Re: [squid-users] Squid as proxy with interception

[Amos Jeffries]

On 12/03/2013 4:33 a.m., Magali Bernard wrote:

Hello,

After many years with squid as a proxy-cache combined with the proxy.pac or
WPAD client configurations, we are considering to use squid as a proxy with
interception (WCCP2) on our whole university site.

The reason essentially lies on complaints from users with their browsers
configurations, but also with applications that can not talk to a proxy...

We'd like to know if interception is widely used and approved.
Some feedback, good or bad experiences, would be precious for us.


It is widely used, and equally widely hated.

Your best choice of configuration is to use mutiple layers of client 
configuration:

 
http://wiki.squid-cache.org/SquidFaq/ConfiguringBrowsers#Recommended_network_configuration

Since you have the WPAD/PAC layer(s) currently working *keep them*.
Just add the interception as a backup method for traffic which bypasses 
the WPAD/PAC.


Using the layered approach you get full proxy functionality with any 
software which correctly supports WPAD/PAC. While still getting the 
proxy access control and some caching with other software despite the 
interception limitations.


Amos

RE: [squid-users] Squid as proxy with interception

[James Harper]

 
 Hello,
 
 After many years with squid as a proxy-cache combined with the proxy.pac
 or
 WPAD client configurations, we are considering to use squid as a proxy with
 interception (WCCP2) on our whole university site.
 
 The reason essentially lies on complaints from users with their browsers
 configurations, but also with applications that can not talk to a proxy...
 
 We'd like to know if interception is widely used and approved.
 Some feedback, good or bad experiences, would be precious for us.
 

If the first thing a student tries to do on your network is to check their 
facebook or google something then they will get an error as you can't (or 
shouldn't for a university network) do interception proxy with HTTPS. A lot of 
other things are https by default these days too.

Maybe put interception proxy in place as a backup, but stick with regular proxy 
as well.

James