Now that I think of it, if WCCP is working (I_See_You and Here_I_Am packets are going through), shouldn't everything be working?

"show wccp" statistics will show you redirect counters and if the engine is built properly.

If those look ok it is probably working.

Of course check if pages that the engine is set to block are actually blocked.

PK

Everything seems to be working in the ASA, but i can't get to any page. Not even Google, and there's no blocking there.

AR01-ASA01# sh wccp

Global WCCP information:

    Router information:

        Router Identifier:                   201.234.XX.XXX

        Protocol Version:                    2.0

    Service Identifier: web-cache

        Number of Cache Engines:             1

        Number of routers:                   1

        Total Packets Redirected:            857

        Redirect access-list:                SquidGRE

        Total Connections Denied Redirect:   0

        Total Packets Unassigned:            1

        Group access-list:                   -none-

        Total Messages Denied to Group:      0

        Total Authentication failures:       0

        Total Bypassed Packets Received:     0

Probably the problem is with the route id.

The HELLOS are exchanged, but probably the engine is rejecting the wccp GRE packets from the router id.

Also the wccp engine should be able to directly talk to the host that is browsing, you need to ensure that is allowed also.

I hope it helps.

PK

Change your routing so that the traffic destined to the routing id hits the ASA inside.

I don't think that is your problem now.I believe that Squid ignores that router id.

PK

Ok, i'm starting to feel like a newbie.

How can i add a route like that? And where?

Squid is connected to Layer 3 switch Cisco 3560, which is connected to ASA.

Where should I add a route? and how? ip route xxx xx xx xx?

Upstream to your routing devices that are between wccp engine and ASA.

PK