Hi, There may be a situation which we can't pass through HTTP with NTLM authentication bacause of lack of keepalive. cache_peer XXX.XXX.XXX.XXX parent 8080 0 no-query connection-auth=on always_direct allow all In above case, squid does not output "Proxy-Connection: keep-alive" to cache peer host, bacause > http.c:HttpStateData::sendRequest() > > 1998 /* > 1999 * Is keep-alive okay for all request methods? > 2000 */ > 2001 if (orig_request->flags.must_keepalive) > 2002 flags.keepalive = 1; > 2003 else if (!Config.onoff.server_pconns) > 2004 flags.keepalive = 0; > 2005 else if (_peer == NULL) > 2006 flags.keepalive = 1; > 2007 else if (_peer->stats.n_keepalives_sent < 10) > 2008 flags.keepalive = 1; > 2009 else if ((double) _peer->stats.n_keepalives_recv / > 2010 (double) _peer->stats.n_keepalives_sent > 0.50) > 2011 flags.keepalive = 1; I think that we have to insert the following code else if (_peer->connection_auth == 1) flags.keepalive = 1; What do you think ? Squid version: 3.1.1 Sincerely, -- Mikio Kishi