Forward from ASA5505 to Squid

[derivo001]

Hi folks.

I'm searching in the last few weeks a way to forward the external requests (http/https, mostly to logon on the web servers available), from the ASA5505 appliance to the Squid proxy.

The LAN gateway is a L3 switch.
The Squid are on a different vlan and is virtual.
I already set up the squid to act as a reverse proxy, so I can use an unique public ip address with multiple vhosts.

How can I configure the ASA to forward this external requests to the Squid? Do I need to use WCCP?

I appreciate the efforts.

Thanks in advance.

[Richard Burts]

It sounds like WCCP  would be what you need to forward the traffic. But my memory is that WCCP on ASA requires that the proxy server be accessed by the same interface as the user traffic and it does not sound like that is the case in what you describe.

HTH

Rick

[derivo001]

I think that the route-map function on ASA can help me to solve this issue.

During the reading of some articles, I founded the route-map which consists in create an access list denying everything different than a http request. An example is attached.

And then just point a next hop address to redirect to Squid.

I really expect that it can works for me.

What do you think?

Thanks in advance.

[Richard Burts]

WCCP was developed for communication between the Cisco and a caching server. It provides forwarding traffic from Cisco to the caching server and also provides a mechanism through which the caching server can send traffic back to the Cisco. The PBR solution might take care of the first part where Cisco sends to the server but would not provide the second part where the server returns traffic to the Cisco. I do not have enough experience with Squid to know whether return traffic is a factor or not. So your PBR might work fine or it might not.

HTH

Rick

[derivo001]

Hi Richard.

The necessity is to redirect the external requests (users over the web - ingress interface is fa0/0) to my internal web servers (that is located at fa0/1) and the proxy server is in the same interface as the web servers. I did the squid configuration as a reverse proxy, because we want to use an unique public ip address and the proxy will match the different sub-domains located as a virtual hosts over the web servers. It is a quite hard to do this configuration because these kind of information are deeply pulverized over the web regarding wccp, squid, reverse, pbr and so on. I will try today the route-map configuration and I let you know about the results. I'm not sure if even my squid reverse configuration are right to work but I will test it. To make the wccp a reality do I need to put the proxy server outside of the LAN? How the requests will reach the web servers in this scenario?

EDIT: I found a solution to this scenario. I'm using Nginx as a reverse proxy and it works very well.

On ASA I did a nat to the nginx proxy, the acl only accepts requests in port 80 and 443 and bum! With a few lines the first web server turn reachable over the internet.

This case can be closed.

Thanks.