HTTP Anti-Virus Proxy

According to the documentation, one of setup is to use the squid sandwich.

1) Am I right to say that all traffic besides https are configured to use SQUID1 while https traffic is configured to use SQUID2 in the IE proxy settings?

2) All traffic pointing to SQUID1 will be scanned while traffic via SQUID2 will not be scanned?

3)If I do not have SQUID1 but I have several HAVP and a SQUID2, can all the HAVPs be pointing SQUID2 as the parent proxy? If so, what are the configurations needed on SQUID2?

4) Would appreciate if you could elaborate on HAVP round robin (related to 3?) and the configurations required.

Thanks !

It depends entirely on what is configured on SQUID1. You can use ACLs to bypass havp on whatever conditions you want (no HTTPS, ip, url, day of time etc.). The point is that you use SQUID1 for everything. It is the central point where clients connect.



Ofcourse, it doesn't matter who and how many connect to SQUID2. All it does is accept clients (in this case, HAVPs) and do proxying.



At simplest, you have cache_peer config for every havp address, and use round-robin option. I haven't tested if it's enough to have one cache_peer line with DNS address pointing to many HAVP IPs.

You should check Squid documentation for rest, all the information is there..

Cheers,
Henrik

What's the reason behind for not allowing SQUID1 to do caching? I have been checking out the squid documentation but does not manage to find anything useful on routing https traffic from SQUID1 to another proxy(SQUID2). The closely I can find was a line that says :

http_access deny CONNECT !SSL_ports

Any pointers?

Thanks

If SQUID1 is caching, it could have virus file in cache that HAVP didn't recognize earlier..

cache_peer_access is for routing traffic..

You would do something like this:

acl Scan_HTTPS proto HTTPS
#Allow all traffic except HTTPS to havp
cache_peer_access havp.xxx.com allow !Scan_HTTPS
#Allow all traffic to SQUID2 (havp is tried first..)
cache_peer_access squid2.xxx.com allow all

Cheers,
Henrik

Thanks Henrik

Any plan to implement support for FTP in next version?

Direct support won't come for some time I think.. just use Squid parent and it works through that in 0.78.

Cheers,
Henrik

1) So to route all the HTTPS and FTP traffic to SQUID2, is the modified SQUID1 configuration correct?

# No caching
cache_dir null /tmp
no_cache deny all
# HAVP on port 8080
cache_peer havp.xxx.com parent 8080 0 no-query no-digest no-netdb-exchange default
# SQUID2 on port 8090
cache_peer squid2.xxx.com parent 8090 0 no-query no-digest no-netdb-exchange

acl Scan_HTTPS proto HTTPS
acl Scan_FTP proto FTP
#Allow all traffic except HTTPS and FTP to havp
cache_peer_access havp.xxx.com allow !Scan_HTTPS
cache_peer_access havp.xxx.com allow !Scan_FTP
#Allow all traffic to SQUID2 (havp is tried first..)
cache_peer_access squid2.xxx.com allow all

2) For HAVP.conf, do I need to specify SQUID2 as the parent proxy?

Thanks !