Redirecting http traffic to the proxy server

[rajath.poovanna]

Hi,

We have a requirement to divert web traffic to blue coat proxy through firewall. Below is the setup

Requirement:

We need to divert web traffic from 10.20.200.0/23 [DMZ-STAFFNET] and point it to Bluecoat proxy to process the packets.

Now that ASA doesn't support PBR to accomplish this, how can we accomplish this ? 

[Adeolu Owokade]

Hi Rajath,

Is the Bluecoat proxy WCCP-enabled? If yes, then maybe this Cisco guide will help you: http://www.cisco.com/c/en/us/td/docs/security/asa/special/wccp/guide/asa-wccp.html

[rajath.poovanna]

Hi Adeolu,

Is there any other way to accomplish the requirement without WCCP.

best,

Rajath

[Andre Neethling]

Have you thought about "Destination NAT" (Twice NAT) as a static NAT rule. It may work for you.

[rajath.poovanna]

I did try creating the below NAT rule, doing so bluecoat will only see the packets from DMZ-STAFFNET interface. Our requirement was to see the original source IP.

(DMZ-STAFFNET) to (bluecoat) source dynamic DMZ-STAFFNET interface   destination static internet proxy-server service original-http proxy-8080

So we switched to WCCP and everything is working fine for HTTP and HTTPS traffic via WCCP.

[Vibhor Amrodia · Accepted solution]

Hi,

To list one limitation that you might see in your scenario , You would only be able to redirect the subnets to the proxy from those subnets which are physically behind the interface where the WCCP server resides only. i.e. UNTRUST

Now , talking about the NAT , why don't you try this NAT if you don't want to NAT the Source part of the Traffic:-

(DMZ-STAFFNET) to (bluecoat) source static DMZ-STAFFNET DMZ-STAFFNET destination static internet proxy-server service original-http proxy-8080

Also , ASA now supports Policy Based routing from ASA 9.4.1 :)

Thanks and Regards,

Vibhor Amrodia