I85PREP
⌘ K
Cisco 300-725 SWSA study materials
Cisco 300-725 SWSA study resources

Cisco 300-725 SWSA: Configure and Verify Proxy and Transparent Traffic Redirection

Cisco 300-725 SWSA · Work through your exam, one topic at a time.

All guide sections

Configure and Verify Proxy and Transparent Traffic Redirection

Domain 2 tests how client traffic actually reaches the proxy: explicit proxy settings, PAC/WPAD, WCCP v2, PBR, and L4 redirection, plus how you prove redirection works. Expect scenario questions where browsing works for one subnet and fails for another.

Explicit proxy mechanics

  • The client sends an absolute-form request such as GET http://example.com/ HTTP/1.1 to wsa.corp:3128; the WSA resolves DNS and connects on the user's behalf.
  • A PAC file returns PROXY wsa.corp:3128. A DIRECT fallback in the return string creates a policy bypass hole and is a common wrong answer.
  • The Proxy Bypass list sends listed domains and IPs direct; keep the appliance's own update and management destinations out of the proxy path.

Transparent redirection mechanics

  • WCCP v2: the router intercepts matching TCP traffic and forwards it to the WSA. WSA supports GRE or L2 (MAC) forwarding, hash or mask assignment, and load balancing across multiple appliances in one service group.
  • PBR: an ACL matches TCP 80/443 and a route-map sets the next hop to the WSA. The return path must also flow through or back to the WSA.
  • L4 switch or load balancer: a VIP redirects traffic; the WSA must still see the original destination address.
  • Defaults: transparent HTTP 80 and HTTPS 443; explicit proxy 3128; SOCKS 1080.

Verification

Access logs show client IP, URL, and action; Policy Trace confirms identity and the matched policy; curl -x proves explicit proxying; a client with no proxy settings proves transparency; a port check confirms the listener.

Worked example

After migrating a site from PAC to WCCP, one VLAN loses connectivity while others are fine. Reasoning: that VLAN is redirected by PBR on a distribution switch whose return traffic exits a different path, so replies never return to the WSA and sessions stall. The fix is to redirect with WCCP L2 on that VLAN or correct the return path - not to relax policy or disable decryption.

Traps that cost marks

  • Leaving a PAC file configured on a client while testing transparent redirection.
  • Mismatched WCCP service group or assignment method between router and appliance.
  • Forgetting Proxy Bypass entries for internal sites, causing hairpin loops.
  • Testing with an IP that is excluded from redirection by an ACL.