topic Re: Proxy Server in DMZ in Network Security

Proxy Server in DMZ

rmujeeb81 — Mon, 11 Mar 2019 18:07:29 GMT

Dear All,

I have an ASA 5520 with inside, outside, and DMZ interfaces. I want to install a proxy server in DMZ and have all my inside hosts go to the proxy first, before accessing the internet. If I don't want to configure a proxy-server address on each of my internal hosts, is there a way to configure port redirection on the ASA to automaticaly send all outbound internet traffic to the proxy server?

Thanks

Re: Proxy Server in DMZ

Jennifer Halim — Sun, 04 Jul 2010 07:10:14 GMT

ASA only supports N2H2 or Websense to perform URL filtering via the ASA itself, without having to configure proxy server settings on the inside hosts.

Alternatively, if the proxy server supports WCCP, that also works with ASA, however, proxy server needs to be connected to the inside interface as well where the internal hosts are connected. Proxy server can't be connected to the DMZ while the traffic is from inside.

Hope that helps.

Re: Proxy Server in DMZ

rmujeeb81 — Sun, 04 Jul 2010 07:21:41 GMT

Hi,

The proxy is actually ISA and we will install it in DMZ as one leg design. If there is no option to redirect web traffic to ISA then we have last option of using proxy ip address in web browsers ?

Thanks

Re: Proxy Server in DMZ

Jennifer Halim — Sun, 04 Jul 2010 07:23:44 GMT

Unfortunately there is no other option on ASA but to configure the proxy ip address on the web browser.

Re: Proxy Server in DMZ

rmujeeb81 — Sun, 04 Jul 2010 07:49:46 GMT

Hi,

Thanks for your response.

What about using WCCP,

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_wccp.html

Thanks

Re: Proxy Server in DMZ

Jennifer Halim — Sun, 04 Jul 2010 08:38:17 GMT

As advised earlier, WCCP will only work if the proxy server is in the inside network, not when it's on DMZ.

WCCP only supports traffic being redirected through the same interface.

As per the following:

WCCP redirect is supported only on the ingress of an interface. The only topology that the adaptive security appliance supports is when client and cache engine are behind the same interface of the adaptive security appliance and the cache engine can directly communicate with the client without going through the adaptive security appliance.

quoted from:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_wccp.html#wp1094628