#show ip wccp 80 detail
WCCP Cache-Engine information:
IP Address: xx.xx.241.40
Protocol Version: 2.0
State: Usable
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Hash Allotment: 256 (100.00%)
Packets Redirected: 0
Connect Time: 1d05h
#show ip wccp 90 detail
WCCP Cache-Engine information:
IP Address: xx.xx.241.40
Protocol Version: 2.0
State: Usable
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Hash Allotment: 256 (100.00%)
Packets Redirected: 0
Connect Time: 1d05h
Adrian Chadd wrote:
"show ip wccp"
and since you're using groups 80 and 90, not the default web-cache type, also
"show ip wccp 80 detail"
"show ip wccp 90 detail"
2009/7/10 Behnam B.Marandi <blix...@gmail.com>:
Thanks for quick replay.
I did set "ip wccp web-cache" in the router config but;
#sh ip wccp web-cache detail
No information is available for the service.
In case of access-list, what I got from step 35 is that access-list just
used for excluding specific web sites from redirecting to cache. Otherwise I
don't know how and where (in router config or squid config) to put an
access-list.
Behnam.
Tom Penndorf wrote:
Hi,
Am 10.07.2009 um 07:29 schrieb Behnam B.Marandi:
I did setup a full transparent caching machine based on Nicholas Ritter's
guide:
http://www.mail-archive.com/squid-users@squid-cache.org/msg65056.html
Cache machine is a Cent OS 5.3
Router is;
IOS (tm) C2600 Software (C2600-IS-M), Version 12.2(11)T8, RELEASE
SOFTWARE (fc1)
Squid config is;
http_port 194.225.241.40:5119 tproxy disable-pmtu-discovery=always
wccp2_router xx.xx.241.39
wccp_version 4
wccp2_rebuild_wait off
wccp2_forwarding_method 1
wccp2_return_method 1
wccp2_assignment_method 1
wccp2_service dynamic 80
wccp2_service dynamic 90
wccp2_service_info 80 protocol=tcp flags=src_ip_hash priority=240
ports=80
wccp2_service_info 90 protocol=tcp flags=dst_ip_hash,ports_source
priority=240 ports=80
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src xx.xx.240.0/20
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
cache_dir ufs /var/spool/squid 4000 16 256
hierarchy_stoplist cgi-bin ?
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
coredump_dir /usr/local/squid/var/cache
visible_hostname tco53
I'm not sure IOS version is critical or not, and in case of
"wccp2_rebuild_wait" I had to set it "off" so the router can see the cache
machine;
6#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: xx.xx.241.39
Protocol Version: 2.0
Service Identifier: web-cache
Number of Cache Engines: 0
Number of routers: 0
Total Packets Redirected: 0
Redirect access-list: -none-
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Service Identifier: 80
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 0
Redirect access-list: -none-
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Service Identifier: 90
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 0
Redirect access-list: -none-
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
As you can see, the router isn't redirecting the traffic to the proxy.
Please send the output of "show ip wccp detail". Also you don't have
defined any access-list for redirecting, so the router don't knows, which
traffic to redirect.
Clients can browse web but there is no transfer between router and cache
machine:
[r...@tco53 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:10:22:FE:6E:EC inet
addr:xx.xx.241.40 Bcast:194.225.241.63 Mask:255.255.255.192
inet6 addr: fe80::210:22ff:fefe:6eec/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:83610 errors:0 dropped:0 overruns:1 frame:0
TX packets:24135 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:7179021 (6.8 MiB) TX bytes:3493119 (3.3 MiB)
Interrupt:5
gre0 Link encap:UNSPEC HWaddr
00-00-00-00-AC-BF-F4-6F-00-00-00-00-00-00-00-00 inet
addr:xx.xx.241.40 Mask:255.255.255.192
UP RUNNING NOARP MTU:1476 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
lo Link encap:Local Loopback inet addr:127.0.0.1
Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:10097 errors:0 dropped:0 overruns:0 frame:0
TX packets:10097 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:424456 (414.5 KiB) TX bytes:424456 (414.5 KiB)
[r...@tco53 ~]# cat /etc/rc.local
ifconfig gre0 194.225.241.40 netmask 255.255.255.192 up
touch /var/lock/subsys/local
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind
/usr/local/squid/sbin/squid
I compiled gre in the kernel so there is no need to modprobe it;
CONFIG_NET_IPGRE=y
CONFIG_NET_IPGRE_BROADCAST=y
[r...@tco53 ~]# ip ru sh
0: from all lookup 255
32765: from all fwmark 0x1 lookup 100
32766: from all lookup main
32767: from all lookup default
[r...@tco53 ~]# ip ro sh ta 100
local default dev lo scope host
[r...@tco53 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.3.2 on Sun Jul 5 17:04:57 2009
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [26:3416]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -i gre0 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -i eth0 -p gre -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j
ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 55936
-j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -s xx.xx.241.39/32 -p udp -m udp --dport 2048 -j
ACCEPT
COMMIT
# Completed on Sun Jul 5 17:04:57 2009
# Generated by iptables-save v1.4.3.2 on Sun Jul 5 17:04:57 2009
*mangle
:PREROUTING ACCEPT [10:1680]
:INPUT ACCEPT [38:3760]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [26:3416]
:POSTROUTING ACCEPT [26:3416]
:DIVERT - [0:0]
-A DIVERT -j MARK --set-xmark 0x1/0xffffffff
-A DIVERT -j ACCEPT
-A PREROUTING -p tcp -m socket -j DIVERT
-A PREROUTING -p tcp -m tcp --dport 80 -j TPROXY --on-port 5119 --on-ip
xx.xx.241.40 --tproxy-mark 0x1/0x1 COMMIT
# Completed on Sun Jul 5 17:04:57 2009
I don't know where this line came from; "-A RH-Firewall-1-INPUT -d
224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT"
I guess despite identification of cache machine by router, it does not
qualified by the router to route web traffic trough it.
Don't know how to debug this, any idea to help this out would be greatly
appreciated.
Behnam.
Tom
