WCCP and public squid proxy

[MightyBob]

Hi folks,

I'm looking for a great config to forward all HTTP/HTTPS traffic from the LAN clients to a public squid server through a fortigate (FortiWifi 60D).

Here is a tiny view of the network :

                +----------------------+ (Internet)------| Squid (IPPROXY:3129) |     |           +----------------------+     |     | +-----------------+ | wan1 (IPWAN)    | |     FGT         | |internal (IPLAN) | +-----------------+    |    |  (LAN)

The linux box hosting the squid server is dedicated and fully configurable.

IPPROXY and IPWAN are public addresses

IPLAN is a private address on LAN (kind of 192.168.xx.0/24)

Thanks for your so helpful comments and advices ;)

[emnoc]

Are you  doing transparent?

Since you have port3129 it seems like this a explicit-proxy.  if your doing WCCP and transparent , hundreds of examples exist on the internet for setting up squild and the kb/cookbooks has a few advance examples for fortigate WCCP

Ken

[MightyBob]

Hi,

Indeed, I'd like to have a transparent proxy and don't want to change config an all devices...

I can change the squid config as needed. If port 3129 is not the best, I can change.

Examples I've found on the cookbooks are showing the config for a squid in DMZ or in LAN... but nothing a squid outside of the network. I mean my squid proxy is hosted in a public server on the internet.

Thanks for your help.

Bob

[FortiKoala]

Few are a few articles that might be helpful

http://kb.fortinet.com/kb/viewContent.do?externalId=FD30096

http://kb.fortinet.com/kb/viewContent.do?externalId=FD32362

[emnoc]

So if it's transparent you need

1: WCCP proxy config on the fgt & enable WCCP on the intercept interface

2: set the squid box for WCCP

3: determine if you forward via layer2 ( firewall and squid on the same LAN ) or  GRE

4: build a fwpolicy   that causes the redirection via WCCP

5: push a certificate to the clients

note: if your set for explicit-proxy ( i.e  your port 3129 ) than you need a fwpolicy to allow access to the  explicit-proxy

[MightyBob]

1: WCCP proxy config on the fgt & enable WCCP on the intercept interface

Enabling WCCP on Internal interface is ok, but it's not so clear to me for WCCP proxy config. What do you mean?

2: set the squid box for WCCP

That's OK!

3: determine if you forward via layer2 ( firewall and squid on the same LAN ) or  GRE

It will be GRE as forwarding is done through the WAN.

4: build a fwpolicy   that causes the redirection via WCCP

I'm not sure to understand well.

5: push a certificate to the clients

Which certificate? Well, security is not (yet) an issue in this PoC!!!

[emnoc]

For the WCCP it's simple

config system interface     edit "LANUSERS"         set vdom "root"         set ip 10.11.2454 255.255.255.0         set allowaccess ping https ssh snmp         set vlanforward enable         set device-identification enable         set snmp-index 913         set wccp enable         set interface "AE01"         set vlanid 100     next end 

config firewall policy     edit 18080         set srcintf "LANUSERS"         set dstintf "wan1"

        set srcaddr  "LANUSERS"

        set dstaddr "all"         set action accept         set schedule "always"         set service "HTTP" "HTTPS"         set logtraffic all         set wccp enable 

        set comment "mysquid on dedicate interface GRE forward/return"     next end

If  your doing SSL inspection, you need to issue the certificate TO  THE LAN USERS!!!!

[MightyBob]

Thanks, it's ok for the wccp on interface and policy.

But now, I need to understand one more thing:

1. where do you tell the fgt to forward traffic through GRE to IPPROXY?

[emnoc]

See the  fwpolicy and the "wccp"  statement from above. Here's a kb link that you might want to  review.

https://publicconsultingg...amp;objectName=Task__c

Ken