WSA, Proxies.

[Pravin Raj Kanagaraj]

Hi, I'm new to WSA, Proxies. Can somebody explain me how the traffic flows across Cisco proxy, FTD and to end machines. I'm finding difficulties in troubleshooting issues in my work since the cisco proxy replaces the source ip of client machines. If you need any questions to get clearer picture, don't hesitate to ask. Thank you. Regards, Pravin Raj K

[balaji.bandi]

You need explain more about your environment, how you have configured WSA as proxy.

1. is this WCCP

2. Explicit Proxy 

any topology of diagram which can help to guide better.

[Pravin Raj Kanagaraj]

1. is this WCCP - yes 2. Explicit Proxy - yes About the environment, Client machine --> Cisco proxy (PAC file) --> WCCP ACL -->Cisco FTD --> Internet

[balaji.bandi]

Ok you have WCCP and Proxy explicit configured. how does that work for you ?

when you configure Explicit configure, the client request replaced by proxy by default.

[Pravin Raj Kanagaraj]

Hey,

Im new to cisco proxy and im unsure about WCCP and Proxy explicit even. I need to learn this quick

[Ken Stieers]

>From your other email, you've got traffic redirected to the WSA 2 ways.

PAC aka explicit proxy

WCCP aka transparent redirection



Start with picking one to troubleshoot....



For PAC, request goes to WSA directly, WSA gets traffic back from website, and returns it to client.



For WCCP, firewall and WSA have a gre tunnel where the traffic gets sent to the WSA, WSA makes request and sends it back to the client.



Some common issues:

Make the access list for WCCP has a deny on the WSA's ip, so you don't end up redirecting the WSA traffic back to itself.

Make sure that FTD trusts the WSA's outbound traffic for 80/443, you don't need or want it to filter the traffic again, one that's load it doesn't need, 2 if there are conflicts (WSA allows a category, FTD blocks it, or FTD's category is slightly different), you end up chasing things in circles.

[Pravin Raj Kanagaraj]

Thanks Ken, 

Since I'm new to WSA, I have seen PAC file and the rules written over it.

And WCCP im unsure about it, is wccp a hardware or it is a feature that runs on WSA.....

And I understand the troubleshooting part.... thank you for that

[Ken Stieers]

WCCP (Web cache control protocol) is a protocol that runs on a router or firewall. I think of it as "publishing a service" that the WSA subscribes to.

WCCP works for all OS/browsers/apps, without worrying about if they support PAC or proxy at all.

We don't even bother with explicit proxy.

[Pravin Raj Kanagaraj]

So, WCCP is like ACL that tells web traffics to redirect to proxy WSA appliance, right?

[Ken Stieers · Accepted solution]

It's a service that redirects traffic to the WSA, controlled by ACL.