The only thing to watch out for is that on some of the older versions, I don't recall specifically which - but it's pretty old, the WSA doesn't send the root (intermediate in this case) along with server cert, so it can cause trust issues in your clients that don't already have the intermediate in their trust store. You should be fine on any 6.3.5+ / 7.0+ version. ... View more

Ron, I'm not sure what the exact cause of this is yet, so I don't have any speculation on possible workarounds. You mentioned that you already have a ticket open, would you mind sending me that ticket number? You can send it to jowolfer@cisco.com . I'd like to follow up on that and work with dev. I'll keep you posted. Thanks, Josh ... View more

I was able to reproduce this today using win7 64 bit, IE 9, and explicit proxy. I have filed the following bug: 76157 EUA expires prematurely I don't currently have win7 32bit to test with, but I'm sure our QA will iron out those details. Thank you for taking the time to report this issue! Josh ... View more

Unfortunately, I can only test explicit proxy on my Win7 box. I don't have the network setup available to do WCCP with this machine. I'm setting up the test and should have some results today. Josh ... View more

Are you deployed explicitly or transparently? I'm currently on Win7 64 bit and I'd like to see if I run into the same problem. Also, which browser are you using? IE? If so, does this happen with another browser like FireFox or Chrome? Josh ... View more

I don't believe this is possible with EUN pages served up from WSA. I'll ask around with the sales team, but I'm fairly certain this is not doable. We do have the following feature request, which is similar to what you're asking for: 39051 Feature Request: Need to be able to send blank notification page / TCP RST based on category There is currently no ETA for this feature. Thanks! Josh ... View more

J, Unfortunately, you are correct. The ASA has the most restrictive requirements for WCCP redirection. Switches and routers are able to redirect any interfaces, regardless of where the WSA sits. Thanks for updating your post with the solution information. Cheers, ... View more

On the switches, the only option is to fail open. If all WCCP WSAs go down, traffic will follow standard routing. In Cisco routers, there is an additional IOS command to fail closed, but I don't believe it's available on switches. The command is: (config)# ip wccp mode closed ... View more

Alexandre, The most common issue with running HTTPS on the WSA and redirecting all port 443 traffic, is that if there is non-standard HTTPS (HTTP over SSL), the WSA will break the connection. Custom streams over 443 are not supported. Currently, the WSA only negotiates TLS upstream to the WSA, so any sites that force SSLv3 or SSLv2 will break unless they are in the transparent bypass list. ... View more

Tim, To confirm what Hallvard is saying, the WSA doesn't down sample the video quality, it only limits the amount of bandwidth consumed to buffer the quality that the user has selected. For example, if you limit to 40 Kb/sec, that 720p youtube video will eventually load at 720p, but it's gonna take all afternoon to do it =). The streaming media bandwith controls under "applications" will cap *each* individual stream. The "overall bandwidth" limits will prevent the WSA itself from ever consuming more bandwidth than you have specified, limiting *every* connection. The latter can be useful if say you have a 40 Mb pipe and you never want the WSA to consume more then 30 Mb of it, leaving 10 Mb always open for other applications or servers. Josh ... View more

The most common HA deployment we see here at Cisco IronPort is WCCP. Note that WCCP can be a pain to get working properly depending on your existing infrastructure and which devices you're using as the WCCP router. For example, WCCP on the ASA will only work if both the clients and the web cache (WSA) exist on the same interface, you can't have the WSA off of a 3rd leg. You can perform WCCP redirect with either a router, layer3 switch, or ASA/PIX. Since the setups are heavily environment specific, we always recommend that the Sales Engineering team assist in planning, deployment, and configuration of WCCP. We do have a few KB articles which can help shed some light on how WCCP is configured and some common questions about it: http://tinyurl.com/58rqk2 : Overview and various tidbits of info http://tinyurl.com/362kgd3 : WCCP router config http://tinyurl.com/6humz5 : How to NOT redirect local servers http://tinyurl.com/dcpuxk : Config Examples for Catalyst switches running WCCP You can also use a .pac file for deploying load balancing, but I'm not personally too familiar with the benefit / risk from it. I have seen in the past where certain browsers interpret the same .pac file differently and it can be difficult to troubleshoot why. For example, IE 6 and IE 7 don't properly send certain local servers direct (bypass proxy), but IE 8 and FF do. It's typically a rare occurrance, but I've seen it happen a few times before. Chapter 5-19 in the WSA 7.1 User Guide has information on .pac files and various deployments. The .pac script below has been recommended in the past. It supports load balancing and redundancy. I can't really get into the specifics of modifying it for your needs, since we don't write pac scripts in support (most of the Sales Engineer team can assist with this), but I wanted to provide it as an example: function FindProxyForURL(url, host) { if (isPlainHostName(host)) return "DIRECT"; else if (shExpMatch(host, "ssl.ironport.com")) return "PROXY 10.0.89.20:80"; else if (shExpMatch(host, "*.ironport.com")) return "DIRECT"; else if (shExpMatch(host, "10.*")) return "DIRECT"; else if (shExpMatch(host, "192.168.*")) return "DIRECT"; else if (shExpMatch(host, "127.0.0.1")) return "DIRECT"; else if (shExpMatch(host, "212.100.248.219")) return "DIRECT"; else if (shExpMatch(host, "129.127.58.196")) return "DIRECT"; else if (shExpMatch(host, "gateway.ywremote.co.uk")) return "DIRECT"; else if (shExpMatch(host, "*.virginia.gov")) return "PROXY 10.160.59.20:80"; else return randomProxy(); } function randomProxy() { switch( Math.floor( Math.random() * 2 ) ) { case 0: return "PROXY 10.0.89.21:80; PROXY 10.0.89.20:80"; break; case 1: return "PROXY 10.0.89.20:80; PROXY 10.0.89.21:80"; break; } } In this exampel there are two proxies defined: 10.0.89.20 and 10.0.89.21. Any occurrance of DIRECT moves to go direct without using a proxy and PROXY x.x.x.x:x means to use that specific proxy. There are some specific declarations to send certain sites to a specific proxy and than a random catch all to randomize all else. This pac file supports 2 WSAs. If there were more than that, I would imaging the end of this pac could be modified, but I'm not certain on the specifics. Cheers, Josh ... View more

Zoltan, I agree with Hallvard. The most common HA deployment we see here at Cisco IronPort is WCCP. Hallvard is also correct that WCCP can be a pain to get working properly depending on your existing infrastructure and which devices you're using as the WCCP router. For example, WCCP on the ASA will only work if both the clients and the web cache (WSA) exist on the same interface, you can't have the WSA off of a 3rd leg. You can perform WCCP redirect with either a router, layer3 switch, or ASA/PIX. Since the setups are heavily environment specific, we always recommend that the Sales Engineering team assist in planning, deployment, and configuration of WCCP. We do have a few KB articles which can help shed some light on how WCCP is configured and some common questions about it: http://tinyurl.com/58rqk2 : Overview and various tidbits of info http://tinyurl.com/362kgd3 : WCCP router config http://tinyurl.com/6humz5 : How to NOT redirect local servers http://tinyurl.com/dcpuxk : Config Examples for Catalyst switches running WCCP Cheers, ... View more