Hi Markus, As suggested, I perform a packet capture by wireshark on proxy client. I can get the TGS-REP packet with no error. The ticket KVNO (version 15)and encryption type (RC4-hmac)match proxy end. Please see the below: <http://squid-web-proxy-cache.1019090.n4.nabble.com/file/n4663971/004.png> In addition, the klist on client shows i have got the key of proxy as well. <http://squid-web-proxy-cache.1019090.n4.nabble.com/file/n4663971/005.png> -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-proxy-kerberos-authentication-failure-Help-tp4663964p4663971.html Sent from the Squid - Users mailing list archive at Nabble.com.