Question : Trying to forward web traffic through corporate web filter

I have a network with multiple remote locations and a centralized office location. My objective is to pass all of the web traffic from the remote locations through a Barracuda web filter at the centralized location. I am using Cisco Pix 501 firewall devices at all remote locations creating a VPN tunnel to a Sonicwall 3060 at the centralized location.

A brief diagram of the current network would look like this:
Remote1(192.168.170.11 255.255.255.0) --->Cisco Pix 501 (192.168.170.2 inside 71.32.38.xxx outside) ----> CLOUD ------> sonicwall 3060 (outside ZZZ.ZZZ.ZZZ.ZZZ inside (192.168.0.2)) ------> Barracuda Web Filter (192.168.0.1) ------> LAN (192.168.0.aaa 255.255.255.0)

Originally we had an ISA server in place and it was grabbing all of that traffic and forcing it through it's web proxy. We want to eliminate the ISA server for this and just route all of the web traffic from remote locations and make it go through the web filter for monitoring and filtering.

I can not figure out what I am doing wrong....I'm very green when it comes to Cisco Routers so be "gentle".

Code Snippet:

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:

           
           
             PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password qqqqqqqqqqqqqqqqqq encrypted
passwd qqqqqqqqqqqqqq encrypted
hostname pixfirewall170
domain-name company.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list pixtosnwl permit ip 192.168.170.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list out-in permit tcp any host 71.32.38.xxx
pager lines 24
logging on
logging monitor debugging
mtu outside 1500
mtu inside 1500
ip address outside 71.32.38.xxx 255.255.255.248
ip address inside 192.168.170.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list pixtosnwl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 71.32.38.xxx www 192.168.0.1 www netmask 255.255.255.255 0 0
route outside 0.0.0.0 0.0.0.0 71.32.38.bbb 255
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.170.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto map tosnwl 20 ipsec-isakmp
crypto map tosnwl 20 match address pixtosnwl
crypto map tosnwl 20 set peer 67.158.dd.cc
crypto map tosnwl 20 set transform-set strong
crypto map tosnwl interface outside
isakmp enable outside
isakmp key ******** address 67.158.dd.cc netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 28800
telnet 192.168.170.0 255.255.255.0 inside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 67.158.dd.cc 255.255.255.255 outside
ssh timeout 5
management-access inside
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80

           
         

Open in New Window Select All

Answer : Trying to forward web traffic through corporate web filter

I just decided to use force a web proxy through group policy that will then go through my web filter at corporate office. The web proxy that I'm using is Squid.