Здравствуйте, перечитал много статей, хочу сделать прозрачный прокси,но не могу подружить Cisco(1721) и squid(на FC5) через WCCPv2.
Похоже проблема в Cisco. Они друг друга видят, пакеты I_See_You и Here_I_Am ходятrouter#debug ip wccp events
WCCP events debugging is on
router#debug ip wccp packets
WCCP packet info debugging is on
router#terminal monitor
router#
Mar 30 10:28:13: WCCP-PKT:S00: Received valid Here_I_Am packet from xxx.xxx.xxx.241 w/rcv_id 00003E5E
Mar 30 10:28:13: WCCP-PKT:S00: Sending I_See_You packet to xxx.xxx.xxx.241 w/ rcv_id 00003E5F
Mar 30 10:28:23: WCCP-PKT:S00: Received valid Here_I_Am packet from xxx.xxx.xxx.241 w/rcv_id 00003E5F
Mar 30 10:28:23: WCCP-PKT:S00: Sending I_See_You packet to xxx.xxx.xxx.241 w/ rcv_id 00003E60
Но когда включаю на interface FastEthernet0 ip wccp web-cache redirect out, то инет пропадает.
Меня беспокоит, что других пакетов, кроме I_See_You и Here_I_Am по дампу нет в этот момент.
Кривой IOS?
Конфигурация.
Сеть: между локалкой и инетом расположена Cisco 1721.
[root@www ~]$ uname -a
Linux www.aaa.ru 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006 i686 i686 i386 GNU/Linux
[root@www ~]$ ./squid -v
Squid Cache: Version 2.6.STABLE9
configure options: '--build=i686-redhat-linux-gnu' '--host=i686-redhat-linux-gnu' '--target=i686-redhat-linux-gnu'
'--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc'
'--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/libexec' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man'
'--infodir=/usr/share/info' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var'
'--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru'
'--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl' '--with-openssl=/usr/kerberos' '--enable-delay-pools'
'--enable-linux-netfilter' '--with-pthreads' '--enable-ntlm-auth-helpers=SMB,fakeauth'
'--enable-external-acl-helpers=ip_user,ldap_group,unix_group,wbinfo_group' '--enable-auth=basic,digest,ntlm'
'--enable-digest-auth-helpers=password' '--with-winbind-auth-challenge' '--enable-useragent-log' '--enable-referer-log'
'--disable-dependency-tracking' '--enable-cachemgr-hostname=localhost' '--enable-underscores'
'--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpwnam,multi-domain-NTLM,SASL' '--enable-cache-digests'
'--enable-ident-lookups' '--with-large-files' '--enable-follow-x-forwarded-for' '--enable-wccpv2' '--enable-fd-config'
'--with-maxfd=16384' 'CFLAGS=-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie' 'build_alias=i686-redhat-linux-gnu'
'host_alias=i686-redhat-linux-gnu' 'target_alias=i686-redhat-linux-gnu'
Cisco - внутренний адрес xxx.xxx.xxx.11
fc5 со сквидом xxx.xxx.xxx.241
Конфиг самой циски
router#sh run
Building configuration...
Current configuration : 4245 bytes
!
! Last configuration change at 12:53:09 Russia Tue Mar 27 2007 by xxx
!
version 12.3
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
security passwords min-length 6
no logging buffered
enable secret 5 <secret>
!
username xxxr privilege 15 view root secret 5 <secret>
clock timezone Russia 5
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no aaa new-model
ip subnet-zero
ip wccp web-cache redirect-list 110
!
!
ip cef
ip domain name aaa.ru
ip name-server nnn.nnn.nnn.nnn
ip name-server nnn.nnn.nnn.nnn
ip name-server nnn.nnn.nnn.nnn
ip ips po max-events 100
no ftp-server write-enable
!
!
!
interface Loopback0
ip address 192.168.0.1 255.255.255.0
ip route-cache policy
ip route-cache flow
!
interface FastEthernet0
description $ETH-LAN$Internet
ip address ggg.ggg.ggg.ggg 255.255.255.252
ip access-group fa0-in in
ip wccp web-cache redirect out
ip nat outside
ip virtual-reassembly
ip route-cache policy
ip route-cache flow
ip policy route-map OUR_MAP
speed auto
!
interface FastEthernet1
description LOCAL_PORT_1
no ip address
no cdp enable
!
interface FastEthernet2
switchport access vlan 2
no ip address
shutdown
no cdp enable
!
interface FastEthernet3
no ip address
shutdown
no cdp enable
!
interface FastEthernet4
no ip address
shutdown
no cdp enable
!
interface Vlan1
ip address xxx.xxx.1.11 255.255.255.0
ip nat inside
ip virtual-reassembly
ip route-cache policy
ip route-cache flow
!
ip classless
ip route 0.0.0.0 0.0.0.0 bbb.bbb.bbb.bbb
no ip http server
ip http authentication local
no ip http secure-server
ip flow-export version 5
ip flow-export destination xxx.xxx.xxx.241 9999
!
ip nat translation dns-timeout 30
ip nat translation icmp-timeout 30
ip nat inside source list 1 interface FastEthernet0 overload
ip nat inside source static tcp xxx.xxx.xxx 21 ggg.ggg.ggg.ggg 21 extendable
ip nat inside source static tcp xxx.xxx.xxx 22 ggg.ggg.ggg.ggg 22 extendable
ip nat inside source static tcp xxx.xxx.xxx 25 ggg.ggg.ggg.ggg 25 extendable
ip nat inside source static tcp xxx.xxx.xxx 80 ggg.ggg.ggg.ggg 80 extendable
ip nat inside source static tcp xxx.xxx.xxx 110 ggg.ggg.ggg.ggg 110 extendable
!
!
ip access-list extended fa0-in
deny ip 169.254.0.0 0.0.255.255 any
deny ip 192.0.2.0 0.0.0.255 any
deny ip 224.0.0.0 0.255.255.255 any
deny ip 10.0.0.0 0.255.255.255 any
deny ip 240.0.0.0 0.255.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 172.16.0.0 0.128.255.255 any
permit udp any eq ntp host ggg.ggg.ggg.ggg eq ntp
permit tcp any host ggg.ggg.ggg.ggg eq smtp
permit tcp any host ggg.ggg.ggg.ggg eq www
permit tcp any host ggg.ggg.ggg.ggg eq pop3
permit tcp any host ggg.ggg.ggg.ggg eq 81
permit tcp any host ggg.ggg.ggg.ggg eq ftp
deny tcp any any range 1 1024
deny udp any any range 1 1024
permit ip any any
access-list 1 permit xxx.xxx.xxx.0 0.0.0.255
access-list 108 permit ip any xxx.xxx.xxx.0 0.0.0.255
access-list 110 deny ip host xxx.xxx.xxx.241 any
access-list 110 permit ip any any
snmp-server community public RO
!
route-map OUR_MAP permit 10
match ip address 108
set interface Loopback0 Vlan1
!
!
control-plane
!
line con 0
exec-timeout 120 0
line aux 0
line vty 0 4
exec-timeout 0 0
login local
length 0
!
ntp clock-period 17180116
ntp server zzz.zzz.zzz.zzz prefer
ntp server zzz.zzz.zzz.zzz
ntp server zzz.zzz.zzz.zzz prefer
ntp server zzz.zzz.zzz.zzz
ntp server zzz.zzz.zzz.zzz
ntp server zzz.zzz.zzz.zzz
ntp server zzz.zzz.zzz.zzz
end
router#
Конфиг сквида
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
access_log /var/log/squid/access.log squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl work src xxx.xxx.xxx.0/255.255.255.0
http_access allow work
http_access deny all
http_reply_access allow all
icp_access allow all
error_directory /usr/share/squid/errors/Russian-1251
wccp2_router xxx.xxx.xxx.11
wccp_version 4
Циска сквид видит
router#sh ip wccp web-cache view
WCCP Routers Informed of:
192.168.0.1
WCCP Cache Engines Visible:
xxx.xxx.xxx.241
WCCP Cache Engines NOT Visible:
-none-
router#
запросы редиректит но на сквид они или не доходят или не правильно
обрабатываются!
router#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: 192.168.0.1
Protocol Version: 2.0
Service Identifier: web-cache
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 387
Redirect access-list: 110
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 3
Total Bypassed Packets Received: 0
router#
router#sh ip wccp web-cache detail
WCCP Cache-Engine information:
Web Cache ID: xxx.xxx.xxx.241
Protocol Version: 2.0
State: Usable
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Hash Allotment: 256 (100.00%)
Packets Redirected: 225
Connect Time: 04:33:41
Bypassed Packets
Process: 0
Fast: 0
CEF: 0
Циска
router#sh hardware
Cisco IOS Software, C1700 Software (C1700-K9O3SY7-M), Version 12.3(11)T, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2004 by Cisco Systems, Inc.
Compiled Sat 18-Sep-04 09:32 by eaarmas
ROM: System Bootstrap, Version 12.2(7r)XM2, RELEASE SOFTWARE (fc1)
router uptime is 2 days, 17 hours, 2 minutes
System returned to ROM by address error at PC 0x80948A50, address 0x80948A50 at 17:03:51 Russia Tue Mar 27 2007
System restarted at 17:06:51 Russia Tue Mar 27 2007
System image file is "flash:c1700-k9o3sy7-mz.123-11.T.bin"
Cisco 1721 (MPC860P) processor (revision 0x400) with 60642K/4894K bytes of memory.
Processor board ID FOC08321HCV (587237953), with hardware revision 0000
MPC860P processor: part number 5, mask 2
1 Ethernet interface
5 FastEthernet interfaces
32K bytes of NVRAM.
32768K bytes of processor board System flash (Read/Write)
