WCCP on ASA with IPSec VPN users

[Igor Rodriguez]

Hello all,

I'd like to ask all of you a question about configuring WCCP on an ASA5520.

I'll try to explain the situation the best I can.

We have a Cisco Ironport that is working as Explicit proxy and we want to migrate it to Transparent mode.

We'll change our network topology and Ironport's IP addressing so that it is connected to the inside interface on our ASAs.

I have a doubt though, we only have an ASA system working on Active/Standby Failover and is the main Internet connection. This ASA system is also where our IPSec VPN tunnels end.

My question is: Are we going to be able to configure VPN clients with no proxy settings? Will WCCP redirection work for VPN users? I must say that these VPN users are assigned an IP pool that is a different network from LAN users and ASA's inside interface.

Thank you all for your help.

Best regards,

Igor

[Jennifer Halim · Accepted solution]

No, WCCP will not work for VPN Users because on ASA, the WCCP server and client needs to be connecting to the same interface. In your case, since the VPN is connected to the public/outside interface, and the WSA is connected to the inside interface, then this is not supported WCCP redirection on the ASA.

[Igor Rodriguez]

Thanks Jennifer.

So on our topology, the only way to configure it is maintaining the VPN clients configuring WSA's IP address and using it as explicit, right?

[Jennifer Halim]

Absolutely correct.

Here is the URL for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/general/basic_wccp.html#wp1143527

Quoted from above:

"WCCP redirection is supported only on the ingress  of an interface. The only topology that the ASA supports is when client  and cache engine are behind the same interface of the ASA and the cache  engine can directly communicate with the client, without going through  the ASA. "

[Igor Rodriguez]

Thanks for the aclaration Jennifer.

I had read that, but I wanted to clarify it with someone.

Your answer was really helpful.

[Steven Williams]

Has to be a way