5

Internet - ASA FW (4 SVI's) - Layer 3 - 2*6509 HSRP - MPLS ROUTER - 15 remote sites

Today I have 3 central internet pops within my network all using ASA firewalls, the firewalls each have 15 MPLS locations that receive internet. Currently I have WCCPV2 running on the firewall at each of these locations. The firewalls have 4 interfaces, today we can only monitor 1 of them "LAN side" due to the limitation of the ASA. I am getting ready to start a project to move WCCP off of the LAN side interface of the firewall onto our core 6509's.

Questions 1 - Where is the best placement of the WCCP process given the network layout? I was thinking on the Layer 3 interface between the core 6509's and the ASA. Thoughts? I have also seen design recommendations that say to put the WCCP configuration on the SVI's on the 6509's however, this doesn't cover the 15 sites coming from MPLS.

Question 2 - What is the best practice for monitoring multiple interfaces on the ASA firewall? Is there a different design method I should consider that would allow me to monitor those interfaces as well? Let me know if haven't provided enough detail. Thanks, Danny

3
  • Does anyone have a comment on the topic above?
    – user1477
    Jul 7 '14 at 17:31
  • Are you trying to monitor SVI status on the ASAs or physical interface status? Jul 21 '14 at 4:54
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5 at 18:43
3

When you are implementing WCCP it shouldn't be inline. Place your Bluecoat that's doing WCCP anywhere in your network provided the ASA can route to it. Take a look at the "Transparent Deployment" section of this document. https://www.bluecoat.com/sites/default/files/documents/files/SWG_Deployment_Methodologies.2.pdf

Regarding the second question I would monitor the ASA interfaces by pinging whatever they are connected to. This way when that goes down I can check if it's a problem with the ASA or the device I'm pinging. There may be a way to do this with IP SLA too but I don't know how.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.