Cisco ASA and Squid with WCCP2

Thanks to: http://blog.evoxmusic.fr/

Thanks to SecPuffy. So, that’s we are looking for > Setup squid first: Then on the box (in this case LINUX) running squid do the following:

1. modprobe ip_gre
2. iptunnel add gre1 mode gre remote $ASA_ROUTER_IDENTIFIER local $SQUID_SERVER_IP dev eth0
3. ifconfig gre1 inet 1.2.3.4 netmask 255.255.255.0 up

Updated to reflect great comment from Dan O’Reilly :) The ASA_ROUTER_IDENTIFIER is first of all just identifier and its the highest ip that is on your ASA. Please use the highest IP on your ASA for the iptunnel command. You can get list of all the ips on your asa by doing “show ip”. Next…. Enable forwarding on squid server:

1. echo 1 > /proc/sys/net/ipv4/ip_forward

Disable reverse path filter.

1. echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
2. echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
3. echo 0 > /proc/sys/net/ipv4/conf/gre1/rp_filter

Add IPTABLES rule to redirect all the traffic coming on port 80 over to the squid listening port. i.e: 3128 in this case:

1. iptables -t nat -A PREROUTING -i gre1 -p tcp -m tcp –dport 80 -j REDIRECT –to-port 3128

Now to configure squid.conf: Make sure you compiled squid with transparency support (required for PF , IPFW etc). Do config –help | grep transp to see all the firewalls that need this option. For Cisco ASA etc, you don’t need to have any transparent option. anyways back to squid.conf add the following line:

1. http_port 3128 transparent

“transparent” is the key word here. Now to configure WCCPv2 in squid.conf:

1. wccp2_router <$ASA_IP_ADDRESS>
2. wccp_version 4
3. wccp2_forwarding_method 1
4. wccp2_return_method 1

Enabling/configuring WCCPv2 on CISCO ASA(7.x/8.x): I will go over two scenarios that I came across. First for testing I only wanted certain IPs to hit the squid box before opening it to the rest of the world. Additionaly I didn’t want ALL THE PROTOCOLS to go through the proxy server. Only http (80) to go through squid: so here is what i created: 1. First created acl for the clients I wanted to allow access through squid for port 80

1. ASA# access-list proxyclients extended permit tcp host 192.168.100.202 any eq www

2. I added acl for my proxy servers too.

1. ASA# access-list proxyservers extended permit ip host 192.168.100.3 any

*** 192.168.100.3 – IP address of my squid box. 3. Now the wccp part:

1. ASA# wccp web-cache redirect-list proxyclients group-list proxyservers
2. ASA# wccp interface inside web-cache redirect in

4. Additionaly you can issue:

1. ASA# wccp web-cache

This should get you going :) Now if you wanted to let EVERYONE in the world go through and go through proxy: I would remove all the ACLs and remove one wccp line:

1. ASA# no access-list proxyclients extended permit tcp host 192.168.100.202 any eq www
2. ASA# no access-list proxyservers extended permit ip host 192.168.100.3 any

This is tricky. You have to “no” the wccp interface command first so…

1. ASA# no wccp interface inside web-cache redirect in
2. ASA# no wccp web-cache redirect-list proxyclients group-list proxyservers

Now lets add the wccp interface command back

1. ASA# wccp web-cache
2. ASA# wccp interface inside web-cache redirect in

At this point all your traffic hitting the firewall would be redirected to the squid server. ** note about https transparency: packets are encrypted ..so by the time packets arrive at SQUID ..it cannot understand. So other words https transparency, I don’t think its supported. As superpaia pointed out in his comments: important: “The only topology that the security appliance supports is when client and cache engine are behind the same interface of the security appliance and the cache engine can directly communicate with the client without going through the security appliance.” from Cisco.

- See more at: http://blog.evoxmusic.fr/content/cisco-use-wccp-and-squid-transparent-proxy#sthash.rSuSV3UQ.dpuf