Hi,
Here you have the deployment Guide of the WSA, the recommended setup will be the same for both.
http://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2013/CVD-WebSecurityUsingCiscoWSADesignGuide-AUG13.pdf
http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-smart-business-architecture/sba_webSec_dg.pdf
Luis Silva