Before running and asking any question, did you had the chance of looking at this wiki? http://wiki.squid-cache.org/ConfigExamples/UbuntuTproxy4Wccp2 The above wiki works for many and there might be a small change in the cisco IOS so I assume it would put all the things you know together. dont use NAT\intercept and WCCP if you can.. Eliezer On 09/07/2013 02:44 PM, Akshay Joshi wrote: > I am desperately trying to use Squid(3.3.3) with WCCP2 (Cisco2921). Although it's not working right now but I think I am really close. > > Router has 3 interfaces and the config is this: > ! > ip wccp web-cache password 7 01100F175804 > ! > interface GigabitEthernet0/0 > ip address 187.72.34.82 255.255.255.248 > ip nat outside > ip virtual-reassembly in > duplex auto > speed auto > ! > interface GigabitEthernet0/1 > ip address 192.168.1.1 255.255.255.0 > ip nat inside > ip virtual-reassembly in > duplex auto > speed auto > ! > interface GigabitEthernet0/2 > ip address 172.16.1.1 255.255.255.0 > ip wccp web-cache redirect in > ip nat inside > ip virtual-reassembly in > duplex auto > speed auto > ! > ip nat inside source list NATTABLE_HOSTS interface GigabitEthernet0/0 od > ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 > ! > ip access-list standard NATTABLE_HOSTS > permit 192.168.0.0 0.0.255.255 > permit 172.16.0.0 0.0.255.255 > permit 10.0.0.0 0.255.255.255 > > > Squid is compiled with following options: > configure > options: '--prefix=/usr' '--includedir=/usr/include' > '--datadir=/usr/share' '--bindir=/usr/sbin' > '--libexecdir=/usr/lib/squid' '--localstatedir=/var' > '--sysconfdir=/etc/squid3' '--enable-delay-pools' '--enable-ssl-crtd' > '--enable-linux-netfilter' '--enable-eui' '--enable-snmp' > '--enable-gnuregex' '--enable-icmp' '--with-logdir=/var/log/squid/' > '--enable-referer-log' '--enable-cache-digests' '--enable-wccp' > '--enable-wccpv2' '--enable-ssl' --enable-ltdl-convenience > > > Squid.conf: > http_port 192.168.1.2:3129 intercept > http_port 192.168.1.2:3128 > > wccp2_router 192.168.1.1 > wccp2_forwarding_method gre > wccp2_return_method gre > wccp2_service standard 0 password=cisco > > Cache.log is also without any errors. > > On ubuntu 12.04 I have set the following rules (based on http://wiki.squid-cache.org/Features/Wccp2): > modprobe ip_gre > ip tunnel add wccp0 mode gre remote 187.72.34.82 local 192.168.1.2 dev eth0 > ifconfig wccp0 192.168.1.2 netmask 255.255.255.255 up > echo 0>/proc/sys/net/ipv4/conf/wccp0/rp_filter > echo 0>/proc/sys/net/ipv4/conf/eth0/rp_filter > echo 1>/proc/sys/net/ipv4/ip_forward > iptables -t nat -A PREROUTING -i wccp0 -p tcp --dport 80 -j REDIRECT --to-port 3129 > iptables -t nat -A POSTROUTING -j MASQUERADE > > > With all this setup, client browser keeps on loading and loading and finally says server taking too long to respond etc. > On the squid machine, via wireshark, I can see that a lot of "destination unreachable" messages are sent from squid to router when I visit some website on browser. > From: 192.168.1.2 to 192.168.1.1 [port unreachable] > > When I manually set proxy IP in browser it works(websites open fine).I could also see HereIAm and ISeeYou messages flowing fine. > > Please guide me on where am I missing. Let me know if more details are required. >
