Wsa query

[Vishal6]

Hi All,

I have to deployed Ftd Firewall (with Threat & malware protection licenses), WSA-S196-K9, and Umbrella in same Data Center. Need to know how does http, https traffic inspection would be here, and which device comes in which place.

[Ken Stieers]

What level of Umbrella do you have?

[Vishal6]

Dns advantage 

[Vishal6]

Any help please 

[amojarra]

Hello @Vishal6 

from WSA's perspective, you can deploy your WSA in two modes:
[1] Explicit Deployment, which is you configure your Client's to send their traffic to the WSA ( configuration can be done via PAC file, Group policy, manually editing the Proxy settings in the browser ...) 

[2] Transparent deployment, which is there will be a layer4 device ( router, firewall ...) that redirects every packet with destination port TCP/80 or TCP/443 to the WSA. 

Note: if your WSA and the Layer4 device is in a same subnet, you can use PBR or Layer2WCCP and if they are not you can configure your WCCP with GRE tunnel. 

Please allow me to share some links:

https://integratingit.wordpress.com/2022/02/25/wsa-transparent-proxy-using-wccp/

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117810-configure-wsa-00.html

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-mt/iap-15-mt-book/iap-wccp.html#GUID-A595C680-31D5-4D20-B4C1-52ED0B4B81A2

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such    ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[Vishal6]

Hi,

Need to know which traffic takes precedence as per my very first post

I have to deployed Ftd Firewall (with Threat & malware protection licenses), WSA-S196-K9, and Umbrella in same Data Center. Need to know how does http, https traffic inspection would be here, and which device comes in which place.

[Jonatan Jonasson]

The config you have for the WSA affects the answer (explicit, vs pac files, vs transparent via wccp, pbr or similar.)
And you don't mention URL filtering license in the FTD?
And is the FTD just for outbound traffic, or is the FTD also between clients and WSA / DNS servers (Umbrella VA)

So there are a number of "what about X?" aspects of this.

But if you think about if from a logical point of view, if you're using certain configuration in PAC files or transparent WSA, and the traffic only traverses FTD when leaving the DC and going to the internet (ie not between WSA and Clients), the process could look something like this:

1. Client does a DNS lookup for a domain, and either directly or indirectly asks Umbrella through local DNS servers or Umbrella VA.
   1. If Umbrella wants to either block the request, or you're using intelligent proxy feature in Umbrella, Umbrella will respond to the DNS query with an IP address in their own range.
   2. Otherwise it will respond with the actual IP address as registered in DNS.
2. If wsa is transparent, the client will try to connect directly to the Umbrella IP provided in the DNS response, and later this session is redirected to WSA through WCCP/PBR/etc.
3. If you're using PAC files, the client may try to proxy the request through WSA.
4. WSA does it's own DNS lookup, and depending on your policies will also resolve to an Umbrella IP if site should be blocked.
5. Depending on WSA own policies, WSA might block the request right there and then.
6. If WSA allows the request, it will go through to the internet, through FTD.
7. Now again, depending on FTD's licenses and config, it might block the connection (based on URL filtering perhaps), and/or if you've integrated the FTD with Umbrella. Or it might allow the request.
8. If neither WSA or FTD blocked the request, and you had a policy in Umbrella to block this domain, the request would reach umbrella and the client would either get a block page or be proxied, depending on your setup.

Now if you had WSA configured as an explicit proxy, initially the client would just send the request directly to WSA, and you would basically start at step #4 in the above process.

You see I'm making a few assumptions on the way, because the traffic flow will depend on your environment and config/policies/licenses in WSA, Umbrella and FTD. 

[Vishal6]

Hi, 

Thank you !

Ftd has  Threat Defence and AMP License so it includes url filtering, correct me if i'm wrong. According to your post internet traffi generated from client machine would first hit WSA (wewill configure it in Explicit mode), then it will redirect to FTD and post umbrella will scan/analyse the traffic and that will be final if nothing blocks by Wsa and FTD. 

I think i have to make same type of policies on WSA, FTD and Umbrella if i dont want unusal output.

[Ken Stieers]

If you're using explicit on the WSA and you set up everything to use Umbrella for DNS resoulution.traffic flow will be:

User types in url
Browser sends request to WSA.
WSA asks Umbrella for IP resolution. (Umbrella DNS Advantage only sees the DNS request not the traffic)
Assuming ip is ok traffic from WSA goes out firewall

You don't want the firewall filtering the WSA's traffic, you already have a better solution in the WSA. So set that traffic to be trusted by the FTD. Troubleshooting double filtering isn't fun.