Come stabilire la connessione WCCP tra linux (squid, si intende già configurato) e Cisco ASA (testato con il 5510)

Sul linux, con squid >2.6 installato:
#modprobe ip_gre
#iptunnel add gre1 mode gre remote 192.168.1.254 local 192.168.1.19 dev eth0
i#fconfig gre1 inet 192.168.1.19 netmask 255.255.255.0 up
#echo 1 > /proc/sys/net/ipv4/ip_forward
#echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
#echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
#echo 0 > /proc/sys/net/ipv4/conf/gre1/rp_filter
#iptables -t nat -A PREROUTING -i gre1 -p tcp -s 192.168.1.0/24 -m tcp –dport 80 -j REDIRECT –to-port 8080
#iptables -t nat -A PREROUTING -i eth0 -p tcp -s 192.168.1.0/24 -m tcp –dport 80 -j REDIRECT –to-port 8080

sul Cisco:
#access-list proxyclients extended deny tcp host 192.168.1.68 any eq www <— per ip che devono fare il bypass del trasparent proxy
#access-list proxyclients extended permit tcp 192.168.1.0 255.255.255.0 any eq www <– ip che saranno soggetti al trasparent proxy
#access-list proxyservers extended permit ip host 192.168.1.19 any
#wccp web-cache redirect-list proxyclients group-list proxyservers
#wccp interface  Lan web-cache redirect in
#wccp web-cache

per vedere lo stato sul Cisco:
sh wccp web-cache detail
e
sh wccp web-cache

NB:
“The only topology that the security appliance supports is when client and cache engine are behind the same interface of the security appliance and the cache engine can directly communicate with the client without going through the security appliance.”