We have an active/failover ASA pair supporting WCCP which redirects Internet bound traffic to WebSense appliances for proxy/filtering services. As recommended, WCCP is redirecting inbound on the “inside” interface and is currently fully operational.
We also have an active/failover ASA pair supporting AnyConnect VPN services which is currently operational but is not redirecting to WCCP. We need to redirect AnyConnect VPN Internet access traffic to the WCCP services. It appears the IOS CLI command tunnel default gateway is what is needed to make this redirection work for the VPN users.
Can anyone confirm the tunnel default gateway command is what is needed to force VPN users trying to access the Internet while using the VPN to be redirected to WCCP (FW-ASA) or perhaps offer an alternative that is known operational?
This is what I think is needed:
On the VPN-ASA (.250 and .249)
route inside 0.0.0.0 0.0.0.0 192.168.1.254 /24 tunneled
Topology:
FW-ASA---FW-ASA VPN-ASA---VPN-ASA
ACTIVE Failover ACTIVE Failover
.254 .253 .250 .249
| | | |
/----------VLAN8 ---—192.168.1.0 /24-----------/
| |
.2 .10
WebSense INTRANET
ASA IOS version 9.3+
Thank you
Frank
