that service group 70 is for https so i have configured accordingly but its not working and not seeing any hits as well

Global WCCP information:
Router information:
Router Identifier: 193.193.1.130

Protocol Version: 2.0

    Service Identifier: web-cache
Number of Cache Engines:             1
Number of routers:                   1
Total Packets Redirected:            531
Redirect access-list:                WCCP-http
Total Connections Denied Redirect:   0
Total Packets Unassigned:            0
Group access-list:                   WCCP-Proxy-Group

Total Messages Denied to Group:      0
Total Authentication failures:       0
Total Bypassed Packets Received:     0

   Service Identifier: 5
Number of Cache Engines:             0
Number of routers:                   0
Total Packets Redirected:            0
Redirect access-list:                WCCP-ftp
Total Connections Denied Redirect:   0
Total Packets Unassigned:            0
Group access-list:                    WCCP-Proxy-Group

Total Messages Denied to Group:      0
Total Authentication failures:       0
Total Bypassed Packets Received:     0

    Service Identifier: 70
Number of Cache Engines:             0
Number of routers:                   0
Total Packets Redirected:            0
Redirect access-list:                WCCP-https
Total Connections Denied Redirect:   0
Total Packets Unassigned:            0
Group access-list:                    WCCP-Proxy-Group

Total Messages Denied to Group:      0
Total Authentication failures:       0
Total Bypassed Packets Received:     0

Re: WCCP with https redirection on ASA

mrbzumrbzu — Wed, 19 May 2010 10:33:42 GMT

Hi,

After making few changes on squid for WCCP, the ASA now redirecting that traffic to squid but squid is giving error message unsupported type. will do some more investigation on this.. do any body know what specific changes are required on squid to make this working. squid is running in transparent mode.

regards

Re: WCCP with https redirection on ASA

mrbzumrbzu — Mon, 24 May 2010 15:43:57 GMT

Hi ,

Is any body know that WCCP works with squid for https traffic? I am finding difficulty in working with them and failed to have working setup. neeither i have found any thing on internet for this....

Regards

Re: WCCP with https redirection on ASA

brquinn — Mon, 24 May 2010 19:55:33 GMT

Greetings,

According to the main squid page, http is supported: "Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more."

http://www.squid-cache.org/

There are a lot of good configuration examples on this site as well, but their ASA config example is not ideal.

http://wiki.squid-cache.org/ConfigExamples/Intercept/CiscoAsaWccp2

The config example on the page linked above uses a redirect-list ACL with the www port defined. This is incorrect because the ASA decides what services are sent to the web-cache server based on what is negotiated for that service with the server. This means two things. 1) You should define your redirect-list ACL with all IP traffic and let the negotiation with the squid wccp server. 2) you need a sepearate redirect service number for each service type; http, https, ftp, etc.

Corrected config:

! Configure hosts to be redirected, exempt the squid server

access-list wccp_redirect extended deny ip host $SQUID-IP any
access-list wccp_redirect extended permit ip WORKSTATIONS 255.255.255.0 any

! Define the default rule for http traffic
wccp web-cache redirect-list wccp_redirect password foo

! Additional rule for https traffic where 70 corresponds with the service # on the squid server

wccp 70 redirect-list wccp_redirect password foo

! Apply both rules to the inside interface

wccp interface inside web-cache redirect in
wccp interface inside 70 redirect in

I hope this helps.

Thanks,

Brendan

Re: WCCP with https redirection on ASA

NeverOutofTune — Fri, 04 Jun 2010 20:28:24 GMT

Would this work for VPN users terminating in the ASA, either as clients or LAN-LAN tunnels? It does appear it wouldn't since the VPN users would not be on the same interface as the squid box.

Re: WCCP with https redirection on ASA

Panos Kampanakis — Fri, 04 Jun 2010 21:49:43 GMT

You are right, it will not work, for the reason that you mentioned.

Re: WCCP with https redirection on ASA

NeverOutofTune — Sat, 05 Jun 2010 18:13:10 GMT

I will be looking into using the VPN Tunnel Default Gateway feature as discussed here: https://cisco-support.hosted.jivesoftware.com/thread/2011160

I should be able to set an internal layer 3 switch as the Tunne Default Gateway and have all VPN traffic go inside then be routed back out and subjected to the web filter (either inline or WCCP). I'll post my result in a few weeks.

Re: WCCP with https redirection on ASA

contik — Wed, 09 Jun 2010 03:50:26 GMT

I have a PIX 515.

I did exactly that what you have written, but https-traffic still coming without proxy directly through PIX to the internet.

With HTTP-traffic all OK. I see it on my squid proxy.

If i set proxy for HTTPS in InternetExplorer manually - https going through squid.

Is the PIX able to route HTTPS/FTP via WCCP ?

Thank you!

Re: WCCP with https redirection on ASA

Panos Kampanakis — Wed, 09 Jun 2010 12:33:16 GMT

What version is the PXI running?

HTTP should work as long as the squid service supports https.

Re: WCCP with https redirection on ASA

contik — Wed, 09 Jun 2010 13:18:07 GMT

oops, sorry for incomplete information about PIX

PIX515E with OS PIX 8.04

with HTTP here is no problem! Everything is going through GRE-tunnel on SQUID proxy.

But HTTPS or FTP (for ex.) going DIRECTLY through PIX, without any proxy and when look on tcpdump there is no any activity on squid server, when i going to https-sites

Re: WCCP with https redirection on ASA

Panos Kampanakis — Wed, 09 Jun 2010 13:32:41 GMT

It should work fine.

Make sure you squid service that the PIX is using has https and ftp ports in it.

Re: WCCP with https redirection on ASA

contik — Wed, 09 Jun 2010 14:01:16 GMT

ok, here is what PIX respond:

pix# show wccp

Global WCCP information:
    Router information:
        Router Identifier:                   192.168.1.1
        Protocol Version:                    2.0

    Service Identifier: web-cache
        Number of Cache Engines:             1
        Number of routers:                   1
        Total Packets Redirected:            1890789
        Redirect access-list:                wccp_redirect
        Total Connections Denied Redirect:   1
        Total Packets Unassigned:            68
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total Bypassed Packets Received:     0

    Service Identifier: 70
        Number of Cache Engines:             1
        Number of routers:                   1
        Total Packets Redirected:            0
        Redirect access-list:                wccp_redirect
        Total Connections Denied Redirect:   0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total Bypassed Packets Received:     0

and some strings from squid.conf:

wccp2_router 123.45.67.89

wccp2_service standard 0
wccp2_service dynamic 70

wccp2_service_info 70 protocol=tcp flags=src_ip_hash,ports_source priority=240 port=443

Re: WCCP with https redirection on ASA

brquinn — Wed, 09 Jun 2010 14:17:51 GMT

and some strings from squid.conf:

wccp2_router 123.45.67.89

wccp2_service standard 0
wccp2_service dynamic 70

wccp2_service_info 70 protocol=tcp flags=src_ip_hash,ports_source priority=240 port=443

The ASA is recognizing the squid server for service 70, but not redirecting anything. I'm not sure if this is the only problem, but I do see one mistake in your squid config.

The Format is:

wccp2_service_info protocol= flags=,..

priority= ports=,..

You are missing the "S" in "ports=443".

Thanks,

Brendan

Re: WCCP with https redirection on ASA

Panos Kampanakis — Wed, 09 Jun 2010 14:30:29 GMT

Is the https hitting the web-cache service redirect ACL?

If it is matching on this one that it will not move to the service 70.

Re: WCCP with https redirection on ASA

contik — Wed, 09 Jun 2010 14:39:35 GMT

no, how i can check this? on the squid server no any activity for https-requests.

Re: WCCP with https redirection on ASA

ssantosh1978 — Mon, 01 Aug 2011 17:00:14 GMT

Vladimir,

you need to configure SSL on squid n order to support https on squid.. Note- Squid transparent mode will not work if you are going to use SSL on squid..

http://www.vmwareandme.com/2013/10/guide-how-to-redirect-http-traffic-from_23.html