Hi Tom,
Exactly the same problem I have. Please let me know if you come
across anything.
-Parvinder Bhasin
On Jun 17, 2009, at 11:50 AM, Tom Penndorf wrote:
Hello,
i'm trying to get squid and wccp on a cisco asa 5510 running. These
are the steps, i've done to set it up.
#aptitude install squid3
#vi /etc/squid3/squid.conf
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow all
http_access deny all
icp_access deny all
htcp_access deny all
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
cache_dir aufs /var/cache/squid3 30000 32 256
access_log /var/log/squid3/access.log squid
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern (cgi-bin|\?) 0 0% 0
refresh_pattern . 0 20% 4320
wccp2_router 10.1.7.1
wccp2_forwarding_method 1
wccp2_return_method 1
wccp2_service standard 0
client_persistent_connections off
icp_port 3130
coredump_dir /var/spool/squid3
#iptunnel add gre1 mode gre remote $ASA-EXT-IP local 10.1.7.2 dev eth0
#ifconfig gre1 10.1.7.2 netmask 255.255.255.255 up
#echo 0 >/proc/sys/net/ipv4/conf/gre1/rp_filter
#iptables -t nat -A PREROUTING -i gre1 -p tcp --dport 80 -j REDIRECT
--to-port 3128
# echo 1 >/proc/sys/ipv4/ip_forward
The asa detects the proxy and redirects the packets. On the squid-
machine, i can see the syn-packets from the client, but no ack-
packets.
The counter for the iptables-rule is also increasing. If i remove
the iptables-rule, the clients can browse the web, because the squid-
machine is acting as a router, so the gre-tunnel seems to work
correctly.
After some research, i've found out, that the ack-packets are send
out at eth0. I don't think, it's the correct way.
Are there any things, i've forgotten? All howto's i've found, don't
tell me any other steps.
System is Debian lenny with squid 3.0.STABLE8-3.
Is there anyone, who can give me a hint?
Thanks,
Tom
