[squid-users] Problem with squid 3.0 WCCP with Cisco ASA 5510 from mrito_at_mail.altcladding.com.ph on 2011-03-14 (squid-users)

From: <mrito_at_mail.altcladding.com.ph>
Date: Mon, 14 Mar 2011 20:25:24 +0800

hi List,

I'm trying to setup a Cisco ASA 5510 & squid 3.0 WCCP and already followed
some sources on the website procedures but client browsing still does not
work. I can ping the public DNS of the website were trying to access via
client PC but the problem is they cannot connect when using the browser.

We've created a GRE tunnel on the Squid box (running Linux):
# iptunnel add gre2 mode gre remote 172.16.9.11 local 172.16.9.14 dev eth0
# ifconfig gre2 127.0.0.2 up

(where 172.16.9.11 is the internal interface of our ASA and 172.16.9.14 is
the IP of our squid proxy server)

Then we've set up iptables to redirect port 80 to our proxy on port 8080:

# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 8080

Our Squid 2.7.STABLE3 config file contains:

http_port 172.16.9.14:8080 transparent
wccp2_router 172.16.9.11

We can tell that WCCP connects because in the ASA we have:

ALTVPN# sh wccp

Global WCCP information:
    Router information:
        Router Identifier: 172.16.18.1
        Protocol Version: 2.0

    Service Identifier: web-cache
        Number of Cache Engines: 0
        Number of routers: 0
        Total Packets Redirected: 5595
        Redirect access-list: -none-
        Total Connections Denied Redirect: 0
        Total Packets Unassigned: 41
        Group access-list: -none-
        Total Messages Denied to Group: 0
        Total Authentication failures: 0
        Total Bypassed Packets Received: 0

However, clients are getting timeouts when trying to browse the internet.
In the ASA logs, I'm seeing:

Denied ICMP type=3, code=3 from PROXY on interface inside
No matching connection for ICMP error message: icmp src inside:PROXY dst
identity: (type 3, code 3) on inside interface.

Please see also below running config we have on our Cisco ASA 5510 Router:
dns-guard
!
interface Ethernet0/0
nameif internet
security-level 0
ip address 122.3.237.69 255.255.255.240
ospf cost 10
!
interface Ethernet0/1
nameif LAN
security-level 100
ip address 172.16.9.11 255.255.255.0
ospf cost 10
!
interface Ethernet0/2
nameif DMZ
security-level 50
ip address 172.16.10.10 255.255.255.0
ospf cost 10
!
interface Ethernet0/3
description Connection to Proxy Server
nameif LAN-TEST
security-level 0
ip address 172.16.18.1 255.255.255.0
!
interface Management0/0
shutdown
nameif management
security-level 100
no ip address
ospf cost 10
management-only

ALTVPN# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter
area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 122.3.237.65 to network 0.0.0.0

C 172.16.9.0 255.255.255.0 is directly connected, LAN
C 122.3.237.64 255.255.255.240 is directly connected, internet
S* 0.0.0.0 0.0.0.0 [1/0] via 122.3.237.65, internet

ALTVPN# sh access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
alert-interval 300
access-list internet_access_in; 2 elements
access-list internet_access_in line 1 extended permit tcp any eq www host
122.3.
237.68 eq www (hitcnt=0) 0x30ad4bcb
access-list internet_access_in line 2 extended permit ip any any
(hitcnt=0) 0xe5
c8f559
access-list LAN_nat0_outbound; 3 elements
access-list LAN_nat0_outbound line 1 extended permit ip 172.16.9.0
255.255.255.0
192.168.1.0 255.255.255.0 (hitcnt=0) 0x903b7638
access-list LAN_nat0_outbound line 2 extended permit ip any 172.16.9.0
255.255.2
55.0 (hitcnt=0) 0x267f03e2
access-list LAN_nat0_outbound line 3 extended permit ip interface LAN
192.168.1.
0 255.255.255.0 (hitcnt=0) 0x547bc155
access-list OO_temp_internet_map2; 1 elements (dynamic)
access-list OO_temp_internet_map2 line 1 extended permit ip host
122.3.237.69 ho
st 124.105.250.93 (hitcnt=1) 0x749b5a74
access-list internet_1_cryptomap; 1 elements
access-list internet_1_cryptomap line 1 extended permit ip 172.16.9.0
255.255.25
5.0 192.168.1.0 255.255.255.0 (hitcnt=88) 0x1bb16a29
access-list internet_2_cryptomap; 1 elements
access-list internet_2_cryptomap line 1 extended permit ip 172.16.9.0
255.255.25
5.0 192.168.1.0 255.255.255.0 (hitcnt=0) 0x3574b840
access-list internet_3_cryptomap; 1 elements
access-list internet_3_cryptomap line 1 extended permit ip 172.16.9.0
255.255.25
5.0 192.168.1.0 255.255.255.0 (hitcnt=0) 0x10902697
access-list TEST-VOIP; 45 elements
access-list TEST-VOIP line 1 extended permit ip any host 122.3.237.71
(hitcnt=41
55) 0x99a80ab9
access-list TEST-VOIP line 2 remark ftp to access outside
access-list TEST-VOIP line 3 extended permit tcp any object-group
FTP-Ports host
122.3.237.67 0xf6962b1a
access-list TEST-VOIP line 3 extended permit tcp any eq ftp host
122.3.237.67 (h
itcnt=0) 0xfa01780e
access-list TEST-VOIP line 3 extended permit tcp any eq ftp-data host
122.3.237.
67 (hitcnt=0) 0xb70941bd
access-list TEST-VOIP line 4 extended permit tcp any object-group
Email-FTP host
122.3.237.72 object-group Email-FTP 0x98cedd5a
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 eq
ftp (hitcnt=0) 0x177ad684
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 eq
pop3 (hitcnt=0) 0x2d12bc58
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 eq
smtp (hitcnt=0) 0x84ffc98c
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 eq
imap4 (hitcnt=0) 0xb8fbab81
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 ra
nge imap4 imap4 (hitcnt=0) 0x876c898f
access-list TEST-VOIP line 4 extended permit tcp any eq ftp host
122.3.237.72 ra
nge www www (hitcnt=0) 0x3cf18dbf
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 e
q ftp (hitcnt=0) 0x76fddfa5
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 e
q pop3 (hitcnt=0) 0x5576c8e0
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 e
q smtp (hitcnt=0) 0x68c851ac
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 e
q imap4 (hitcnt=0) 0x6ffce792
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 r
ange imap4 imap4 (hitcnt=0) 0x48cc9d74
access-list TEST-VOIP line 4 extended permit tcp any eq pop3 host
122.3.237.72 r
ange www www (hitcnt=0) 0xc735a5c7
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 e
q ftp (hitcnt=0) 0xc6871205
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 e
q pop3 (hitcnt=0) 0x57726c49
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 e
q smtp (hitcnt=0) 0x9019435f
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 e
q imap4 (hitcnt=0) 0x8c390aa8
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 r
ange imap4 imap4 (hitcnt=0) 0x71754724
access-list TEST-VOIP line 4 extended permit tcp any eq smtp host
122.3.237.72 r
ange www www (hitcnt=0) 0x24abf895
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
eq ftp (hitcnt=0) 0xbfe598f9
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
eq pop3 (hitcnt=0) 0x391a9cad
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
eq smtp (hitcnt=0) 0xfa5d6ef6
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
eq imap4 (hitcnt=0) 0xedac3efb
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
range imap4 imap4 (hitcnt=0) 0x23b4bc13
access-list TEST-VOIP line 4 extended permit tcp any eq imap4 host
122.3.237.72
range www www (hitcnt=0) 0xfe07df4d
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 eq ftp (hitcnt=0) 0x735bb658
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 eq pop3 (hitcnt=0) 0x620fea4e
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 eq smtp (hitcnt=0) 0xe90b09fe
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 eq imap4 (hitcnt=0) 0xbb591de8
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 range imap4 imap4 (hitcnt=0) 0x3b8c6326
access-list TEST-VOIP line 4 extended permit tcp any range imap4 imap4
host 122.
3.237.72 range www www (hitcnt=0) 0x179a016b
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 eq ftp (hitcnt=0) 0x55379a09
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 eq pop3 (hitcnt=0) 0x5d818542
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 eq smtp (hitcnt=0) 0xeb60f36c
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 eq imap4 (hitcnt=0) 0x4c738b8a
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 range imap4 imap4 (hitcnt=0) 0x5ab3e241
access-list TEST-VOIP line 4 extended permit tcp any range www www host
122.3.23
7.72 range www www (hitcnt=0) 0x8a7c17ce
access-list TEST-VOIP line 5 extended permit tcp any eq 4569 host
122.3.237.73 e
q 4569 inactive (hitcnt=0) (inactive) 0xada01420
access-list TEST-VOIP line 6 extended permit tcp any range 5004 5082 host
122.3.
237.73 range 5004 5082 inactive (hitcnt=0) (inactive) 0xab9fbd6b
access-list TEST-VOIP line 7 extended permit tcp any eq ftp host
122.3.237.77 eq
ftp (hitcnt=0) 0xaea8cc8f
access-list TEST-VOIP line 8 extended permit tcp any range 10000 20000
host 122.
3.237.73 range 10000 20000 (hitcnt=0) 0x30823148
access-list TEST-VOIP line 9 extended permit tcp any eq www host
122.3.237.68 eq
www (hitcnt=0) 0x054e0d3e
access-list TEST-VOIP line 10 extended permit ip any any (hitcnt=887374)
0xd8807
c8a
access-list Testing_access_in; 1 elements
access-list Testing_access_in line 1 extended permit ip any any (hitcnt=0)
0x99c
cf1ed
access-list CA_access_in; 1 elements
access-list CA_access_in line 1 extended permit ip any any (hitcnt=0)
0xd27e6019

access-list DESIGN_access_in; 1 elements
access-list DESIGN_access_in line 1 extended permit ip any any (hitcnt=0)
0x733b
8222
access-list VLAN_access_in; 1 elements
access-list VLAN_access_in line 1 extended permit ip any any (hitcnt=0)
0x9e1ad8
0e
access-list OO_temp_internet_map1; 1 elements (dynamic)
access-list OO_temp_internet_map1 line 1 extended permit ip host
122.3.237.69 ho
st 219.76.221.202 (hitcnt=8) 0x1ff8e693
access-list OO_temp_internet_map3; 1 elements (dynamic)
access-list OO_temp_internet_map3 line 1 extended permit ip host
122.3.237.69 ho
st 116.236.233.130 (hitcnt=1) 0x09ee5ca8
access-list LAN_access_in; 1 elements
access-list LAN_access_in line 1 extended permit ip any any
(hitcnt=344404) 0x74
568ade
access-list Link_core_access_in; 1 elements
access-list Link_core_access_in line 1 extended permit ip any any
(hitcnt=4586)
0xd19edd8c
access-list Internet; 1 elements
access-list Internet line 1 extended permit ip any any (hitcnt=0) 0x7af0bd38
access-list Malvin; 1 elements
access-list Malvin line 1 extended permit ip host Proxy any (hitcnt=207)
0x5abb7
d27

Regards,
Malvin
Received on Mon Mar 14 2011 - 12:25:33 MDT

This archive was generated by hypermail 2.2.0 : Tue Mar 15 2011 - 12:00:01 MDT