I have a BlueCoat ProxySG 810 appliance and want to use it as both an HTTP Proxy Server for clients on the Inside interface of a PIX 525 Firewall (OS Version = 8.0(4)) and a Reverse Proxy Server for my Web Servers on the DMZ.

1. Should I place the ProxySG 810 on the DMZ?
2. If I do so, does the ProxySG 810 need to be allowed access the Inside network (i.e. Initialize connections to Inside) to be able to serve as an HTTP Proxy Server to the Inside Clients?
3. I think the answer to the 2nd question is no; if such, is it sufficient to just allow access from Inside to the DMZ (and ban the opposite direction)?

Notes:

1. PIX 525 (8.0(4)) supports WCCP.
2. The Outside interface of the PIX 525 is connected directly to the Internet.