Proxy-protocols transparent command

Hi,
According to the documentation, if the command:
- proxy-protocols transparent default-server
- http proxy outgoing host a.b.c.d
are used, content engine forwards intercepted http proxy-style requests to the corresponding outgoing proxy server, a.b.c.d in this case.
If some of PC web browsers have proxy configured and some do not have, will the cache engine forward ALL the http requests to the proxy server a.b.c.d (regardless of whether the browser is configured to point to a proxy server or not) ?
Or the cache engine only forward those PC web browser with proxy configured to the proxy server a.b.c.d and PC without proxy configuration will not be forwarded to the proxy server a.b.c.d?

All the traffic intercepted by the cache will be forwarded to the proxy.
So, you also need to intercept the traffic with WCCP or another method.
regards,
Gilles.

Similar Messages

Reverse Proxy and Transparent Caching

I've seen a couple threads on these particular subjects, and I'm still a little curious. I understand that it is possible to have both of these configured, but what is the proper method of accomplishing this?
For example, our setup is similar to the configuration in the configuration guide for clients and content engines on different subnets, so the transparent part seems pretty simple where the "ip wccp web-cache redirect out" command will be on the interface connected to the internet.
However, for the reverse proxy portion, can I also configure reverse proxy on the same internet-connected interface with "ip wccp 99 redirect in"? Or does the transparent caching take precendence even though they are for different conditions? If that is the case, do I then need to use the "ip wccp 99 redirect out" command on the interface that would be pointing back towards the origin servers?
I'd just like to clarify because we don't have test devices to play around with, so we would be modifying production devices.
As a completely different question, if only transparent caching is configured, is it still possible to use the CE590 as a proxy server? The reason I am asking is that we recently shut down wccp because we were seeing excessive traffic at odd hours. A stroll through the transaction logs revealed that most of this traffic was destined for foreign subnets. It appeared that the CE590 was acting as a proxy for these foreign IPs because the source IP address as well as the data being retrieved were foreign to our network.
If anyone can help with my questions, it would be greatly appreciated.
David

According to this thread,
http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.ee8a89a
if you are redirecting both the services on the same interface, One service takes precedence over the other and I believe transparent web-cache redirect takes precedence over reverse-proxy.I think you need to use the "ip wccp 99 redirect out" command on the interface that would be pointing back towards the origin servers.
For details refer:
http://www.cisco.com/en/US/partner/products/sw/conntsw/ps491/products_configuration_guide_chapter09186a00800af658.html#19607
I'm not too sure about the CE 590 but i know that the CE 560 can be used as a proxy for transparent caching using WCCP.

Cisco WSA : Is it possible to use web proxy in transparent mode without WCCP router ?

Hello !
I would like to use Cisco WSA as a web proxy in a transparent way (without any configuration in client's web browsers) but i don't have a WCCP router. So, is it possible ?
If yes, how to do this ?
Thank you,
Stephane Walker

Hi Stephane
The only alternative to WCCP is PBR (Policy Based Routing). With a simple configuration on the router you can redirect traffic defined as interesting by access list to WSA. On the WSA you need to configure transparent mode (Security Services -> Web Proxy -> Edit Settings -> Proxy Mode: Transparent). You also need to assure that proxy is listening on the port 80 and that HTTPS proxy is enabled (on port 443) if you want to redirect the HTTPS traffic as well.
Sample configuration for Cisco router
access-list 110 permit tcp any any eq www
route-map proxy-redirect permit 10
match ip address 110
set ip next-hop xxx.xxx.xxx.xxx
interface ethernet0/1
ip policy route-map proxy-redirect
xxx.xxx.xxx.xxx is the proxy IP in such case and access-list 110 defines web traffic (HTTP TCP/80) as interesting.
The biggest disadvantage of such solution is lack of failure detection. If the proxy will go down for some reason router will keep redirecting the traffic causing internet access outage.
Routers other than Cisco equipment should also have an option to configure policy based routing.
/Artur
Ps. It's not possible to place the WSA in-line between clients and the internet.

Feig LRU 2000 UHF reader - Transparent Command

Hi,
Does anyone have any idea how to construct a Transparent command using mode 1 in FEIG lru 2000 uhf reader, for EPC command SELECT? I have been trying to accomplish the same for several days, but cudnt come up with a solution.
Earnestly looking forward to hear regarding the same.
Thanks & Regards,
Sharmila.

Got it. I tried booting with MOD_AUTOLOAD set to yes, and it was working fine. Looks like I needed to specify some more modules in my list.

Bonjour Sleep Proxy protocol documentation?

Can anyone point me to a technical description of the Bonjour Sleep Proxy protocol description, or a technical description of how it works?
(I've already seen the Apple KB article http://support.apple.com/kb/HT3774
providing an overview of the "Wake on Demand" feature, the reference
to "Sleep Proxy Servers" in http://files.multicastdns.org/draft-cheshire-dnsext-multicastdns.txt , and the Sleep Proxy Service patent in http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u= %2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=7,330,986.PN.&OS=PN/7,330,986&RS =PN/7,330,986 .)
What I'm really trying to understand is if the Sleep Proxy server is intended to take over the IP address belonging to the sleeping device. Based on the documents above, I gather that the Sleep Proxy server may respond to mDNS queries for services registered by the sleeping device. But I'd guess the mDNS responses come from an IP source address of the Sleep Proxy Server. I wouldn't expect the Sleep Proxy server to start sending IP datagrams using the IP source address of the sleeping client, or to respond to ARP Requests targetting the sleeping client's IP address. But lacking a technical description of the Sleep Proxy Server is expected to behave, I'm just guessing.
I ask because starting on September 3 2009, I've seen three Apple Time Capsules "steal" IP addresses belonging to other devices. (For several hours, the Time Capsule's uplink sent ARP Reply packets for an IP address that didn't belong to it. It did so at the same time it send ARP Reply packets for the Time Capsule's assigned IP address.) The victim of each IP address theft was a Macintosh computer that had no apparent relationship with the Time Capsule. The release of the Sleep Proxy client software in Mac OX X 10.6 several days earlier makes me wonder if Sleep Proxy service is the cause of these IP address thefts.

I moved this to the more appropriate "Mac OS X Technologies > Networking and the Web" forum, since it's become apparent that it involves more than Time Capsules.

How to get polipo proxy to transparently handle web traffic?

hello there,
I've got a router PC at home. It runs privoxy so that any PC on my local network can browse the Internet in a reasonably secure way, with no ads and such.
Because we often visit the same websites, I thought that's be a good thing to set up a caching proxy. I tried Squid, but found it difficult to configure, slow to start, etc. so I finally chose polipo, which is much lighter and simpler.
On the web, many sources advise to have to following setup:
1) local -- privoxy -- polipo -- internet
I got such a setup, but I'd like to try the following instead:
2) local -- polipo -- privoxy -- internet
In my opinion it's more relevant because:
- my router is quite old, and I think it would be lighter on resources to serve already privoxied cached pages, rather than having privoxy process every cached page
- in terms of privacy, it's generally advised not to have a parent proxy on top of privoxy
Privoxy acts as an intercepting proxy, so setup 1) was quite easy to configure. Web traffic is redirected to privoxy, then privoxy forwards it to polipo.
Polipo does not act as an intercepting proxy, because its developer considers that "interception proxying is a fundamentally broken design [...], and will not be supported by Polipo". So far, the only possible workaround I found are :
- configure browsers to use polipo: not suitable, I want any local network computer to be able to transparently connect to the internet
- use yet another proxy to intercept traffic...
- or, from polipo docs :
If you want to use interception proxying in order to avoid manually configuring your clients, please use Netscape's proxy.pac auto-configuration (you don't need a separate web server, as a proxy.pac file can be served by Polipo's internal server).
It gives link pointing to http://wp.netscape.com/eng/mozilla/2.0/ … -live.html which is dead.
So, in short: is there a way to transparently route my web traffic through polipo?
Thanks for any guidance.

Not sure if your still looking for a solution, but I could think of a couple possible ways to redirect the traffic. One would be rinetd (Here). The other solution I thought would be iptables (FW_REDIRECT ??), but I have not tried that.
I might try experimenting with a few ways, but let me know if you have it working..

Softwareupdate -l and proxy and UNIX command

When I run softwareupdate -l I'm prompted to login to our company proxy server, which I expect. Is there a way to send my username and password along with the software update command?

If you're using Workgroup Manager, the procedure is documented in Chapter 7 of the System Imaging and Software Update Administration section of the Mac OS X 10.4 Server documentation.
If not, another poster came up with this solution (I haven't tested it, so I can't say of my own knowledge that this is correct):
Create the following as a text file, save it as com.apple.SoftwareUpdate.plist and then copy it to /Library/Managed Preferences/root/on each workstation. Replace the <<your server here>> with the address of your actual software update server.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CatalogURL</key>
<string>http://<<your server here>>:8088/</string>
</dict>
</plist>
Hope it works for you.

How to add proxy to dtexec command line to run ssis package

Hi all!
I am in badly need to your help to solve my problem
i build an ssis package to read xml data from API and load it in a local DB
and i created an ajent sql job to schedule run this package and thanks god it worked well..
BUT..
When i changed my network that i must use a proxy (**.**.***.***:8080) to connect to internet
the scheduled job didn't work !!
i guess i must add this proxy server to the DTEXEC command line that i use in my scheduled job
waiting for your help please..
Thanks

Dear all
really Thanks a lot .. PROBLEM SOLVED :)
i created a new credential using my windows account and then i created a new proxy account using my new credential and finally i use this proxy account in sql agent job and it works well
i guess that the problem is SQL Server Agent uses SQL
Server credentials to launch the job, not Windows
credentials .
Thanks

FBLdi - Using Proxy parameter in command

Hi ,
We are using FBldi for integration , by including the proxy we could see the files uploading to UCM. But the Batch process to load the file to Fusion is not triggered.
We got a message - Connection timed out.
How the proxy parameter is used in FBLdi ? Could you please help me resolve the issue.
Thanks,
Prem

Hi ,
We are using FBldi for integration , by including the proxy we could see the files uploading to UCM. But the Batch process to load the file to Fusion is not triggered.
We got a message - Connection timed out.
How the proxy parameter is used in FBLdi ? Could you please help me resolve the issue.
Thanks,
Prem

Networking protocol send commands to client

I was wondering how does sending commands to a client work.
What I mean is would I
write a loop (runnable) which will listen from the server for keywords and then perform the the required action on the client side?
I've looking for a bit of explanation of how it would work :)
thank you

I was wondering how does sending commands to a client
work.
What I mean is would I
write a loop (runnable) which will listen from the
server for keywords and then perform the the required
action on the client side?
I've looking for a bit of explanation of how it would
work :)
thank youKeep listetning on a particulat Socket in the client for specific Strings. Imagine the server sends a String "Shutdown". The client has to receive the String and then it can compare it with a set of predefined strings and when it finds a match you can execute whatever command associated with that string.

ACNS, bypass list, server-error

Im using Content Engine Module in Cisco 3700 to transparently monitor Webtraffic to an upstream Squid Proxy. Unfortunatly I'm getting a lot of bypass packets. Every request is leading to insert the upstream proxy into the bypass list (Entry type "server-error"). Is there any way to explore what kind of error message was received ?

I was able to solve the problem ...
I had to use "proxy-protocols transparent original-proxy" command to instruct ACNS to use the proxy the request was original intended to to fullfill the request. Without this command ANCS tries to connect to the destionation webserver directly.

Content engine 510 - transparent proxy stand-alone

Hello to all,
after studying architecture examples about Content Engine 510, I found that there is two modes:
1) standard proxy
2) transparent proxy
I need the transparent architecture !
But every example about transparent mode seems to include a router or a switch with a particular level of software, that can send http requests to the Content Engine to have cache.
I don't have any of these components.
I simply need to have a Content Engine that receive any kind of IP protocols on one ethernet, and route it to the other ethernet plug, except that if it is http protocol, it will cache the pages.
Is is simply impossible to configure the Content Engine 510 that way ?
Is the transparent proxy mode always requires a router or a switch to give it the http flow ?
If it is possible, where can I find some configuration examples ?
Thanks to help a newbie in content engine...
Olivier

Olivier,
You'll need to have a router running wccp in order to redirect http requests to the cache. Withouth this, the cache has no visibilty of traffic on your LAN.
Regards,
Dave

Proxy Setup LMS3.2 with Proxyless/transparent doesnt work

Hello,
For CCO connection we need a proxyless connection (transparent proxy without the need for Proxy-IP/Port/User, working IE settings are for Direct Internet connections) but LMS3.2 isnt able to provide this:
1. Proxy Server Setup doesnt accept "No Proxy" or empty Proxy fileds
2. SW Center Please => SW-Update brings after entering my CCO-Account:
ERROR: Unable to connect to Cisco.com. Please check D:/PROGRA~2/CSCOpx/log/psu.log file for details. Download operation cannot proceed.
=> check psu.log:
[ Mon Jan 25 17:48:30 CET 2010 ] INFO   [SecurityHandler : getCSProxyHost] : No proxy Host configured
[ Mon Jan 25 17:48:30 CET 2010 ] INFO   [SecurityHandler : getCSProxyPort] : No proxy port confgured
[ Mon Jan 25 17:48:35 CET 2010 ] INFO   [SecurityHandler : getCSProxyHost] : No proxy Host configured
Is there any workarround to can use proxless connection for CCO-Access from LMS?
Steffen

If the proxying is transparent to the client, then there is nothing you need to do in LMS. The "No proxy" messages in the psu.log are informational. Technically, you do not have a proxy, and that is fine. If the transparent proxy is configured to intercept HTTP traffic, then things should just work. LMS should be able to connect to Cisco.com just fine without proxy settings. If you need to see why this isn't working, start a sniffer trace filtering on tcp/80 traffic to www.cisco.com. Run the software update job, and the capture should show the problem.

Small question on proxy?

I have started the server socket on 8080. Then i have created a proxy with localhost and port 8080. Then created Socket wit the proxy. now i said socket.connect() . please look at the following code:-
               InetSocketAddress ins=new InetSocketAddress("localhost",8080);
          Proxy pr=new Proxy(Proxy.Type.SOCKS,ins);
          Socket sc=new Socket(pr);
          InetSocketAddress inst=new InetSocketAddress("yahoo.com",8080);
          sc.connect(inst);
          InputStream is=sc.getInputStream();
          while(true){
               System.out.println(is.read());
          }on the server i got the socket outputstream and written some data.
               ServerSocket ss=new ServerSocket(8080);
          Socket s=ss.accept();
                OutputStream os=s.getOutputStream();
          os.write(23);when i do this at the client end i am not able to read any data even i am writing to the outputstream of the socket on the server. can anybody tell what is wrong.?
actually nothing is comming up on the client.

ejp wrote:
So far there is no contradiction on my explanation of proxySo far there is nothing but contradictions of your explanation. I contradicted it several times above, including [three times in one post|http://forums.sun.com/thread.jspa?messageID=10961231#10961231].
so i believe what i said is right about what is proxy?I don't know how you can continue to believe things that are false and have been contradicted. A proxy (1) engages in a protocol with the client to determine what target host the client wants to connect to, (2) connects to that host, and (3) then becomes a transparent connection between the client and the target host. You are failing here at step (1) so it is utterly impossible to get to step (3).See ejp my explanation in the prior post about proxy is as below
when i define proxy in the socket , the socket first establishes connection with proxy server and then proxy server gets the details from the established socket and proxy server now caretes another socket to the final destination and reads the data from its input stream and writes the data to the output stream of the socket established by origin.
I don't see any difference between what you said and what i am saying except your protocol stuff. The concept is the same
I also believe that proxy protocols are application layer protocols and are not processed by OSI.You have some very strange beliefs. Nothing is implemented by OSI. OSI isn't even there. Never has been. Do you mean TCP?
In this case even my server does not implement socks protocol i should receive the raw data.No. You've been told a number of times that that isn't so, now including immediately above. You also have the evidence of your own code that it doesn't work. How much information and proof do you need to register that?I am talking about open system interconnectivity model. Why is it so strange for you?
I never said that my above code is not working. I am able to read the code something like "9876" from the client socket which i believe is a code for shake hand.
Think of a HTTP protocol ? even if i don't implement it my server will be receiving the raw data?No. If it doesn't implement the HTTP CONNECT command, the proxy won't know what to connect to, so it won't connect. It's not just a transparent connection. Otherwise HTTP proxies and SOCKS proxies would be the same thing. Hasn't that occurred to you?I am not talking about http proxy. i am talking about http protocol in general. Think you typed a url pointing to my server in the browser and my server which don't implement http protocol is running on some machine, even though my server does not implement http protocol still i receive raw data. I have done this so many times. I am not just saying like that.
I think this is the reason why i am not able to get raw data.
The reason is that the client is being told that your proxy server is a SOCKS proxy, so it is trying to set up a SOCKS session with it eventually leading to a SOCKS CONNECT command, and as your server isn't a SOCKS proxy this entire process is failing. Precisely as you would expect, and precisely as you were [already told|http://forums.sun.com/thread.jspa?messageID=10961231#10961231].
I am also saying the same thing. I said client failed in hand shake with the proxy server that is the reason i am not able to get data from the client. Why is it hurting you?
>
This is elementary. You need to stop arguing about this and take some notice of the people who are answering you.Good if i dont know elementary i prefer to learn it rather than ignoring it.. I am taking note, otherwise why will i reply.
ejp said, so everything is right will never be the case in these forums. I want to know something and until i am not clear why should i agree with you and more over what you are saying and what i am saying is the same. you are using little bit technical terms and i am saying it in plain English. instead getting upset if you have something specific to say please highlight my point and your point where they are contradicting. That would be the right direction and would be of great help to me.

ACE 4710 transparent LB with two Caches and two routers.

Hello,
I have ACE 4710 that load balance two cach flows (bluecoat), i am doing pbr on the routers to send the traffic destined to port 80 to ACE then Cach farm. After that the Cach flow will get the page from the internet via two routers. The return traffic will match another pbr on the routers with source port 80 that will send it to the ACE then CachFlow again .....then to the users.
I am not using ip-spoofing on the CachFlow for now. In the figure attached i created a VIP 0.0.0.0 0.0.0.0 port 80 on the interface on the ACE facing the routers, but the question is do i have to create another VIP 0.0.0.0 0.0.0.0 port 80 on the interface on ACE facing the Cach Flow? or just forward the traffic on the default route? What might be the default route since i have to use two routers and i cannot use hsrp?
Kindly I need some assistance
Thank you and regards,
George
access-list PERMIT_ALL line 8 extended permit ip any any
access-list CFLOW line 8 extended permit ip any any
ip name-server 8.8.8.8
ip name-server 4.2.2.2
##################################Config for Cache Cache Servers###################
probe http CISCO_WWW_PROBE
ip address 72.163.4.161
interval 2
faildetect 2
passdetect interval 2
passdetect count 5
request method head url /index.html
expect status 200 200
exit
probe http YAHOO_WWW_PROBE
ip address 87.248.112.181
interval 2
faildetect 2
passdetect interval 2
passdetect count 5
request method head url /index.html
expect status 200 200
exit
serverfarm host TRANSPARENT_PROXY_SF
description Transparent Proxy Farm
transparent
predictor hash url
probe CISCO_WWW_PROBE
probe YAHOO_WWW_PROBE
rserver CFLOW01
    inservice
rserver CFLOW02
    inservice
exit
exit
############################################# Router Cache Farm ############################
probe icmp ICMP_PROBE
description *** Probe for icmp health monitoring ***
interval 5
faildetect 2
passdetect interval 60
passdetect count 2
exit
rserver host Router01
description Connection to Sodetel Router
ip address 192.168.14.4
probe ICMP_PROBE
inservice
rserver host Router02
description Connection to IDM Router
ip address 192.168.14.5
probe ICMP_PROBE
inservice
serverfarm host Routers
description Transparent Proxy Farm
transparent
predictor hash url
probe ICMP_PROBE
rserver Router01
    inservice
rserver Router02
    inservice
exit
exit
################################# Management################################
class-map type management match-any REMOTE_MGMT
description Allow Remote management for below protocols
8 match protocol icmp any
9 match protocol ssh source-address 172.31.13.31 255.255.255.255
10 match protocol ssh source-address 172.31.31.21 255.255.255.255
policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
class REMOTE_MGMT
    permit
class-map match-all CFLO2Internet
2 match virtual-address 0.0.0.0 0.0.0.0 any
class-map match-all TRANSPARENT_VIP_CM
2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq www
policy-map type loadbalance first-match TRANSPARENT_LB_PM
class class-default
    serverfarm TRANSPARENT_PROXY_SF backup Routers
policy-map type loadbalance first-match CFLO2Internet_LB
class class-default
    serverfarm Routers
policy-map multi-match CFLO2Internet_PM
class CFLO2Internet
    loadbalance vip inservice
    loadbalance policy CFLO2Internet_LB
    loadbalance vip icmp-reply active
    connection advanced-options TCP
policy-map multi-match L3L4_PM
class TRANSPARENT_VIP_CM
    loadbalance vip inservice
    loadbalance policy TRANSPARENT_LB_PM
    loadbalance vip icmp-reply active
    connection advanced-options TCP
====Interfaces======
interface vlan 11
description Interface between Routers and ACE
ip address 192.168.14.2 255.255.255.224
alias 192.168.14.1 255.255.255.224
peer ip address 192.168.14.3 255.255.255.224
no icmp-guard
access-group input PERMIT_ALL
service-policy input REMOTE_MGMT_ALLOW_POLICY
service-policy input L3L4_PM
no shutdown
interface vlan 21
description Connection to CFlow ServerFarm
ip address 192.168.12.2 255.255.255.224
alias 192.168.12.1 255.255.255.224
peer ip address 192.168.12.3 255.255.255.224
no icmp-guard
access-group input CFLOW
service-policy input CFLO2Internet_PM ------>>>> Is this necessary???
no shutdown

Hi George,
In the topology you described, only the service-policy in the interface towards the routers is necessary. For the traffic from the caches, the ACE will just forward to the default gateway.
The only problem is, as you mentioned, that you cannot use HSRP. In that case, you can still configure two default gateways, but there is no way to predict which one the ACE will use at a given time (the way it does to select the one it will use is sending an ARP request to both gateways and using the one that replies first until the ARP entry expires)
If you need to load-balance the traffic between both routers, then yes, you would need to configure a new VIP on the cache side and load-balanced to a transparent serverfarm composed of both routers.
Regards
Daniel

Proxy-protocols transparent command

Similar Messages

Maybe you are looking for