Ironport S370 as the URL Filtering Server of ASA

[jyothydas]

Is it possible to make Ironport S370 as the URL filtering server of ASA. I currently see only Websense and SmartFilter as the default option. Is this possible with just these two devices ( without using a third server for WCCP) ?

Currently intranet users browse though WSA ( all are on same network). I now want WiFi users ( in different zone, different security level) to also use the WSA instead of using the CSC.

[deyster94]

Yes, you have to use WCCP to redirect the traffic to the Ironport.  It would look something like this:

access-list ironport-wccp extended permit ip host X.X.X.X any

X.X.X.X is the IP address of your Ironport appliance.  If you have more then one, just add the same ACL with it's IP address listed.

wccp web-cache group-list ironport-wccp

wccp interface INT-NAME web-cache redirect in

These two commands will direct the traffic to the WSA.  INT-NAME is the name of the interface on the ASA that you want web traffic redirected on.

After you get this configured, try to browse to the web on the wireless network.  Then do a show wccp from the ASA and you should see packets being directed to the Ironport.