I have one central Proxy Server running Squid 3.1.10 under
CentOS 6.3 running locally here and also for our 2 remote sites for all http
traffic.
We are using Cisco's WCCP and between the remote sites and the
Squid is a ASA box.
where the Proxy is running Site A and one of the remote Site B.
From either of the remote sites, when I try to access a printer
or other web enabled device thru a browser that is not defined in squid.conf, I
get access denied.
This is strange to me as this request should be considered part
of the internal network.
When I put statements in squid.conf for this print, I then get connection timed
out.
From the Squid server, I cannot ping this remote printer due to
the static route has 0.0.0.0 as its gateway address.
See the below config for one of the remote sites:
In /etc/rc.local file:
iptunnel add tun-cc mode gre remote 192.168.253.16 local
10.80.166.227 dev eth0
ip link set dev tun-cc up
ip route add 10.80.202.0/23 dev tun-cc metric 101
In squid.conf, this network should be considered internal:
acl nga_net src 10.80.0.0/16 # Internal network (I have tried splitting out
the ACL statements but same result)
http_access allow nga_net
If I look at the static routes on the server (netstat -rn or route -v)
Destination Gateway Genmask Flags MSS Window irtt Iface
1.2.3.0 0.0.0.0 255.255.255.0 U 0 0 0 gre0
10.80.166.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.80.202.0 0.0.0.0 255.255.254.0 U 0 0 0 tun-cc
(remote site)
0.0.0.0 10.80.166.254 0.0.0.0 UG 0 0 0 eth0
As you can see, the gateway for this remote site is the Internet (0.0.0.0) and
thinking it should be 10.80.166.254.
When I try to change the gateway for this static route, I get message -
RTNETLINK answers: File exists
If I remove the static route, I cannot get to any internal or Internet site
from a remote site workstation.
Due to the ASA in the traffic path of the remote sites, there is a gre tunnel
setup for outbound traffic from the Squid server, without the tunnel the packet
would be dropped by the ASA box.
I know the best practices is to have a proxy server at each remote location,
but this solution does work for most requests.
Has anyone else run into this and found a solution, thanks....
______________________________________________________
NIPRO GLASS
______________________________________________________
CAUTION - This message may contain privileged and confidential information
intended only for the use of the addressee named above. If you are not the
intended recipient of this message you are hereby
notified that any use, dissemination, distribution or reproduction of this
message is prohibited. If you have received this message in error please notify
NIPRO GLASS
immediately. Any views expressed in
this message are those of the individual sender and may not necessarily reflect
the views of NIPRO GLASS._______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users
