IgorKH

Здравствуйте, перечитал много статей, хочу сделать прозрачный прокси, но не могу подружить Cisco(1721) и squid(на FC5) через WCCPv2. Похоже проблема в Cisco. Они друг друга видят, пакеты I_See_You и Here_I_Am ходят router#debug ip wccp events WCCP events debugging is on router#debug ip wccp packets WCCP packet info debugging is on router#terminal monitor router# Mar 30 10:28:13: WCCP-PKT:S00: Received valid Here_I_Am packet from xxx.xxx.xxx.241 w/rcv_id 00003E5E Mar 30 10:28:13: WCCP-PKT:S00: Sending I_See_You packet to xxx.xxx.xxx.241 w/ rcv_id 00003E5F Mar 30 10:28:23: WCCP-PKT:S00: Received valid Here_I_Am packet from xxx.xxx.xxx.241 w/rcv_id 00003E5F Mar 30 10:28:23: WCCP-PKT:S00: Sending I_See_You packet to xxx.xxx.xxx.241 w/ rcv_id 00003E60 Но когда включаю на interface FastEthernet0 ip wccp web-cache redirect out, то инет пропадает для всех, кроме xxx.xxx.xxx.241, что в принципе правильно в соответствии с access-list 110. Но Packets Redirected не приходят на сквид, т.е. других пакетов по debug и tcpdump, кроме I_See_You и Here_I_Am нет в этот момент не на линуксе не на циске. Кривой IOS? Конфигурация. Сеть: между локалкой и инетом расположена Cisco 1721. [root@www ~]$ uname -a Linux www.aaa.ru 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006 i686 i686 i386 GNU/Linux [root@www ~]$ ./squid -v Squid Cache: Version 2.6.STABLE9 configure options: '--build=i686-redhat-linux-gnu' '--host=i686-redhat-linux-gnu' '--target=i686-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/libexec' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--localstatedir=/var' '--datadir=/usr/share' '--sysconfdir=/etc/squid' '--enable-epoll' '--enable-snmp' '--enable-removal-policies=heap,lru' '--enable-storeio=aufs,coss,diskd,null,ufs' '--enable-ssl' '--with-openssl=/usr/kerberos' '--enable-delay-pools' '--enable-linux-netfilter' '--with-pthreads' '--enable-ntlm-auth-helpers=SMB,fakeauth' '--enable-external-acl-helpers=ip_user,ldap_group,unix_group ,wbinfo_group' '--enable-auth=basic,digest,ntlm' '--enable-digest-auth-helpers=password' '--with-winbind-auth-challenge' '--enable-useragent-log' '--enable-referer-log' '--disable-dependency-tracking' '--enable-cachemgr-hostname=localhost' '--enable-underscores' '--enable-basic-auth-helpers=LDAP,MSNT,NCSA,PAM,SMB,YP,getpw nam,multi-domain-NTLM,SASL' '--enable-cache-digests' '--enable-ident-lookups' '--with-large-files' '--enable-follow-x-forwarded-for' '--enable-wccpv2' '--enable-fd-config' '--with-maxfd=16384' 'CFLAGS=-fPIE -Os -g -pipe -fsigned-char' 'LDFLAGS=-pie' 'build_alias=i686-redhat-linux-gnu' 'host_alias=i686-redhat-linux-gnu' 'target_alias=i686-redhat-linux-gnu' Cisco - внутренний адрес xxx.xxx.xxx.11 fc5 со сквидом xxx.xxx.xxx.241 Конфиг самой циски router#sh run Building configuration... Current configuration : 4245 bytes ! ! Last configuration change at 12:53:09 Russia Tue Mar 27 2007 by xxx ! version 12.3 service timestamps debug datetime localtime service timestamps log datetime localtime service password-encryption ! hostname router ! boot-start-marker boot-end-marker ! security passwords min-length 6 no logging buffered enable secret 5 <secret> ! username xxxr privilege 15 view root secret 5 <secret> clock timezone Russia 5 mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 no aaa new-model ip subnet-zero ip wccp web-cache redirect-list 110 ! ! ip cef ip domain name aaa.ru ip name-server nnn.nnn.nnn.nnn ip name-server nnn.nnn.nnn.nnn ip name-server nnn.nnn.nnn.nnn ip ips po max-events 100 no ftp-server write-enable ! ! ! interface Loopback0 ip address 192.168.0.1 255.255.255.0 ip route-cache policy ip route-cache flow ! interface FastEthernet0 description $ETH-LAN$Internet ip address ggg.ggg.ggg.ggg 255.255.255.252 ip access-group fa0-in in ip wccp web-cache redirect out ip nat outside ip virtual-reassembly ip route-cache policy ip route-cache flow ip policy route-map OUR_MAP speed auto ! interface FastEthernet1 description LOCAL_PORT_1 no ip address no cdp enable ! interface FastEthernet2 switchport access vlan 2 no ip address shutdown no cdp enable ! interface FastEthernet3 no ip address shutdown no cdp enable ! interface FastEthernet4 no ip address shutdown no cdp enable ! interface Vlan1 ip address xxx.xxx.1.11 255.255.255.0 ip nat inside ip virtual-reassembly ip route-cache policy ip route-cache flow ! ip classless ip route 0.0.0.0 0.0.0.0 bbb.bbb.bbb.bbb no ip http server ip http authentication local no ip http secure-server ip flow-export version 5 ip flow-export destination xxx.xxx.xxx.241 9999 ! ip nat translation dns-timeout 30 ip nat translation icmp-timeout 30 ip nat inside source list 1 interface FastEthernet0 overload ip nat inside source static tcp xxx.xxx.xxx 21 ggg.ggg.ggg.ggg 21 extendable ip nat inside source static tcp xxx.xxx.xxx 22 ggg.ggg.ggg.ggg 22 extendable ip nat inside source static tcp xxx.xxx.xxx 25 ggg.ggg.ggg.ggg 25 extendable ip nat inside source static tcp xxx.xxx.xxx 80 ggg.ggg.ggg.ggg 80 extendable ip nat inside source static tcp xxx.xxx.xxx 110 ggg.ggg.ggg.ggg 110 extendable ! ! ip access-list extended fa0-in deny ip 169.254.0.0 0.0.255.255 any deny ip 192.0.2.0 0.0.0.255 any deny ip 224.0.0.0 0.255.255.255 any deny ip 10.0.0.0 0.255.255.255 any deny ip 240.0.0.0 0.255.255.255 any deny ip 192.168.0.0 0.0.255.255 any deny ip 172.16.0.0 0.128.255.255 any permit udp any eq ntp host ggg.ggg.ggg.ggg eq ntp permit tcp any host ggg.ggg.ggg.ggg eq smtp permit tcp any host ggg.ggg.ggg.ggg eq www permit tcp any host ggg.ggg.ggg.ggg eq pop3 permit tcp any host ggg.ggg.ggg.ggg eq 81 permit tcp any host ggg.ggg.ggg.ggg eq ftp deny tcp any any range 1 1024 deny udp any any range 1 1024 permit ip any any access-list 1 permit xxx.xxx.xxx.0 0.0.0.255 access-list 108 permit ip any xxx.xxx.xxx.0 0.0.0.255 access-list 110 deny ip host xxx.xxx.xxx.241 any access-list 110 permit ip any any snmp-server community public RO ! route-map OUR_MAP permit 10 match ip address 108 set interface Loopback0 Vlan1 ! ! control-plane ! line con 0 exec-timeout 120 0 line aux 0 line vty 0 4 exec-timeout 0 0 login local length 0 ! ntp clock-period 17180116 ntp server zzz.zzz.zzz.zzz prefer ntp server zzz.zzz.zzz.zzz ntp server zzz.zzz.zzz.zzz prefer ntp server zzz.zzz.zzz.zzz ntp server zzz.zzz.zzz.zzz ntp server zzz.zzz.zzz.zzz ntp server zzz.zzz.zzz.zzz end router# Конфиг сквида http_port 3128 transparent hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? cache deny QUERY acl apache rep_header Server ^Apache broken_vary_encoding allow apache access_log /var/log/squid/access.log squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports acl work src xxx.xxx.xxx.0/255.255.255.0 http_access allow work http_access deny all http_reply_access allow all icp_access allow all error_directory /usr/share/squid/errors/Russian-1251 wccp2_router xxx.xxx.xxx.11 wccp_version 4 Циска сквид видит router#sh ip wccp web-cache view WCCP Routers Informed of: 192.168.0.1 WCCP Cache Engines Visible: xxx.xxx.xxx.241 WCCP Cache Engines NOT Visible: -none- router# запросы редиректит но на сквид они или не доходят или не правильно обрабатываются! router#sh ip wccp Global WCCP information: Router information: Router Identifier: 192.168.0.1 Protocol Version: 2.0 Service Identifier: web-cache Number of Cache Engines: 1 Number of routers: 1 Total Packets Redirected: 387 Redirect access-list: 110 Total Packets Denied Redirect: 0 Total Packets Unassigned: 0 Group access-list: -none- Total Messages Denied to Group: 0 Total Authentication failures: 0 Total Bypassed Packets Received: 0 router# router#sh ip wccp web-cache detail WCCP Cache-Engine information: Web Cache ID: xxx.xxx.xxx.241 Protocol Version: 2.0 State: Usable Initial Hash Info: 00000000000000000000000000000000 00000000000000000000000000000000 Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF Hash Allotment: 256 (100.00%) Packets Redirected: 225 Connect Time: 04:33:41 Bypassed Packets Process: 0 Fast: 0 CEF: 0 Циска router#sh hardware Cisco IOS Software, C1700 Software (C1700-K9O3SY7-M), Version 12.3(11)T, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright © 1986-2004 by Cisco Systems, Inc. Compiled Sat 18-Sep-04 09:32 by eaarmas ROM: System Bootstrap, Version 12.2(7r)XM2, RELEASE SOFTWARE (fc1) router uptime is 2 days, 17 hours, 2 minutes System returned to ROM by address error at PC 0x80948A50, address 0x80948A50 at 17:03:51 Russia Tue Mar 27 2007 System restarted at 17:06:51 Russia Tue Mar 27 2007 System image file is "flash:c1700-k9o3sy7-mz.123-11.T.bin" Cisco 1721 (MPC860P) processor (revision 0x400) with 60642K/4894K bytes of memory. Processor board ID FOC08321HCV (587237953), with hardware revision 0000 MPC860P processor: part number 5, mask 2 1 Ethernet interface 5 FastEthernet interfaces 32K bytes of NVRAM. 32768K bytes of processor board System flash (Read/Write)