4

I am trying to solve problem about configuration of transparent proxy server. I don't have any configuration on devices, I have not started yet. Because of preparing and studying that topic.

I am starting to be little bit confused how the GRE tunnel for encapsulation of packets works. In fact I know how GRE tunnels works but with the configuration of wccp <-> squid it seems to be different.

Cisco official documentation says, GRE tunnels are created automatically. Why not... Less works for me. But I have to configure GRE tunnel on server side. Thats what squid documentation says, by the way.

Example.

  • Router IP address = 192.168.1.254
  • Local engine with squid = 192.168.1.253

For debian I use following commands:

ip tunnel add wccp0 mode gre remote 192.168.1.254 local 192.168.1.253 dev eth0
ifconfig wccp0 192.168.1.253 netmask 255.255.255.255 up

So I don't have to specify GRE IP address? As in normal situation of site to site tunnel, when I have to? How it works? Cisco router and proxy server will negotiate IP address for GRE encapsulation automatically? Which IP addresses they will use?

Each manual or HOWTO on internet looks pretty different.

I will be very glad for any answer. Thanks in advance.

Daniel

Improve this question

2 Answers 2

Reset to default
3

I think Cisco was referring to the interesting traffic is automatically put into a GRE formed tunnel. Which is different than we normally think of when making a GRE tunnel. Usually it has to do with routing and you need a virtual interface to have an IP address so you have something from R1 to push routes to R2.

Correct, in WCCP you don't have to specify an IP address for the GRE interface wccp0. Most of the times I've see it set to the same as the physical interface so you can run squid on that IP address only. As long as you have ip_forward=1 the packet is already decapsulated and in the wccp0 virtual interface. You can verify this by doing a tcpdump -i wccp -vvv and you will see stuff.

The trick here is WCCP happens after the routing process, which is usually how we use GRE. We are skipping the Tunnel interface IP part because we are using an ACL on the Cisco side, and Squid WCCP process gets the packet since it's automatically decapsulated when it arrives. Squid isn't a router so we don't need a Tunnel interface IP for next-hop statements...the decapsulated packet is ready for processing....

WCCP SSL redirection using Squid3.4+ and Cisco ASA

Improve this answer
0
0

Squid box:

ip tunnel add wccp0 mode gre remote any local any dev eth0 ifconfig wccp0 127.0.0.2 netmask 255.255.255.252 up

From the ASA or router, add the wccp service and point the redirect list to 192.168.1.253.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.