The document discusses how to set up transparent and explicit proxy configurations with a Cisco Web Security Appliance (WSA) in 5 minutes. It provides the network topology and prerequisites. It then describes two options for the default gateway configuration for transparent proxy setup using WCCP and access control lists. It also discusses configuring the WSA for transparent redirection and verifying the setup. Explicit proxy configuration is demonstrated through default gateway, WSA, and client settings.

1. Transparent | Explicit PX Setup Cisco WSA 9.2
Dhruv Sharma

2. In this session we will
1. We will setup Transparent / Explicit Proxy with Cisco WSA in 5 min.
2. In below slide we have covered how to factory setup your WSA from scratch.
https://www2.slideshare.net/dhruv27tech/factory-setup-wsa92v10

3. Topology

4. Prerequisite
• Users must be able to open the destination websites (http://10.10.10.11 and https://10.10.10.11
) without proxy.

5. Default Gateway Configuration- Option 1
!
ip wccp 90 redirect-list REDIRECT group-list WSA password 0 cisco
!
ip access-list extended REDIRECT
permit tcp 192.168.111.0 0.0.0.255 any eq www
permit tcp 192.168.111.0 0.0.0.255 any eq 443
ip access-list extended WSA
permit ip host 192.168.111.150 any
!
!
interface GigabitEthernet2
ip address 192.168.111.100 255.255.255.0
ip wccp web-cache redirect in
ip wccp 90 redirect in
negotiation auto
!
WSA Redirection ACL
Option 1

6. Default Gateway Configuration- Option 2
!
ip wccp 90 redirect-list REDIRECT password 0 cisco
!
ip access-list extended REDIRECT
permit tcp 192.168.111.0 0.0.0.255 any eq www
permit tcp 192.168.111.0 0.0.0.255 any eq 443
deny ip host 192.168.111.150 any
!
!
interface GigabitEthernet2
ip address 192.168.111.100 255.255.255.0
ip wccp web-cache redirect in
ip wccp 90 redirect in
negotiation auto
!
WSA Redirection ACL
Option 2

7. Verification

8. • WSA Setup for Transparent Redirect

9. Step 1 of 2
• Login into WSA > Network > Transparent Redirection

10. Step 2 of 2
• Provide below details

11. Verification

12. Verification

13. • Explicit Proxy

14. Topology

15. Default Gateway Configuration
R1
!
ip access-list extended proxy
permit ip host 192.168.111.150 any
deny tcp 192.168.111.0 0.0.0.255 any eq www
deny tcp 192.168.111.0 0.0.0.255 any eq 443
!
interface GigabitEthernet2
ip address 192.168.111.100 255.255.255.0
ip access-group proxy in
negotiation auto
end

16. WSA Configuration
• Below is the default configuration on the WSA.

17. Client Configuration
• Change the browser Settings

18. • Lab Fun

19. References
• https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa_12-5/User-
Guide/b_WSA_UserGuide_12_5.pdf