cisco asa and wccp

[cstpierre4]

Hello,

Trying to setup bluecoat proxysg and cisco asa using wccp. I have had some feed back saying this is not a good idea. Has anyone successfully setup a cisco asa and used wccp to communicate with a proxy for web filtering?

My other solution would be to put the proxy inline of the firewall but im worried about resources on the proxy as it will then have to look at all traffic.

Any input would be great. Thanks!

[Marvin Rhoads]

It's been a while since I've done it; but yes that's certainly do-able.

Here's the configuration I used - assuming an inside interface nameif "inside" and, of course, substitute your own values for the bracketed ones below:

object-group network inside_networks
 network-object <subnet a, mask>
 network-object <subnet b, mask>

access-list inside_networks extended permit ip object-group inside_networks any

access-list Bluecoat extended permit ip host <bluecoat proxyaddress> any

wccp 1 redirect-list inside_networks group-list Bluecoat password <password>
wccp interface inside 1 redirect in