Redirecting remote-access VPN traffic to BlueCoat web proxy

Question

We'd like to get away from split-tunneling on our remote-access VPNs.

The problem I am having is once I turn off split-tunneling, internet bound traffic hairpins on the outside interface without going through our proxy servers. I would like that traffic (specifically 80/443) to be routed to our BlueCoat ProxySGs to ensure safer web-browsing.

The SGs are on the inside network behind our ASA which is the firewall and VPN concentrator. We are using WCCP between the ASA and SGs for transparent proxying. It looks something like this:

proxy --- inside-net --- ASA --- outside-net --- VPN/Internet

The configuration I used on the ASA after disabling split-tunneling was:

wccp interface outside 90 redirect in

The access-list for redirection would match the VPN subnet so I won't post that configuration.

One thing to note is if I explicitly set the proxy IP in my web browser, it works. But something about allowing the ASA and SGs to handle this transparently is not working. Any insight is greatly appreciated!

Answer 1

I'm not sure how this will work with the BlueCoat, but there is a 'tunneled' keyword that can be added to a static default route on the ASA that will be used for traffic exiting a VPN tunnel, instead of the normal default route that is responsible for the hairpin that you are seeing. There are some other restrictions that apply to using this configuration as noted here (ASA version 8.2). This presumably would require the proxy to be able to handle in some fashion all traffic exiting the VPN tunnel, not just 80/443, in that traffic that will not be proxied by the BlueCoat would essentially need to be 'routed' by it back to the ASA, where it would pass through using the standard default route out to the Internet.

Answer 2

After talking to Cisco yesterday, it doesn't look like WCCP will work in this scenario. The "route interface x.x.x.x x.x.x.x tunneled" command as mentioned by Eric is an option, however, I don't want the proxy server to be the default gateway for all VPN traffic. It also doesn't allow me to load balance traffic to both proxy servers. In the event that it went down, VPN traffic would be black-holed.

In doing my initial research, I came across a set of commands that are applied to group-policy that allow you to set the proxy server in Internet Explorer by manipulating the registry. The commands are "msie-proxy method use-server" and "msie-proxy server value FQDN/IP address:port". The downside to this is that you can only specify one FQDN or IP. However I can get around this by specifying a FQDN that is load balanced using DNS.

A note: During my testing, AnyConnect 2.5 did not allow me to change the proxy settings in IE. Once I upgraded to 3.1, it worked just fine. I'm aware that 2.5 is EoL and becoming EoS in June 2015. It is also affected by several security vulnerabilities such as POODLE, but I have to work with what I have at the moment. It's on my to-do list to get everyone upgraded.