WCCP visibility

exclusive — Thu, 15 Apr 2010 09:24:04 GMT

Hi All.

Yesterday we tried to put PAN Device on a POC with a customer just before traffic reach their Proxy solution. Customer redirect using WCCP web traffic from router to Proxy and we used a PAN port on Palo Alto to receive that WCCP traffic. The Proxy device only has one NIC interface, so at TAP port of PAN we should see WCCP traffic redirect from Router to Proxy, and Proxy responses to Router.

What did we see? Only WCCP traffic, not Web traffic, from Router to Proxy, and Web responses from Proxy to Router, where only Proxy IP is showed as source IP.

Is WCCP encapsulating web traffic when redirecting to Proxy? I have seen that WCCP could use GRE, so maybe in that case HTTP traffic cannot be seen by PAN Device. Router brand is CISCO

It should be supported that configuration. I know that PAN cannot use WCCP to forward traffic to a proxy.

If we connect a Laptop with WireShark/Ethereal we can see al traffic, web and WCCP, with users as Source IP.

We used last Threat and App Update and 3.0.6 PANOS version.

Thank you.

Re: WCCP visibility

nrice — Thu, 15 Apr 2010 23:45:32 GMT

It may be best to contct Support with this one. WCCP is not encrypting HTTP traffic, but because the PAN is in tap mode, they'd need to look at the logs to verify the traffic flow.

Re: WCCP visibility

exclusive — Mon, 19 Apr 2010 13:06:26 GMT

Ok, we'll do that.

Thanks.

Re: WCCP visibility

JoeKwok — Wed, 27 Apr 2022 09:28:54 GMT

May I know the result after contact support?

topic Re: WCCP visibility in General Topics

WCCP visibility

Re: WCCP visibility

Re: WCCP visibility

Re: WCCP visibility