If we were using a Cisco ASA here is the config for it:
1. Set up service objects to match TCP traffic going from all available ports to ports
8081 or 80:
hostname(config)# object service http-original
hostname(config-service-object)# service tcp source range 1
65535 destination eq www
hostname(config-service-object)# description http-original
hostname(config)# object service http-redirect
hostname(config-service-object)# service tcp source range 1
65535 destination eq 8081
hostname(config-service-object)# description http-redirect
2. Create a network object to match the source traffic that should be filtered by
Cloud Web Security:
hostname(config)# object network Filtered-Web-Addresses
hostname(config-network-object)# subnet 0.0.0.0 0.0.0.0
Use the subnet addresses that apply to your organization.
3. Create a network object to match the destination address (i.e. the Websense Cloud
Web Security proxy):
hostname(config)# object network Websense-Proxy
hostname(config-network-object)# host
webdefence.global.blackspider.com
hostname(config-network-object)# description Websense-Proxy
4. Using the object and network services you have set up, create NAT rules on your
firewall to send Web traffic from your internal addresses to the cloud service. We
recommend two rules: one for internal IP addresses, and one for your guest
wireless network.
The NAT statements for these rules are as follows:
nat (inside,outside) source dynamic any interface
destination static Filtered-Web-Addresses Websense-Proxy
service http-original http-redirect inactive
nat (guest-wireless,outside) source dynamic any interface
destination static Filtered-Web-Addresses Websense-Proxy
service http-original http-redirect inactive
