<div dir="ltr">Thanks Amos,, mike <div><br></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On 25 July 2015 at 03:20, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 25/07/2015 4:59 a.m., Jagannath Naidu wrote:<br>
> 1. Its not a transparent proxy.<br>
><br>
> 2. My clients get wpad configuration from AD server. So there are two<br>
> question.<br>
> 2.1 :I know that wpad is used to identify proxy server and port(and rest<br>
</span>> other bypass rules). When clients resolve to <a href="http://wpad.abc.com" rel="noreferrer" target="_blank">wpad.abc.com</a>, is there way<br>
<span class="">> that I can overwrite the wpad file off client. Like creating a webserver to<br>
> to serve wpad file and I change /etc/hosts file to "<myhwebserveripaddress><br>
</span><span class="">> <a href="http://wpad.abc.com" rel="noreferrer" target="_blank">wpad.abc.com</a>"<br>
> 2.2 Is there any other way to tell clients via squid server, to do not come<br>
> to squid server and re initiate the request.<br>
<br>
</span>Exactly that if you wish. Its not clear whether WPAD is the problem though.<br>
<br>
The fact that you have Squid logs showing access indicates the traffic<br>
us actually getting there okay. The responses do seem to be coming back<br>
from 10.* servers as well.<br>
So what is happening is something is causing those servers not to like<br>
the traffic being requested from them.<br>
<span class=""><br>
<br>
><br>
> On 24 July 2015 at 21:10, Jagannath Naidu <<br>
</span><span class="">> <a href="mailto:jagannath.naidu@fosteringlinux.com">jagannath.naidu@fosteringlinux.com</a>> wrote:<br>
><br>
>><br>
>><br>
>> On 24 July 2015 at 21:05, Jagannath Naidu <<br>
</span><span class="">>> <a href="mailto:jagannath.naidu@fosteringlinux.com">jagannath.naidu@fosteringlinux.com</a>> wrote:<br>
>><br>
>>> Dear List,<br>
>>><br>
>>> I have been working on this for last two weeks, but never got it<br>
>>> resolved.<br>
>>><br>
>>> We have a application server (SERVER) in our local network and a desktop<br>
>>> application (CLIENT). The application picks proxy settings from IE. And we<br>
>>> also have a wensense proxy server<br>
>>><br>
>>> case 1: when there is no proxy set<br>
>>> application works. No logs in squid server access.log<br>
>>><br>
>>> case 2: when proxy ip address set and checked "bypass local network"<br>
>>> application works. No logs in squid server access.log<br>
>>><br>
>>> case 3: when proxy ip address is set to wensense proxy server. UNCHECKED<br>
>>> "bypass local network"<br>
>>> application works. We dont have access to websense server and hence we<br>
>>> can not check logs<br>
<br>
</span>Can you explain "not works" in any better detail?<br>
application expected vs actual behaviour?<br>
if you can relate that to particular HTTP messages even better.<br></blockquote><div>The application is "aspect unified ip agent desktop". It is a dialer application (VOIP). Used on windows machine. </div><div>Rest cases : </div><div><br></div><div>When application is launched, it shows that it has joined domain "HTP". HTP is default, we can change to other from the drop down list. </div><div><br></div><div>Case 4: not works. </div><div><br></div><div>But in this case, it shows no drop down list, nor with a single option like "HTP". Application can connect to server anymore. And I can not call or receive calls anymore.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class=""><br>
<br>
>>><br>
>>><br>
>>> case 4: when proxy ip address is set to proxy server ip address.<br>
>>> UNCHECKED "bypass local network"<br>
>>> application does not work :-(. Below are the logs.<br>
>>><br>
>>><br>
>>> 1437751240.149 7 192.168.122.1 TCP_MISS/404 579 GET<br>
>>> <a href="http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application" rel="noreferrer" target="_blank">http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application</a><br>
</span>>>> - HIER_DIRECT/<a href="http://10.1.4.46" rel="noreferrer" target="_blank">10.1.4.46</a> text/html<br>
<br>
404. The URL you see above references an object that does not exist on<br>
that server.<br>
<br>
Things to look into:<br>
Is it the right server?<br></blockquote><div>Yes </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Is it the right URL?<br></blockquote><div>Yes</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Why was it requested?<br></blockquote><div>Don't know. These were the only logs I can get from access.log. The server is "Microsoft IIS HTTP/1.1"</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does the server actually know its "<a href="http://dlwvdialce.htmedia.net" rel="noreferrer" target="_blank">dlwvdialce.htmedia.net</a>" name?<br></blockquote><div>Yes. It is resolvable 1) ping dlwvdialce works 2) ping <a href="http://dlwvdialce.htmedia.net">dlwvdialce.htmedia.net</a> works </div><div> </div><div>initially "dlwvdialce" was not resolving to any host. That's where used "append_domain .<a href="http://htmedia.net">htmedia.net</a>" is squid.conf (worked for other applications). </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class=""><br>
<br>
>>> 1437751240.992 94 192.168.122.1 TCP_DENIED/407 3757 CONNECT<br>
</span><span class="">>>> <a href="http://0.client-channel.google.com:443" rel="noreferrer" target="_blank">0.client-channel.google.com:443</a> - HIER_NONE/- text/html<br>
>>> 1437751240.996 0 192.168.122.1 TCP_DENIED/407 4059 CONNECT<br>
>>> <a href="http://0.client-channel.google.com:443" rel="noreferrer" target="_blank">0.client-channel.google.com:443</a> - HIER_NONE/- text/html<br>
<br>
<br>
</span>Authentication. Normal I think.<br></blockquote><div>Yes, NTLM auth. </div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class=""><br>
>>> 1437751242.327 5 192.168.122.1 TCP_MISS/404 579 GET<br>
</span>>>> <a href="http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm" rel="noreferrer" target="_blank">http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm</a> - HIER_DIRECT/<br>
>>> 10.1.4.46 text/html<br>
<br>
Same as the first 404'd URL.<br>
<span class=""><br></span></blockquote><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">>> 1437751244.777 1 192.168.122.1 TCP_MISS/503 4048 POST<br>
>>> <a href="http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal" rel="noreferrer" target="_blank">http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal</a><br>
</span>>>> - HIER_NONE/- text/html<br>
<br>
503 usually indicates the attempted server failed.<br>
<br>
Makes sense if TCP to <a href="http://cs-711-core.htmedia.net" rel="noreferrer" target="_blank">cs-711-core.htmedia.net</a> port 8180 did not work.<br>
Which would also match the lack of server IP in the log.<br></blockquote><div><br></div><div> 1) ping <a href="http://cs-711-core.htmedia.net/" rel="noreferrer" target="_blank">cs-711-core.htmedia.net</a> does not work "no such host"</div><div> 2) ping <a href="http://cs-711-core.htmedia.net/" rel="noreferrer" target="_blank">cs-711-core</a> does not work "no such host"</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class=""><br>
<br>
>>><br>
>>> UPDATE: correct logs<br>
>><br>
>> 1437752279.774 6 192.168.122.1 TCP_MISS/404 579 GET<br>
>> <a href="http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application" rel="noreferrer" target="_blank">http://dlwvdialce.htmedia.net/UADInstall/UADPresentationLayer.application</a><br>
</span>>> - HIER_DIRECT/<a href="http://10.1.4.46" rel="noreferrer" target="_blank">10.1.4.46</a> text/html<br>
<span class="">>> 1437752281.854 5 192.168.122.1 TCP_MISS/404 579 GET<br>
</span>>> <a href="http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm" rel="noreferrer" target="_blank">http://dlwvdialce.htmedia.net/UADInstall/uadprop.htm</a> - HIER_DIRECT/<br>
<span class="">>> 10.1.4.46 text/html<br>
>> 1437752284.265 2 192.168.122.1 TCP_MISS/503 4048 POST<br>
>> <a href="http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal" rel="noreferrer" target="_blank">http://cs-711-core.htmedia.net:8180/ConcertoAgentPortal/services/ConcertoAgentPortal</a><br>
</span>>> - HIER_NONE/- text/html<br>
>><br>
<br>
Same comments as above.<br>
<div><div class="h5"><br>
>><br>
>><br>
>>> squid -v<br>
>>> Squid Cache: Version 3.3.8<br>
>>> configure options: '--build=x86_64-redhat-linux-gnu'<br>
>>> '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr'<br>
>>> '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin'<br>
>>> '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include'<br>
>>> '--libdir=/usr/lib64' '--libexecdir=/usr/libexec'<br>
>>> '--sharedstatedir=/var/lib' '--mandir=/usr/share/man'<br>
>>> '--infodir=/usr/share/info' '--disable-strict-error-checking'<br>
>>> '--exec_prefix=/usr' '--libexecdir=/usr/lib64/squid' '--localstatedir=/var'<br>
>>> '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid'<br>
>>> '--with-logdir=$(localstatedir)/log/squid'<br>
>>> '--with-pidfile=$(localstatedir)/run/squid.pid'<br>
>>> '--disable-dependency-tracking' '--enable-eui'<br>
>>> '--enable-follow-x-forwarded-for' '--enable-auth'<br>
>>> '--enable-auth-basic=DB,LDAP,MSNT,MSNT-multi-domain,NCSA,NIS,PAM,POP3,RADIUS,SASL,SMB,getpwnam'<br>
>>> '--enable-auth-ntlm=smb_lm,fake'<br>
>>> '--enable-auth-digest=file,LDAP,eDirectory'<br>
>>> '--enable-auth-negotiate=kerberos'<br>
>>> '--enable-external-acl-helpers=file_userip,LDAP_group,time_quota,session,unix_group,wbinfo_group'<br>
>>> '--enable-cache-digests' '--enable-cachemgr-hostname=localhost'<br>
>>> '--enable-delay-pools' '--enable-epoll' '--enable-icap-client'<br>
>>> '--enable-ident-lookups' '--enable-linux-netfilter'<br>
>>> '--enable-removal-policies=heap,lru' '--enable-snmp' '--enable-ssl'<br>
>>> '--enable-ssl-crtd' '--enable-storeio=aufs,diskd,ufs' '--enable-wccpv2'<br>
>>> '--enable-esi' '--enable-ecap' '--with-aio' '--with-default-user=squid'<br>
>>> '--with-filedescriptors=16384' '--with-dl' '--with-openssl'<br>
>>> '--with-pthreads' 'build_alias=x86_64-redhat-linux-gnu'<br>
>>> 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall<br>
>>> -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong<br>
>>> --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic<br>
>>> -fpie' 'LDFLAGS=-Wl,-z,relro -pie -Wl,-z,relro -Wl,-z,now' 'CXXFLAGS=-O2<br>
>>> -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions<br>
>>> -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches<br>
>>> -m64 -mtune=generic -fpie'<br>
>>> 'PKG_CONFIG_PATH=%{_PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig'<br>
>>><br>
>>><br>
>>> squid.conf<br>
>>><br>
</div></div>>>> acl localnet src <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> # RFC1918 possible internal network<br>
>>> acl localnet src <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> # RFC1918 possible internal network<br>
>>> acl localnet src <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> # RFC1918 possible internal network<br>
<span class="">>>> acl localnet src fc00::/7 # RFC 4193 local private network range<br>
>>> acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged)<br>
>>> machines<br>
>>> acl SSL_ports port 443<br>
>>> acl Safe_ports port 80 # http<br>
>>> acl Safe_ports port 21 # ftp<br>
>>> acl Safe_ports port 443 # https<br>
>>> acl Safe_ports port 70 # gopher<br>
>>> acl Safe_ports port 210 # wais<br>
>>> acl Safe_ports port 1025-65535 # unregistered ports<br>
>>> acl Safe_ports port 280 # http-mgmt<br>
>>> acl Safe_ports port 488 # gss-http<br>
>>> acl Safe_ports port 591 # filemaker<br>
>>> acl Safe_ports port 777 # multiling http<br>
>>> acl Safe_ports port 8180<br>
>>> acl CONNECT method CONNECT<br>
>>> acl wvdial dst 10.1.4.45 10.1.4.50 10.1.4.53 10.1.4.48 10.1.4.54<br>
>>> 10.1.4.46 10.1.4.51 10.1.4.47 10.1.4.55 10.1.4.49 10.1.4.52 10.1.2.4<br>
<br>
</span>For easier reading:<br>
acl wvdial dst 10.1.4.45-10.1.4.55/27 10.1.2.4<br>
<br>
(at least I think they are all in one /27, double-check that)<br>
<br>
>>> http_access allow wvdial<br>
>>> acl dialer dstdomain .<a href="http://htmedia.net" rel="noreferrer" target="_blank">htmedia.net</a><br>
<span class="">>>> http_access allow dialer<br>
>>> http_access deny !Safe_ports<br>
>>> http_access deny CONNECT !SSL_ports<br>
>>> http_access allow localhost manager<br>
>>> http_access deny manager<br>
</span>>>> visible_hostname = <a href="http://NOIDAPROXY01.MYDOMAIN.NET" rel="noreferrer" target="_blank">NOIDAPROXY01.MYDOMAIN.NET</a><br>
<br>
"=" is a funny domain name. I suspect you wanted the domain-name part<br>
of the line to be used instead. Remove the "= " bit.<br>
<br></blockquote><div>Removed = bit. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
>>> append_domain .<a href="http://mydomain.net" rel="noreferrer" target="_blank">mydomain.net</a><br>
>>> ignore_expect_100 on<br>
<br>
The ignore_* directive should not be useful in 3.3. You can remove it now.<br>
<span class=""><br>
>>> dns_v4_first on<br>
>>> auth_param ntlm program /usr/bin/ntlm_auth --diagnostics<br>
</span>>>> --helper-protocol=squid-2.5-ntlmssp --domain=<a href="http://HTMEDIA.NET" rel="noreferrer" target="_blank">HTMEDIA.NET</a><br>
<span class="">>>> auth_param ntlm children 1000<br>
>>> auth_param ntlm keep_alive off<br>
>>> auth_param basic program /usr/bin/ntlm_auth<br>
>>> --helper-protocol=squid-2.5-basic<br>
>>> auth_param basic children 100<br>
>>> auth_param basic realm Squid proxy-caching web server<br>
>>> auth_param basic credentialsttl 2 hours<br>
>>> acl auth proxy_auth REQUIRED<br>
>>> http_access allow all auth<br>
<br>
</span>"allow all auth" means the same as "allow auth".<br>
<br>
"all" only has meaning on the end (right-hand side) of the line which<br>
would otherwise end in a proxy_auth ACL.<br>
It should either be on the end of that line, or not used at all.<br>
<span class=""><br>
<br>
>>> http_access allow localnet<br>
>>> http_access allow localhost<br>
>>> http_access deny all<br>
</span>>>> http_port <a href="http://0.0.0.0:8080" rel="noreferrer" target="_blank">0.0.0.0:8080</a><br>
<span class="">>>> coredump_dir /var/spool/squid<br>
>>> refresh_pattern ^ftp: 1440 20% 10080<br>
>>> refresh_pattern ^gopher: 1440 0% 1440<br>
>>> refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>
>>> refresh_pattern . 0 20% 4320<br>
>>><br>
>>><br>
>>> It was the same behavior with squid-3.1.10-19. I thought, upgrading to<br>
>>> squid 3.3 would help. Please help me resolving this mystery.<br>
<br>
</span>Looks to me like the server at 10.1.4.46 does not know what to do with<br>
the URLs requested.<br>
<br>
I would start looking at whether the application is actually supposed to<br>
be going there for its requests.<br>
<div class="HOEnZb"><div class="h5"><br></div></div></blockquote><div>How can do that ? </div><div>I can install wireshark on client and test the result. </div><div><br></div><div>Am I missing any information to give ? </div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">
Amos<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">Thanks & Regards<br><br><span>B Jagannath</span><br><div>Keen & Able Computers Pvt. Ltd.<br></div><div></div><div>+919871324006<br></div></div></div></div></div></div></div>
</div></div>