ASA forwarding

[Anukalp S]

Hello.

I have web filtering server in inside network of ASA as well as desktops. Is it possible for any traffic reaching to ASA from desktop should forward to web filtering server and then go to internet via ASA.

pls help me here.

[Itzcoatl Espinosa]

Hi Anukalp,

Reading the notes, it may seem you need to configure wccp on the ASA for traffic redirection. Here is the document that talks about it.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_wccp.html

Please take closer look to the guidelines and restrictions.

I hope it helps.

Dont forget to rate the answer if it helped you to solve your question.

regards,

Itzcoatl

[Anukalp S]

Hi Itzcoatl..

i will go through this link and see if it could help me to cover up my requirement.

[Anukalp S]

Hi..

This link tell to redirect port 80 or range 0-254 but if i want to redirect port 443 also so can it be useful?

[Itzcoatl Espinosa]

Hi Anukalp,

Port 443 should also be redirected. Here is a sample configuration.

I am adding a example for a configuration with HTTP and HTTPS to be redirect to different WCCP devices.

!-- Define the Cache Engines pertaining to WCCP Group 1:

access-list wccp-group1 extended permit ip host 10.198.28.x any

access-list wccp-group1 extended permit ip host 10.198.28.y any

!-- Define the Cache Engines pertaining to WCCP Group 2:

access-list wccp-group2 extended permit ip host 10.198.28.4 any

access-list wccp-group2 extended permit ip host 10.198.28.5 any

!-- Define HTTP traffic -service web-cache- that would be redirected:

access-list wccp-http extended permit tcp 10.198.28.0 255.255.255.0 any eq www

!-- Define HTTPS traffic -service 70- that would be redirected:

access-list wccp-https extended permit tcp 10.198.28.0 255.255.255.0 any eq https

!-- Link the services to be redirected to each group:

wccp web-cache redirect-list wccp-http group-list wccp-group1

wccp 70 redirect-list wccp-https group-list wccp-group2

!-- Enable WCCP redirection on the interface:

wccp interface inside web-cache redirect in

wccp interface inside 70 redirect in

Thanks,

Itzcoatl

[Anukalp S]

Hi Itzcoatl..

Above access-list wccp-http & wccp-https are permitting , should there also be deny statement to avoid loop.

Also  access-list wccp-http & wccp-https are not related to firewall inside interface name. it should be different.Right??

[Itzcoatl Espinosa]

Hi,

There is no need to configure a deny, unless you want to exclude some network or hosts from being redirected to the web cache server.

The interface name can be different, nevertheless remember that the web-server and the internal hosts should be behind the same ASA interface in order to work.

Thanks,

Itzcoatl

[Anukalp S]

Thanks For your help Itzcoatl.