WSA Architecture and Deployment Options
Domain 1 of the 300-725 SWSA exam covers how the Cisco Secure Web Appliance (formerly the Web Security Appliance, WSA) is built and where it sits in the network. Questions test platform and interface roles, the proxy data path, and the standard deployment models: explicit proxy, transparent redirection, reverse proxy, and PAC-assisted explicit proxy.
Inside the box
- AsyncOS is the hardened appliance OS; configuration happens through the GUI, the CLI, or a Content Security Management Appliance (SMA).
- Data path: a client request arrives on a data interface, passes authentication and identity selection, then the policy layers in order - Access, Decryption, Routing, Outbound Malware, Data Security - before the proxy fetches content and DVS scans it in a single streaming pass.
- The L4 Traffic Monitor (L4TM) passively listens on interfaces and blocks known botnet and malware endpoints by IP address and DNS name, independent of HTTP policy.
- Hardware appliances expose P1/P2 data ports, T1/T2 transparent ports, and M1 management; virtual appliances (S100V, S300V, S600V, S1000V) map those roles to vNICs. The M1 interface serves GUI, SSH, and updates - never user web traffic.
Deployment models
- Explicit forward proxy: the browser or a PAC/WPAD file points at a data interface on the explicit proxy port (3128 by default; SOCKS 1080).
- Transparent: WCCP v2 from a router or switch, policy-based routing (PBR), or an L4 switch/load balancer redirects TCP 80/443 to the transparent interface, with no client configuration.
- Reverse proxy: publishes internal web servers to the internet; still examinable even though it is not user web policy.
- Transparent mode requires the appliance to be in the traffic path. The WSA does not NAT, so a default gateway is mandatory.
Worked example
A branch has 400 users, one ISR router, and no ability to change browser settings. The router supports WCCP but is not the gateway for one VLAN, which is routed elsewhere. Reasoning: WCCP only intercepts traffic that traverses the device running it, so that VLAN bypasses filtering. PBR on the WSA-facing router has the same limit. The correct fix is to redirect on every gateway, or deploy a PAC file by GPO - not to add a second appliance.
Traps that cost marks
- Confusing the management interface with a data interface; the GUI is not reachable through a proxy port.
- Assuming WCCP works when the router is off-path or GRE return traffic is asymmetric.
- Believing the deployment mode provides TLS trust; trust comes from distributing the appliance CA to clients, not from transparent redirection.