Cisco WSA Traffic Flow with Load Balancer

[Mandeep singh5]

Hello All,

We've 2 WSA in DC and a Citrix load balancer. Our requirement is to utilize both ISPs from Cisco WSA. So, what will be the traffic flow if we use Citrix Load Balancer for load balancing? We're using a browser-based explicit proxy for all users.

Can anyone explain the traffic flow and interconnection of WSA in terms of file analysis with TG? If we're going to use a load balancer then how the traffic will flow/load-balanced and can able to send the files to On-Prem TG as well for file analysis?

@amojarra @webproxy @wsa

[balaji.bandi]

Traffic flows should be ( suggest to use WPAD if you looking browser proxy)

users ---LB ---(P1) WSA (P2) - outside to internet ---FW --ISP

[Mandeep singh5]

Hello Balaji,

First of all, we are not going to use PAC file. Instead we simply define proxy server details in browser proxy settings.

Second thing is that I'm clear with the traffic flow which you've sent. My only concern is that we have on-prem TG as well for file analysis. So, In case of Load balancer does it cause any issue if WSA will going to send data from it's P1 interface to TG Clean interface for file analysis.

[balaji.bandi]

You need make small network diagram how your network connected.

if you point to browser Proxy settings you need to point to VIP IP of LB

TG depends  on where this Located in the network and routing, you going to mentioned the TG in WSA - so WSA  can look to connect for that. (may be you need to look TG deployment guide on premises).

check some deployment guides :

https://www.cisco.com/c/dam/en/us/products/collateral/security/web-security-appliance/guide-c07-740816.pdf

attached some guide i used (but TG in cloud) - instead of F5 we used Citrix LB

[amojarra]

Hello Balaji

Hope you are doing fine,

from Client side, most probably you are adding the LB's IP address as the proxy server which Balanced the HTTP and HTTPS traffic.

Regarding the TG, WSA will communicate with TG with its interface IP, and some random Port Number, sending the traffic to your TG server ( most probably TCP443)   

So the traffic going out from WSA to TG will not get balanced on the return path, on the other hand, you can have M1 interface to communicate with your TGs.

Feel free to let us know if there is any questions or concerns.

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[balaji.bandi]

you can have M1 interface to communicate with your TGs.  - Make sense, should M1 Interface aware of that routing.

[Mandeep singh5]

All our M1 interfaces will be in the same subnet. TG Clean interface and WSA P1 interface will be on the same subnet. So, we will make an integration between Clean and P1 interface rather than M1

[amojarra]

So if they are on a same subnet, the traffic going out from WSA's P1 interface will never hits your LB. 

The only Item you need to consider in your design, is to choose the best algorithm for the LB, lets say with both Source IP and Destination IP, in this case, the traffic of downloading one file will always be in a same WSA, and that WSA will communicate with one of your TGs, 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[Mandeep singh5]

What will happen if we do load balancing on the basis of source IP only, does that create any issue?

[amojarra · Accepted solution]

when I point at source IP and Destination IP, I meant not to use port number. 
If you are choosing just source IP, so always traffic from one client will be redirected to one WSA, there wont be any issue in file consistency. 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such   ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++