Using Artica Squid Open Source Project to Build Powerful and Safe but Simple to Use Proxy

Looking for a pre-installed GUI based Proxy for a while and found Artica recently. The feature is pretty attractive and GUI interface looks cool.

What is Artica?
"Artica Proxy is an appliance that claim to manage Squid-cache proxy with all features that Squid Cache provides.With the Artica Web interface you can monitor, manage get statistics of your proxy service.
Artica Proxy provides ISOs in order to build a full proxy appliance without any technical skills.
Artica Proxy allows to enable Web filtering engine with more than 30.000.000 categorized websites.

Other features included such as reverse-proxy, RDP proxy, VPN, DHCP, DNS..."
Here are some my experience on it.

1. Download Link:
 http://artica-proxy.com/telechargements/

There are ISO, ESXi, Hyperv, Xen versions to download.


2. Installation in Vmware Workstation 
In this post I am using Vmware Workstation 10 to do installation based on Artica Proxy CD-ROM ISO. The vm's configuration is set as following:

Hard Drive = 20G
CPU = Dual CPU with 2 Core
Memory = 3G
Delete other unused hardware such as printer, usb and sound card.

Full installation will take 15- 20 minutes depends on your host performance. Basic configuration wizard will take you 5 minutes to get a full functional Proxy for your internal machines.

2.1 Update to latest release

Current IOS version is 3.03.041314. It can be upgraded to 3.06.050915 by some clicks.


3. Test Proxy

Config client IE proxy with 192.168.236.100 on port 3128.

By default, Artica proxy will allow all internal machines to use proxy to surf internet. You wont need to do too much work to get all your clients to use this new proxy.


4. Artica Support

Artica Support is amazing. I have been tried to open tickets in their tracker system, in next a couple of hours they posted videos to answer my dummy questions. Artica also has a forum to let users discuss there.

5. Configuration Examples

Example 1: Using ACLs
1.1 Default block everything from Internal to Internet
1.2 Create a specific rule to allow one machine 192.168.5.53 to access some specific sites based on IP addresses or URL Domain names

Example 2: Using Web-Filtering
2.1 Default block everything from Internal to Internet
2.2 Create a specific rule to allow one machine 192.168.1.136 to access to categories News and Search Engines only

6. Reference

• http://artica-proxy.com/

Configure Netflow on network devices for PRTG Netflow Monitoring

Netflow is a feature first introduced into Cisco routers and switches and then flow concept has been widely accepted by other network product vendors. Basically the network devices which support xflow feature can collect IP traffic statistics on the interfaces where xFlow is enabled, and export those statistics as xFlow records to remote defined xFlow collector.

PRTG can use this NetFlow feature for detailed bandwidth usage monitoring and it also shows you:

• where your bandwidth is used
• who is using it
• how it is being used
• why it is being used

It lets you see which specific applications are being used and how the usage might affect your network. NetFlow monitoring is included in all PRTG Network Monitor licenses, which means no special license to enable this feature. It will be counted into your sensors license.



PRTG support most xFlow (NetFlow, IPFIX, sFlow, jFlow)  protocols with their flow sensors.

1. Example Configuration for Cisco Routers and Switches:

1.1 Cisco Routers Example

This configuration is old platform and IOS. 

router-2621(config)#interface FastEthernet 0/1
router-2621(config-if)#ip route-cache flow
router-2621(config-if)#exit
router-2621(config)#ip flow-export destination 192.168.1.101 9995
router-2621(config)#ip flow-export source FastEthernet 0/1
router-2621(config)#ip flow-export version 5
router-2621(config)#ip flow-cache timeout active 1
router-2621(config)#ip flow-cache timeout inactive 15
router-2621(config)#snmp-server ifindex persist
router#show ip flow export
router#show ip cache flow

note: Please note that NetFlow data export has to be enabled on all interfaces of a router in order to see accurate IN and OUT traffic.

1.2 Cisco Switches (4510) Example

flow record PRTG-FLOW
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
collect interface output
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
flow exporter PRTG-EXPORTER
description NETFLOW Export to PRTG
destination xxx.xxx.xxx.xxx
source Loopback0
transport udp 2055
export-protocol netflow-v9
!
flow monitor PRTG-MONITOR
description PRTG Netflow Monitor
record PRTG-FLOW
exporter PRTG-EXPORTER
!
interface vlan xxxx
ip flow monitor PRTG-MONITOR input
!ip flow monitor PRTG-MONITOR output
! Cisco switch 4510 does not support Netflow output option

2. Configuration for Cisco ASA firewalls

access-list global_mpc extended permit ip any any
!
flow-export destination inside 192.168.1.101 9995
!
class-map global_class
  match access-list global_mpc
!
policy-map global_policy
  class global_class
   flow-export event-type all destination 192.168.1.101

note:In fact Cisco ASA only support version 9. ASA NetFlow was never intended to be used for real time/live traffic analysis. On the Cisco forums web page the official statement is: "[...] NetFlow on the ASA does not provide the ability to see this data in real time. The data can be collected after the flow has been terminated and analyzed but we do not support real time viewing of the NetFlow records. [...] The total bytes transferred can only be seen after the flow is torn down. [...] Lastly, all flows on the ASA are bidirectional. All counters for a flow will increase for traffic flowing from A->B or B->A. [...] NetFlow has a significant performance impact."

3. Configuration for Check Point Gaia Firewalls

SecurePlatform doesn't support NetFlow but Gaia is fully supporting it.

Check Point CLI Commands Example:

To add a collector:

add netflow collector ip VALUE port VALUE [srcaddr VALUE export-format VALUE]

To delete a collector:

delete netflow collector [for-ip VALUE [for-port VALUE]] 

To change settings of a collector:

set netflow collector [for-ip VALUE [for-port VALUE]]
   export-format VALUE
   srcaddr VALUE

set netflow collector [for-ip VALUE]
   port VALUE

set netflow collector
   ip VALUE

To see NetFlow configurations:

show netflow all
show netflow collector [for-ip VALUE [for-port VALUE]]
show netflow collector [for-ip VALUE [for-port VALUE]]
   export-format
   srcaddr
show netflow collector [for-ip VALUE] port
show netflow collector ip

4. Configuration Example for Juniper SRX Firewalls

Jflow Version 9

set services flow-monitoring version9 template ipv4-test ipv4-template
set forwarding-options sampling input rate 100
set forwarding-options sampling input run-length 0
set forwarding-options sampling family inet output flow-server 10.9.1.13 port 9996
set forwarding-options sampling family inet output flow-server 10.9.1.13 version9 template ipv4-test
set forwarding-options sampling family inet output inline-jflow source-address 10.9.1.26
set interfaces reth2 unit 0 family inet sampling input

Jflow Version 5

set interfaces reth2 unit 0 family inet sampling input
set interfaces reth2 unit 0 family inet sampling output
set forwarding-options sampling input rate 100 
set forwarding-options sampling family inet output flow-server 10.9.1.13 port 9996
set forwarding-options sampling family inet output flow-server 10.9.1.13 version 5

5. PRTG Sensor Configuration

Reference:

1. Configuring Cisco ASA NetFlow via ASDM
2. Check Point GAiA NetFlow Configuration
3. Configuring Netflow Export - CLI (netflow)
4. How can I use a trusted SSL certificate with the PRTG web interface?