We'd like to get away from split-tunneling on our remote-access VPNs.
The problem I am having is once I turn off split-tunneling, internet bound traffic hairpins on the outside interface without going through our proxy servers. I would like that traffic (specifically 80/443) to be routed to our BlueCoat ProxySGs to ensure safer web-browsing.
The SGs are on the inside network behind our ASA which is the firewall and VPN concentrator. We are using WCCP between the ASA and SGs for transparent proxying. It looks something like this:
proxy --- inside-net --- ASA --- outside-net --- VPN/Internet
The configuration I used on the ASA after disabling split-tunneling was:
wccp interface outside 90 redirect in
The access-list for redirection would match the VPN subnet so I won't post that configuration.
One thing to note is if I explicitly set the proxy IP in my web browser, it works. But something about allowing the ASA and SGs to handle this transparently is not working. Any insight is greatly appreciated!