cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
818
Views
4
Helpful
9
Replies

Cisco WSA Traffic Flow with Load Balancer

Mandeep singh5
Beginner
Beginner

Hello All,

We've 2 WSA in DC and a Citrix load balancer. Our requirement is to utilize both ISPs from Cisco WSA. So, what will be the traffic flow if we use Citrix Load Balancer for load balancing? We're using a browser-based explicit proxy for all users.

Can anyone explain the traffic flow and interconnection of WSA in terms of file analysis with TG? If we're going to use a load balancer then how the traffic will flow/load-balanced and can able to send the files to On-Prem TG as well for file analysis?

@amojarra @webproxy @wsa

1 Accepted Solution

Accepted Solutions

when I point at source IP and Destination IP, I meant not to use port number. 
If you are choosing just source IP, so always traffic from one client will be redirected to one WSA, there wont be any issue in file consistency. 

 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such   ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

View solution in original post

9 Replies 9

balaji.bandi
Hall of Fame
Hall of Fame

Traffic flows should be ( suggest to use WPAD if you looking browser proxy)

users ---LB ---(P1) WSA (P2) - outside to internet ---FW --ISP

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Hello Balaji,

First of all, we are not going to use PAC file. Instead we simply define proxy server details in browser proxy settings.

Second thing is that I'm clear with the traffic flow which you've sent. My only concern is that we have on-prem TG as well for file analysis. So, In case of Load balancer does it cause any issue if WSA will going to send data from it's P1 interface to TG Clean interface for file analysis.

You need make small network diagram how your network connected.

if you point to browser Proxy settings you need to point to VIP IP of LB

TG depends  on where this Located in the network and routing, you going to mentioned the TG in WSA - so WSA  can look to connect for that. (may be you need to look TG deployment guide on premises).

check some deployment guides :

https://www.cisco.com/c/dam/en/us/products/collateral/security/web-security-appliance/guide-c07-740816.pdf

attached some guide i used (but TG in cloud) - instead of F5 we used Citrix LB

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

amojarra
Cisco Employee
Cisco Employee

Hello Balaji

Hope you are doing fine,

from Client side, most probably you are adding the LB's IP address as the proxy server which Balanced the HTTP and HTTPS traffic.

Regarding the TG, WSA will communicate with TG with its interface IP, and some random Port Number, sending the traffic to your TG server ( most probably TCP443)   

So the traffic going out from WSA to TG will not get balanced on the return path, on the other hand, you can have M1 interface to communicate with your TGs.

 

Feel free to let us know if there is any questions or concerns.

 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

you can have M1 interface to communicate with your TGs.  - Make sense, should M1 Interface aware of that routing.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

All our M1 interfaces will be in the same subnet. TG Clean interface and WSA P1 interface will be on the same subnet. So, we will make an integration between Clean and P1 interface rather than M1

amojarra
Cisco Employee
Cisco Employee

So if they are on a same subnet, the traffic going out from WSA's P1 interface will never hits your LB. 

The only Item you need to consider in your design, is to choose the best algorithm for the LB, lets say with both Source IP and Destination IP, in this case, the traffic of downloading one file will always be in a same WSA, and that WSA will communicate with one of your TGs, 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

What will happen if we do load balancing on the basis of source IP only, does that create any issue?

when I point at source IP and Destination IP, I meant not to use port number. 
If you are choosing just source IP, so always traffic from one client will be redirected to one WSA, there wont be any issue in file consistency. 

 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++     If you find this answer helpful, please rate it as such   ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: