IronPort Web Security Appliance (WSA) with Cisco ASA (Filtering)

Technology Overview

The Cisco IronPort Web Security Appliance (WSA) is a web proxy that works

with other Cisco network components to monitor and control outbound

requests for Web content and scrubs return traffic for unwanted or malicious

content (Figure 1).

Figure 1. Logical Traffic Flow Using WSA

The Cisco WSA is deployed on a network using one or more interfaces that

are used to forward requests and responses. Traffic can be directed to the

WSA using either explicit proxies configured on the end host, or using a

network protocol like Web Cache Control Protocol (WCCP) running on an

inline device like the perimeter firewall or router.

Configration example

1. Allow the Ironport out through the firewall:

access-list acl_inside extended permit tcp host 192.168.1.1 any 

2. Create a new acl containing the members of the wccp group. in our example, it is just 1 Ironport

access-list ironport-allow extended permit ip host 192.168.1.1 any

3. Create an acl that defines what traffic should be redirected to the Ironport

access-l ironport-forward extended permit tcp 192.168.1.0 255.255.255.0 any eq http

4. Configure wccp

wccp web-cache group-list ironport-allow redirect-list ironport-forward

5. Enable wccp on an interface.

wccp interface inside web-cache redirect in

6. Confirm configuration

show wccp

On the Ironport:
Network>Transparent Redirection
Choose WCCP v2 router> click Submit
Select Add service
Click Create a standard service ID, enter the ASA IP address in the box provided

Submit changes