I have a BlueCoat ProxySG 810 appliance and want to use it as both an HTTP Proxy Server for clients on the Inside interface of a PIX 525 Firewall (OS Version = 8.0(4)) and a Reverse Proxy Server for my Web Servers on the DMZ.

1. Should I place the ProxySG 810 on the DMZ?
2. If I do so, does the ProxySG 810 need to access the Inside network (i.e. Initialize connections to Inside) to be able to serve as an HTTP Proxy Server to the Inside Clients? 

 In other words: is it required to create an ACL rule to allow access from DMZ (ProxySG 810) to the Inside?

Notes:

1. PIX 525 (8.0(4)) supports WCCP.
2. The Outside interface of the PIX 525 is connected directly to the Internet.