WCCP redirection not working properly due to router ID

[jomar050485]

I have a setup that has two firewalls. Our webfilter running WCCP is on the inside of the second firewall. WCCP redirection is configured on the second firewall.

ISP ----> ASA5520 ----> WAN ----> ASA5515 ----> filter

When I enable WCCP on the ASA5520, it takes the highest IP for the router ID which is the public address of the 5520. The filter cannot communicate with that IP address because it's on the OUTSIDE of the external ASA.

How can I make this work? Do I have to move my filter? I can't move it to the outside interface because according to Cisco:

The only topology that the adaptive security appliance supports is when client and cache engine are behind the same interface of the adaptive security appliance and the cache engine can directly communicate with the client, without going through the adaptive security appliance.

It seems like I cannot change the router ID of the ASA, either.

[Giorgio Romano]

About tris Cisco said:

1. Router ID is chosen as the highest IP address configured on the ASA.  If that happens to the DMZ interface or the outside interface IP address, then the WCCP server has to have a route to get to that Router-ID address pointing to the ASA's interface.