[squid-users] Central Proxy using WCCP to multiple sites in our network with ASA box.

[Luderitz Bob]

                I have one central Proxy Server running Squid 3.1.10 under CentOS 6.3 running locally here and also for our 2 remote sites for all http traffic.

                We are using Cisco's WCCP and between the remote sites and the Squid is a ASA box.

                where the Proxy is running Site A and one of the remote Site B.
                From either of the remote sites, when I try to access a printer or other web enabled device thru a browser that is not defined in squid.conf, I get access denied.
                This is strange to me as this request should be considered part of the internal network.
When I put statements in squid.conf for this print, I then get connection timed out.

                From the Squid server, I cannot ping this remote printer due to the static route has 0.0.0.0 as its gateway address.

                See the below config for one of the remote sites:

                In /etc/rc.local file:

                iptunnel add tun-cc mode gre remote 192.168.253.16 local 10.80.166.227 dev eth0
ip link set dev tun-cc up
ip route add 10.80.202.0/23 dev tun-cc metric 101

In squid.conf, this network should be considered internal:
acl nga_net src 10.80.0.0/16    # Internal network (I have tried splitting out the ACL statements but same result)

http_access allow nga_net

If I look at the static routes on the server (netstat -rn or route -v)
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
1.2.3.0         0.0.0.0         255.255.255.0   U         0 0          0 gre0
10.80.166.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
10.80.202.0     0.0.0.0         255.255.254.0   U         0 0          0 tun-cc  (remote site)
0.0.0.0         10.80.166.254   0.0.0.0         UG        0 0          0 eth0

As you can see, the gateway for this remote site is the Internet (0.0.0.0) and thinking it should be 10.80.166.254.
When I try to change the gateway for this static route, I get message - RTNETLINK answers: File exists
If I remove the static route, I cannot get to any internal or Internet site from a remote site workstation.

Due to the ASA in the traffic path of the remote sites, there is a gre tunnel setup for outbound traffic from the Squid server, without the tunnel the packet would be dropped by the ASA box.

I know the best practices is to have a proxy server at each remote location, but this solution does work for most requests.
Has anyone else run into this and found a solution, thanks....

______________________________________________________

NIPRO GLASS
______________________________________________________

CAUTION  - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby
notified  that  any  use,  dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify NIPRO GLASS
 immediately. Any views expressed in
this message are those of the individual sender and may not necessarily reflect the views of NIPRO GLASS.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20141017/ea2490c4/attachment.html>