what is route-map ommand ? 1

[haneo]

we have a cisco 2511 IOS 11.0(16) with a linux as getway from internal network connected with it via Ethernet interface 100Mbits/s

can some body tell me what is this config ??

route-map squid permit 10
match ip address 110
set ip next-hop IP-OF-THE-LINUX-GATWAY

thanks for all

 

[mtashiro]

This is policy based routing. It is a way of making data flow differently that the routing tables would sugguest.

In your example:

route-map squid permit 10 <--- Defines the routemap

match ip address 110 <--- Defines interesting traffic

set ip next-hop IP-OF-THE-LINUX-GATWAY <--- Tells router that all interesting traffic should go to IP-OF-THE-LINUX-GATWAY instead if the default gateway or a route in the routing table.

You should have an access-list 110 that tells you what traffic is going to match.

You can also use route-maps to mark traffic as well. For example, you could set the IP Precedence bit on certain traffic by using route-maps.

 

[haneo]

Thanks mtashiro for your rapid post

Yes there is an ACL like this:
access-list 110 deny tcp host IP-OF-THE-LINUX-GATWAY any eq www
access-list 110 permit tcp any any eq www


so this block proxy from browsing

http://www pages

?

but this can't be done by ? :

access-list 1 deny IP-OF-THE-LINUX-GATWAY any eq www

 

[haneo]

Just a precision:

When i navigate from that proxy with mozilla i can view web pages so this access list is not doing what it should do !

wait you post .

 

[mtashiro]

No, it is not blocking web traffic. In your case it is saying any

http://WWW traffic

from any host execpt the LINUX-Gateway hits the router the next hop address is the LINUX-Gateway (proxy server?). If the proxy server traffic hits the router then send it out the router. You don't want

http://WWW traffic

from the LINUX-Gateway to send it's

http://WWW traffic

back to iself and create a loop.

 

[marsd]

What it does pretty obviously is redirect vanilla http
traffic through your linux squid proxy.
This is definitely one way to create the illusion of a transparent proxy.

 

[haneo]

marsed thanks i was searching for a long time how to do a transparant proxy with cisco routers, but with no result !!

I am happy that existe i will retest this tomorrow and send the result here (it's not me how configured the cisco)

Thanks for all mtashiro & marsd