WCCP intercept + Squid - Seeing WAN IP instead of true client IP

[wsladek]

Hi folks, I have an 80F (6.4.6) configured to intercept HTTP traffic and forward to Squid via WCCP.  Everything works, except one issue - all Squid sees is the WAN IP instead of the individual client machines.   Fortinet has a kb article on how to set all this up, and I basically followed it to a T.  The architecture/topology in their example is essentially the same as my environment: Outside zone (WAN - PAT'ed) Trusted zone (end client machines that will have HTTP intercepted) Restricted zone (where Squid resides) I have nat enabled on the wccp intercept policy, and turning off nat simply breaks http traffic for the end client machines.  Oddly, the kb article even has a note that says "If the preferred behavior is not to deliver the traffic to user if the cache is not reachable, a simple trick is to disable natting on policy 3."   Yet this simply does not work...? I'm at a loss, any help would be appreciated.  Here are the relevant configs: Interface configs:     edit "wan1"         set vdom "root"         set mode pppoe         set type physical         set role wan         set snmp-index 1         set dns-server-override disable     next     edit "restricted"         set vdom "root"         set ip 10.10.10.1 255.255.255.0         set allowaccess ping         set type hard-switch         set role dmz         set snmp-index 11         set wccp enable     next     edit "trusted_switch"         set vdom "root"         set ip 192.168.48.1 255.255.255.0         set allowaccess ping https ssh http         set type hard-switch         set device-identification enable         set lldp-transmission enable         set role lan         set snmp-index 13     next Policy to intercept HTTP traffic:     edit 26         set name "WCCP-Intercept-Trusted"         set uuid 6f7674f8-0a6e-51ec-fbe0-ce5d0ddb17d5         set srcintf "trusted_zone"         set dstintf "outside_zone"         set srcaddr "trusted_switch address"         set dstaddr "all"         set action accept         set schedule "always"         set service "HTTP"         set logtraffic all         set wccp enable         set nat enable     next Policy on Trusted zone to allow other traffic:     edit 1         set name "Trusted-to-Outside"         set uuid 59618638-05d4-51ec-11c8-7da9ac447b72         set srcintf "trusted_zone"         set dstintf "outside_zone"         set srcaddr "all"         set dstaddr "all"         set action accept         set schedule "always"         set service "Allowed_Trusted_Services"         set logtraffic all         set nat enable     next Policy to allow Squid out:     edit 23         set name "Restricted-to-Outside"         set uuid 8b29980a-06c3-51ec-600e-efda35307a42         set srcintf "restricted_zone"         set dstintf "outside_zone"         set srcaddr "all"         set dstaddr "all"         set action accept         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable     next

[emnoc]

You probably want to enable in squid.conf via header on but I would try something like and then check with https://www.xmyip.com/proxy-check to see what headers are detected

via on

follow_x_forwarded_for allow all

forwarded_for on

http://socpuppet.blogspot.com/2018/09/squid-for-fortios.html

Ken Felix

[wsladek]

Hey thank you for the input.  I specifically delete all the Squid headers but commented out my custom settings and inputted those suggested config values, however no changes to the behavior.  I even see my WAN IP in the X-Forwarded-For header oddly.

FWIW, the 80F replaced an ASA, and the ASA didn't have this problem.  So I was leaning towards a firewall config issue, but I also understand the technology is different so could very well be a Squid --> FG compatibility issue where I do in fact need custom Squid settings.

I am thinking my next troubleshooting step is disabling nat on the wccp policy, and then figure out why that breaks http traffic (because seemingly it should not).  Do you know of any diagnostic commands off hand that will point me in the right direction?  Been using ASAs for last 13 years and this is my first Fortigate so still learning.  Thanks again.

[emnoc]

A firewall alone does NOT add XFF or VIA headers unless it's acting like a forward proxy or reverse proxy. So in your cisco ASA you need to see what your doing but I haven't done squid with cisco.

back to fortios+squid you need to look at the options in squid for your version

So XFF is typically used for "reverse" proxy to a web-server

So VIA is used for "forward" proxy as and additional header to show and tell what the client and the forward proxy or chain or proxies in the path.

e.g i wrote about this many years ago where we injected XFF in a A10 SLB

http://socpuppet.blogspot.com/2013/05/x-forwarded-proto.html

So I would capture the packet at the squid host and review your squid.conf options for that version.

Ken Felix