Squid - WCCP and Cisco ASA setup

Setup squid first:

Then on the box (in this case LINUX) running squid do the following:

modprobe ip_gre
iptunnel add gre1 mode gre remote $ASA_ROUTER_IDENTIFIER local $SQUID_SERVER_IP dev eth0
ifconfig gre1 inet 1.2.3.4 netmask 255.255.255.0 up


Updated to reflect great comment from DanO'Reilly :)

The ASA_ROUTER_IDENTIFIER is first of all just identifier and its the highest ip that is on your ASA. Please use the highest IP on your ASA for the iptunnel command. You can get list of all the ips on your asa by doing "show ip".

Next....

Enable forwarding on squid server:


echo 1 > /proc/sys/net/ipv4/ip_forward


Disable reverse path filter.


echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/gre1/rp_filter



Add IPTABLES rule to redirect all the traffic coming on port 80 over to the squid listening port. i.e: 3128 in this case:


iptables -t nat -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j REDIRECT --to-port 3128


Now to configure squid.conf:

Make sure you compiled squid with transparency support (required for PF , IPFW etc). Do config --help | grep transp to see all the firewalls that need this option. For Cisco ASA etc, you don't need to have any transparent option.

anyways back to squid.conf add the following line:


http_port 3128 transparent


"transparent" is the key word here.

Now to configure WCCPv2 in squid.conf:


wccp2_router <$ASA_IP_ADDRESS>
wccp_version 4
wccp2_forwarding_method 1
wccp2_return_method 1




Enabling/configuring WCCPv2 on CISCO ASA(7.x/8.x):

I will go over two scenarios that I came across. First for testing I only wanted certain IPs to hit the squid box before opening it to the rest of the world. Additionaly I didn't want ALL THE PROTOCOLS to go through the proxy server. Only http (80) to go through squid: so here is what i created:

1. First created acl for the clients I wanted to allow access through squid for port 80

ASA# access-list proxyclients extended permit tcp host 192.168.100.202 any eq www

2. I added acl for my proxy servers too.

ASA# access-list proxyservers extended permit ip host 192.168.100.3 any

*** 192.168.100.3 - IP address of my squid box.

3. Now the wccp part:

ASA# wccp web-cache redirect-list proxyclients group-list proxyservers
ASA# wccp interface inside web-cache redirect in

4. Additionaly you can issue:

ASA# wccp web-cache


This should get you going :)

Now if you wanted to let EVERYONE in the world go through and go through proxy: I would remove all the ACLs and remove one wccp line:


ASA# no access-list proxyclients extended permit tcp host 192.168.100.202 any eq www
ASA# no access-list proxyservers extended permit ip host 192.168.100.3 any

This is tricky. You have to "no" the wccp interface command first so...


ASA# no wccp interface inside web-cache redirect in
ASA# no wccp web-cache redirect-list proxyclients group-list proxyservers

Now lets add the wccp interface command back


ASA# wccp web-cache
ASA# wccp interface inside web-cache redirect in


At this point all your traffic hitting the firewall would be redirected to the squid server.

** note about https transparency: packets are encrypted ..so by the time packets arrive at SQUID ..it cannot understand. So other words https transparency, I don't think its supported.

As superpaia pointed out in his comments:

important: "The only topology that the security appliance supports is when client and cache engine are behind the same interface of the security appliance and the cache engine can directly communicate with the client without going through the security appliance." from Cisco.