Great config! Important note to others (as this happened to us): When you apply the service-policy called "inside-policy" on the inside interface, it will replace the default policy. (the one with a global class, inspecting ftp and other protocols) A quick fix to this is to simply add the global-class inspections to the newly created "inside-policy"(otherwise things like ftp would break..trim down as needed.): policy-map inside-policy class http-class inspect scansafe http-pmap fail-close class https-class inspect scansafe https-pmap fail-close class global-class inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect sqlnet inspect sunrpc inspect tftp inspect xdmcp inspect dns dynamic-filter-snoop To add the to access-list configs: If there are http/https destinations in which you do NOT want redirected (such as intranet websites or other speciatly cloud apps that don't play nice with a proxy), you can modify the access lists to include deny statements (effectively, denying redirection, so it routes as normal): access-list http-traffic remark Do not redirect internal web servers access-list http-traffic extended deny tcp any object-group internal-web-servers eq www access-list http-traffic remark Ignore traffic sourced from another internal proxy access-list http-traffic extended deny tcp host 10.10.10.1 any eq www access-list http-traffic extended permit tcp any any eq www access-list https-traffic extended permit tcp any any eq https I also included an example to deny a source, which would be useful if you currently have a proxy appliance that clients are being redirected to. The current proxy could be ignored, and clients could be gradually moved from the old to the new scan safe redirection. The deny statements should be replicated to the https-traffic ACL as needed.
... View more
