<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"> I have one central Proxy Server running Squid 3.1.10 under CentOS 6.3 running locally here and also for our 2 remote sites for all http traffic.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> We are using Cisco’s WCCP and between the remote sites and the Squid is a ASA box.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> where the Proxy is running Site A and one of the remote Site B.
<o:p></o:p></p>
<p class="MsoNormal"> From either of the remote sites, when I try to access a printer or other web enabled device thru a browser that is not defined in squid.conf, I get access denied.<o:p></o:p></p>
<p class="MsoNormal"> This is strange to me as this request should be considered part of the internal network.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">When I put statements in squid.conf for this print, I then get connection timed out.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal"> From the Squid server, I cannot ping this remote printer due to the static route has 0.0.0.0 as its gateway address.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> See the below config for one of the remote sites:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> In /etc/rc.local file:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> iptunnel add tun-cc mode gre remote 192.168.253.16 local 10.80.166.227 dev eth0<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ip link set dev tun-cc up<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ip route add 10.80.202.0/23 dev tun-cc metric 101<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">In squid.conf, this network should be considered internal:<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">acl nga_net src 10.80.0.0/16 # Internal network (I have tried splitting out the ACL statements but same result)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">http_access allow nga_net<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">If I look at the static routes on the server (netstat –rn or route –v)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Destination Gateway Genmask Flags MSS Window irtt Iface<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">1.2.3.0 0.0.0.0 255.255.255.0 U 0 0 0 gre0<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">10.80.166.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">10.80.202.0 0.0.0.0 255.255.254.0 U 0 0 0 tun-cc (remote site)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">0.0.0.0 10.80.166.254 0.0.0.0 UG 0 0 0 eth0<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">As you can see, the gateway for this remote site is the Internet (0.0.0.0) and thinking it should be 10.80.166.254.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">When I try to change the gateway for this static route, I get message – RTNETLINK answers: File exists<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">If I remove the static route, I cannot get to any internal or Internet site from a remote site workstation.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Due to the ASA in the traffic path of the remote sites, there is a gre tunnel setup for outbound traffic from the Squid server, without the tunnel the packet would be dropped by the ASA box.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">I know the best practices is to have a proxy server at each remote location, but this solution does work for most requests.<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Has anyone else run into this and found a solution, thanks….<o:p></o:p></p>
</div>
<br clear="both">
______________________________________________________<BR>
<BR>
NIPRO GLASS<BR>
______________________________________________________<BR>
<BR>
CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby<BR>
notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify NIPRO GLASS<BR>
immediately. Any views expressed in<BR>
this message are those of the individual sender and may not necessarily reflect the views of NIPRO GLASS.<BR>
</body>
</html>