2

We'd like to get away from split-tunneling on our remote-access VPNs.

The problem I am having is once I turn off split-tunneling, internet bound traffic hairpins on the outside interface without going through our proxy servers. I would like that traffic (specifically 80/443) to be routed to our BlueCoat ProxySGs to ensure safer web-browsing.

The SGs are on the inside network behind our ASA which is the firewall and VPN concentrator. We are using WCCP between the ASA and SGs for transparent proxying. It looks something like this:

proxy --- inside-net --- ASA --- outside-net --- VPN/Internet

The configuration I used on the ASA after disabling split-tunneling was:

wccp interface outside 90 redirect in

The access-list for redirection would match the VPN subnet so I won't post that configuration.

One thing to note is if I explicitly set the proxy IP in my web browser, it works. But something about allowing the ASA and SGs to handle this transparently is not working. Any insight is greatly appreciated!

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:34
2

I'm not sure how this will work with the BlueCoat, but there is a 'tunneled' keyword that can be added to a static default route on the ASA that will be used for traffic exiting a VPN tunnel, instead of the normal default route that is responsible for the hairpin that you are seeing. There are some other restrictions that apply to using this configuration as noted here (ASA version 8.2). This presumably would require the proxy to be able to handle in some fashion all traffic exiting the VPN tunnel, not just 80/443, in that traffic that will not be proxied by the BlueCoat would essentially need to be 'routed' by it back to the ASA, where it would pass through using the standard default route out to the Internet.

| improve this answer | |
  • Thanks for the info Eric. I was aware of the 'tunneled' option, however, we have more than just one proxy so this would not work in a load-balancing scenario. I think I've figured out what I am going to do. There's a set of commands that I had researched but didn't want to implement, but after talking to Cisco yesterday, it doesn't look like WCCP will work in this scenario. The commands are "msie-proxy method use-server" and "msie-proxy server value FQDN/IP address:port". The downside to this is that again you can only specify one FQDN or IP, however I can load balance this with DNS. – packetologist Feb 25 '15 at 12:53
-1

After talking to Cisco yesterday, it doesn't look like WCCP will work in this scenario. The "route interface x.x.x.x x.x.x.x tunneled" command as mentioned by Eric is an option, however, I don't want the proxy server to be the default gateway for all VPN traffic. It also doesn't allow me to load balance traffic to both proxy servers. In the event that it went down, VPN traffic would be black-holed.

In doing my initial research, I came across a set of commands that are applied to group-policy that allow you to set the proxy server in Internet Explorer by manipulating the registry. The commands are "msie-proxy method use-server" and "msie-proxy server value FQDN/IP address:port". The downside to this is that you can only specify one FQDN or IP. However I can get around this by specifying a FQDN that is load balanced using DNS.

A note: During my testing, AnyConnect 2.5 did not allow me to change the proxy settings in IE. Once I upgraded to 3.1, it worked just fine. I'm aware that 2.5 is EoL and becoming EoS in June 2015. It is also affected by several security vulnerabilities such as POODLE, but I have to work with what I have at the moment. It's on my to-do list to get everyone upgraded.

| improve this answer | |
  • I would disagree with that. I thought redirecting the traffic from VPN users to BlueCoat proxy servers would be a little more networking related. I could be wrong. – packetologist Feb 25 '15 at 13:38
  • I'm not trying to get into anything here, but... Isn't this network design related? I fail to see how this is not on topic. – packetologist Feb 25 '15 at 13:43
  • Who said I'm going to be pushing GPO policies? Did you read my comment/answer? I can do this from the ASA. We are using a transparent proxy design (WCCP) for our inside users, so WPAD is not needed for them. This seems entirely related to networking. – packetologist Feb 25 '15 at 13:56
  • Leave it. I'm not sure what the problem is. Have a good one Mike. – packetologist Feb 25 '15 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.