Firewall with NetFlow and WCCP (Cisco WSA)

[wijngaarden.m]

I need some assitance with using NetFlow in combination with WCCP.

We have a firewall enabled with WCCP and NetFlow exporting the flow to a NetFlow analyzer. The issue at hand is that all traffic that is redirected by the WCCP rule, shows as the IP from the Cisco WSA.

Is it possible to get more accurate data, in stead of the NetFlow result showing the WSA generating traffic?

[Bogdan Nita]

I believe one problem with this setup is that the WSA sends the responds directly to the host and not to the ASA. If the ASA does not see the entire session it can't send netflow reports on that traffic.

If the WSA can't use the cache for answering it will send out the request with its own IP and that traffic goes properly through the ASA and it is properly reported by netflow.

One possible solution would be to activate netflow on other downstream devices, unfortunately WSA doesn't support netflow as far as I know.

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116046-config-wccp-asa-00.pdf

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCzv64580/?rfs=iqvred

HTH

Bogdan