Пытаюсь натсроить связку для прозрачного проксирования из cisco роутера и squid 3.1.0.17 на FreeBSD 7.3.
Делаю все по сквидовским мануалам типа вот этого http://wiki.squid-cache.org/ConfigExamp ... o3640Wccp2
и http://wiki.squid-cache.org/ConfigExamp ... p2Receiver
Но никак оно заводится не хочет. Уже не знаю что и где ковырять.
Циска сквид видит.Но при этом никаких пакетов по gre интерфейсу FreeBSD не идет. Хотя вроде в статистике циска пишет, что пакеты форвардит. И веб странички не открываются. Если сквид убить, то wccp редиректа нету и веб работает. И что добивает больше всего в логах ни циски ни сквида ничего кроме сообщений wccp "I see you" нет.
Отдельно от циски сквид работает.
Код: Выделить всё
#sh ip wccp web-cache detail
#WCCP Client information:
WCCP Client ID: 172.16.0.2
Protocol Version: 2.0
State: Usable
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Hash Allotment: 256 (100.00%)
Packets s/w Redirected: 25
Connect Time: 00:00:52
Bypassed Packets
Process: 0
Fast: 0
CEF: 0
Errors: 0
Код: Выделить всё
sh ip wccp web-cache
Global WCCP information:
Router information:
Router Identifier: 10.11.10.1
Protocol Version: 2.0
Service Identifier: web-cache
Number of Service Group Clients: 1
Number of Service Group Routers: 1
Total Packets s/w Redirected: 3035
Process: 4
Fast: 0
CEF: 3031
Redirect access-list: REDIRECT_HTTP
Total Packets Denied Redirect: 3151
Total Packets Unassigned: 2644
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
Конфиг цыски - роутер 2821
Код: Выделить всё
##version 12.4 c2800nm-advsecurityk9-mz.124-17.bin
ip wccp web-cache redirect-list REDIRECT_HTTP
ip cef
!
interface Loopback0
ip address 10.11.10.1 255.255.255.0
ip route-cache policy
ip route-cache flow
!
interface GigabitEthernet0/0
description VLAN trunk if
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no ip mroute-cache
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/0.1
description vlan management
encapsulation dot1Q 1 native
ip address 192.168.100.254 255.255.255.0
no cdp enable
!
interface GigabitEthernet0/0.90
description proxy
encapsulation dot1Q 90
ip address 172.16.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.95
description web
encapsulation dot1Q 95
ip address 111.111.111.111 255.255.255.248
ip nat outside
ip virtual-reassembly
no cdp enable
!
interface GigabitEthernet0/0.99
description interlink
encapsulation dot1Q 99
ip address 172.16.10.2 255.255.255.0
ip wccp web-cache redirect in
ip nat inside
ip virtual-reassembly
ip ospf authentication
ip ospf authentication-key 7 1438143B0A57382E36
ip ospf message-digest-key 1 md5 7 122A205351392A206E12616B352626
ip ospf network point-to-point
traffic-shape group 101 64000 8000 8000 1000
!
interface GigabitEthernet0/1
description to-fw
ip address 222.222.222.222 255.255.255.252
ip access-group From-INTERNET in
no ip redirects
no ip unreachables
no ip proxy-arp
ip wccp web-cache redirect out
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly
ip route-cache flow
ip policy route-map BILLING_MAP
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map VPN
!
router ospf 10
router-id 172.16.10.2
log-adjacency-changes
area 0 authentication message-digest
redistribute connected subnets
passive-interface default
no passive-interface GigabitEthernet0/0.99
network 172.16.10.2 0.0.0.0 area 0
default-information originate always
!
ip local pool VPN-POOL 172.16.20.10 172.16.20.20
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 222.222.222.222
ip flow-export version 5
ip flow-export destination 172.16.0.2 9996
ip flow-top-talkers
top 30
sort-by bytes
!
ip http server
ip http access-class 99
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat pool POOL1 222.222.222.222 222.222.222.222 netmask 255.255.255.252
ip nat inside source route-map NO_NAT_VPN pool POOL1 overload
!
!
ip access-list extended FOR-MOBILE-USERS
permit ip any any
ip access-list extended From-INTERNET
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
permit ip any any
!
ip access-list extended REDIRECT_HTTP
deny tcp host 172.16.0.2 any
permit tcp 192.168.0.0 0.0.255.255 any eq www
!
ip access-list extended VPN_NO_NAT
deny ip 192.168.0.0 0.0.255.255 172.16.20.0 0.0.0.255
deny ip 172.16.0.0 0.0.0.255 172.16.20.0 0.0.0.255
deny ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255
permit ip 192.168.0.0 0.0.255.255 any
permit ip 172.16.0.0 0.0.0.255 any
permit ip 172.16.10.0 0.0.0.255 any
!
logging trap debugging
logging facility local3
logging 172.16.0.2
access-list 99 permit 192.168.100.0 0.0.0.255
access-list 99 permit 172.16.20.0 0.0.0.255
access-list 101 permit ip any 192.168.10.0 0.0.0.255
access-list 108 permit ip any 192.168.0.0 0.0.255.255
route-map NO_NAT_VPN permit 1
match ip address VPN_NO_NAT
!
route-map BILLING_MAP permit 10
match ip address 108
set interface Loopback0 GigabitEthernet0/1
!
Конфиг FreeBSD gre
Код: Выделить всё
ifconfig gre0 create
ifconfig gre0 172.16.0.2 10.20.30.40 netmask 255.255.255.255 link1 tunnel 172.16.0.2 172.16.0.1 up
Конфиг сквида имеющий отношение к wccp
Код: Выделить всё
http_port 3128 transparent
wccp2_router 172.16.0.1
wccp2_forwarding_method 1
wccp2_return_method 1
wccp2_service standard 0
