WSA WCCP for ASA Configuration Example

Introduction

This document describes how to configure the Web Cache Communication Protocol (WCCP) for the Cisco Adaptive Security Appliance (ASA) through the Cisco Web Security Appliance (WSA).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Cisco WSA
• Cisco ASA
• WCCP
• Transparent proxy deployments

Components Used

The information in this document is based on these software and hardware versions:

• Cisco WSA Version 7.x
• Cisco ASA Version 8.x

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Configure

Use this section in order to configure the WCCP for the ASA.

Configuration Overview

These are the commands that are entered on the WSA in order to configure the WCCP for the ASA:

hostname(config)# wccp {web-cache | service_number} [redirect-list access_list]
 [group-list access_list] [password password] 

hostname(config)# wccp interface interface_name {web-cache | service_number}
 redirect in

These are the entry descriptions for this command:

• service-number: This is a dynamic service identifier, which means that the service definition is dictated by the cache. The dynamic service number can range from 0 to 255. The maximum allowable number is 256, which includes the web-cache service that is specified with the web-cache keyword.
  
  
• redirect-list: This is an optional entry. It is used with an access list that controls the traffic that is redirected to this service group. The access-list argument is a string of no more than 64 characters (name or number) that specifies the access list.
  

  Note: The ASA Software Versions 8.1 and earlier do not accept the TCP port in the redirect-list; only network addresses can be used.

• group-list: This is an optional access list entry that determines the web caches that are allowed to participate in the service group. The access-list argument is a string of no more than 64 characters (name or number) that specifies the access list.
  
  
• password: This is an optional entry that specifies the Message Digest 5 (MD5) authentication for the messages that are received from the service group. The messages that are not accepted by the authentication are discarded.

Note: The standard service is web-cache (Service ID 0), which only intercepts TCP Port 80 (HTTP) traffic. For any other customized services, Cisco recommends that you use a Service ID between 90 and 97.

Configuration Example

Complete these steps in order to configure the WCCP for the ASA via the WSA:

1. Enter this command in order to use the default service group web-cache:
   
   

   wccp web-cache
   wccp interface inside web-cache redirect in

2. Enter this command in order to use a dynamic service group ID for the redirection of HTTP and HTTPS traffic:
   
   

   wccp 90 redirect-list wccp-hosts group-list wccp-routers

3. Enter this command in order to use WCCP security:
   
   

   wccp 90 redirect-list wccp-hosts group-list wccp-routers password securewccp

4. The access list can be configured so that it denies the traffic that is sent to the ASA as a destination IP address and redirects it to the WSA. This is particularly useful when the ASA is configured in order to redirect traffic to multiple WSAs. For example, the WSAs might be assigned these IP addresses:
   
   
   • WSA1 IP address = 10.0.0.1
   • WSA2 IP address = 10.0.0.2
     
     
   Enter these commands in order to configure the access list to deny the traffic:
   
   

   access-list wccp-hosts extended deny tcp any host 10.0.0.1
   access-list wccp-hosts extended deny tcp any host 10.0.0.2

5. Enter this command in order to allow the HTTP traffic to be redirected:
   
   

   access-list wccp-hosts extended  permit tcp any any eq www

6. Enter this command in order to allow the HTTPS traffic to be redirected:
   
   

   access-list wccp-hosts extended  permit tcp any any eq https

7. Enter these commands in order to define the WSAs that are allowed to participate in the WCCP communication:
   
   

   access-list wccp-routers standard permit host 10.0.0.1
   access-list wccp-routers standard permit host 10.0.0.2

8. If the redirect-list command is not accepted, then an extended access list might be needed. Enter these commands in order to configure the extended access list:
   
   

   access-list wccp-routers extended permit ip host 10.0.0.1 any
   access-list wccp-routers extended permit ip host 10.0.0.2 any

9. Enter this command in order to apply the configuration:
   
   

   wccp interface inside 90 redirect in

Verify

In order to display the global statistics that are related to WCCP, enter the show wccp command in privileged EXEC mode:

show wccp {web-cache | service-number}[detail | view]
show run | inc wccp

Note: The type of traffic (HTTP, HTTPS, FTP) that is redirected is defined by the WSA WCCP configuration. The ASA can only filter the redirected traffic with the use of the redirect-list.

Troubleshoot

There is currently no specific troubleshooting information available for this configuration.

Related Information

• Configuring Web Cache Services Using WCCP
• Technical Support & Documentation - Cisco Systems