Transparent Squid-Cache Servers load-balanced with Cisco IOS SLB vs WCCP



Using WCCP (Cisco router as WCCP router and Squid as web-cache server configured to work in transparent mode) I experienced problems opening different https:// pages. This is because some services (webservers), check whether subsequent https connections are the coming from the same origin as the original http access. As https:// is not intercepted but routed like any other traffic the requests arrives with the real client IP address. When using transparent mode and if you want to get rid of these problems you have to:
  • NAT the traffic outside the proxy and clients, making sure that both intercepted and normally routed traffic uses the same source IP address.
    • or
  • Add access lists to your intercepting routers to not intercept sites where this is a problem.
The problem is that with our existing network design it was impossible to implement any of these options. So I decided to try load-balancing with Cisco IOS SLB which is working very well.

I want to thank Henrik Nordstrom, Marc Elsen and squid users for help and great support they provided.
Here is my network diagram.

Hosted by www.Geocities.ws

1