Configure Squid to forward traffic to SIA Proxy

Before you begin

Make sure you install Squid on an operating system that supports SSL on Squid. For example, you can use Windows or Ubuntu 16 and later.
Make sure that you upgrade Squid to version 3.5 or later. When preparing to compile the installation files, use these settings to enable SSL:

./configure --with-default-user=proxy --with-openssl --enable-ssl--crtd
Make sure you generate a MITM CA TLS certificate in SIA and distribute this certificate to computers or TLS clients in your network. See SIA Proxy as a TLS intermediary and Distribute the SIA Proxy certificate.
On the system where Squid is installed, create a copy of the squid.conf file to make sure that you keep the original configuration file as a reference. For example, on Linux, enter this command to copy the file:
```
sudo cp /etc/squid/squid.conf /etc/squid/<NEWNAME>.conf
sudo chmod a-w /etc/squid/<NEWNAME>.conf
```
where <NEWNAME> is the name of the Squid configuration file.
In SIA, make sure the IP address for Squid is added to a location configuration. To add or edit a location, see Create a location.
If you configured proxy authorization in SIA, make sure you copy the username and remember the password that you configured for the proxy credential in SIA. For more information, see Configure proxy authorization and Create a proxy credential.

If your organization currently uses Squid as a caching and forward HTTP web proxy, you can configure it to forward traffic to SIA. This feature is supported on Squid version 3.5 or later.

To configure Squid to forward traffic to SIA Proxy:

Open the renamed configuration file.
Confirm that the forwarded-for option is set on. This option should be enabled by default.
At the end of the renamed configuration file, add this information:
```
cache_peer nevada.proxy.akaetp.net parent 443 0 ssl sslcafile=/etc/ssl/certs
dns nameservers <<<PRODUCT_NICKNAME>>_DNS_IP_Primary> <<<PRODUCT_NICKNAME>>_DNS_IP_Secondary>
```
where:
- <SIA_DNS_IP_Primary> is the IP address of the primary SIA DNS server.
- <SIA_DNS_IP_Secondary> is the IP address of the secondary SIA DNS server.
If you enabled proxy authorization in an SIA policy and configured proxy credentials in SIA, you need to also configure these credentials in Squid. In the cache_peer configuration, add this authentication option:

login=<username>:<password>

where:
- <username> is the username that you configured in SIA. You can copy this username from SIA. Make sure the username includes the ID number that's associated with your organization.
- <password> is the password that you configured in SIA for the proxy credential.
For more information, see Enable proxy authorization and Create a proxy credential.
Optionally, configure user authentication. As part of this process, you need to add proxy_auth ACL entries to the configuration file. For more information, see the Squid documentation.
Review the configuration file and confirm that it looks like this:
```
http_access allow localhost
visible_hostname = localhost
forwarded_for on
cache_peer nevada.proxy.akaetp.net parent 443 0 ssl sslcafile=/etc/ssl/certs login=<username>: 
<password>
dns_nameservers <<<PRODUCT_NICKNAME>>_DNS_IP_Primary> <<<PRODUCT_NICKNAME>>_DNS_IP_Secondary>

acl all src all
acl SSL_ports port 443
acl CONNECT method CONNECT
http_access allow all
never_direct allow all
prefer_direct off
http_port 3128
```
where:
- <username> is the username that you configured in SIA as a proxy credential. Make sure the username includes the ID that's associated with your organization. For more information on the credential in SIA, see Create a proxy credential.
- <password> is the password that you configured in SIA as a proxy credential.
- <SIA_DNS_IP_Primary> is the IP address of the primary SIA DNS server.
- <SIA_DNS_IP_Secondary> is the IP address of the secondary SIA DNS server.
To validate the configuration file, enter this command:

squid -k parse
Restart Squid. The command and process you use for this operation may vary depending on Squid version. For example, on version 3.5, you enter this command:

sudo systemctl restart squid

For more information, see the Squid product documentation.
To check Squid's status, enter this command:

service squid status
Go to the Squid logs and confirm there are no errors. The path to log files varies depending on the Squid version. For example, on version 3.5, the path is var/log/squid/access.log, while in later versions the path is/usr/local/squid/var/logs.

Next steps

On an end user's machine or browser, manually configure Squid as a proxy server. You need to specify the Squid IP address and 3128as the port. See the documentation for the browser or the operating system that you need to configure.
Test that requests in the network are handled by SIA proxy. For example, request a domain or URL that is blocked by the AUP. After verifying that the request is handled based on a policy configuration, you can return to the logs and confirm that you see logs entries for TCP_TUNNEL.