When IE Proxy Settings was Bypassed

Problem Scenario:
Facing problem when accessing a particular site through ProxySG.

---

Root Cause Analysis:
IE bypassing the IE proxy setting and directly accessing to the site http://www.first-aviva.com.tw/ (59.125.161.186) for retrieving XML and XSL files.

Downloaded and analyzed the JSP coding.
http://www.first-aviva.com.tw/cms/js/xml.jsp.

Some Googling and lead to the following links:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms766434
http://msdn.microsoft.com/en-us/library/windows/desktop/aa384069

---

Solution:

C:\>proxycfg
Microsoft (R) WinHTTP Default Proxy Configuration Tool
Copyright (c) Microsoft Corporation. All rights reserved.

Current WinHTTP proxy settings under:
  HKEY_LOCAL_MACHINE\
    SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
      WinHttpSettings :

     Direct access (no proxy server).

C:\>proxycfg /?
Microsoft (R) WinHTTP Default Proxy Configuration Tool
Copyright (c) Microsoft Corporation. All rights reserved.

usage:

    proxycfg -?  : to view help information

    proxycfg     : to view current WinHTTP proxy settings

    proxycfg [-d] [-p  []]

        -d : set direct access
        -p : set proxy server(s), and optional bypass list

    proxycfg -u  : import proxy settings from current user's
                   Microsoft Internet Explorer manual settings (in HKCU)

C:\>
C:\>proxycfg -p 199.40.248.34:8080 ""
Microsoft (R) WinHTTP Default Proxy Configuration Tool
Copyright (c) Microsoft Corporation. All rights reserved.

Updated proxy settings
Current WinHTTP proxy settings under:
  HKEY_LOCAL_MACHINE\
    SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
      WinHttpSettings :

    Proxy Server(s) :  199.40.248.34:8080
    Bypass List     :  

C:\>
C:\>proxycfg
Microsoft (R) WinHTTP Default Proxy Configuration Tool
Copyright (c) Microsoft Corporation. All rights reserved.

Current WinHTTP proxy settings under:
  HKEY_LOCAL_MACHINE\
    SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
      WinHttpSettings :

    Proxy Server(s) :  199.40.248.34:8080
    Bypass List     :  

C:\>

The Output of the SGOS 'test http get {url}' Command

ProxySG#sh ver
Version: SGOS 5.4.3.7 Proxy Edition
Release id: 45225
UI Version: 5.4.5.1 Build: 51300
Serial number: 3508112036
NIC 0 MAC: 00E0814EC475
ProxySG#
ProxySG#test http get http://www.oanda.com/

Type escape sequence to abort.
Executing HTTP get test

* HTTP request header sent:
GET http://www.oanda.com/ HTTP/1.0
Host: www.oanda.com
User-Agent: HTTP_TEST_CLIENT

* HTTP response header recv'd:
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 16 Jun 2011 16:50:34 GMT
Content-Type: text/html
Accept-Ranges: bytes
Vary: Accept-Encoding
Connection: close

Measured throughput rate is 4.29 Kbytes/sec
HTTP get test passed
ProxySG#

Only trust the packets, nothing else...

WYSINWYRG - The 'show ip bgp neighbors ip-addr advertised-routes' Command

What You See Is Not What You Really Get (WYSINWYRG). :-)

First of all, let's see what's the advertised-routes option of the show ip bgp neighbors {ip-addr} command claims to be.

Router#sh ip bgp neighbors 2.2.2.2 ?
  advertised-routes  Display the routes advertised to a BGP neighbor
  dampened-routes    Display the dampened routes received from neighbor
  flap-statistics    Display flap statistics of the routes learned from
                     neighbor
  paths              Display AS paths learned from neighbor
  received           Display information received from a BGP neighbor
  received-routes    Display the received routes from neighbor
  routes             Display routes learned from neighbor
  |                  Output modifiers
  <cr>

Router#

So it says "the routes advertised to a neighbor", hmm... let's see...

Above shows the network topology used for this demonstration.
RT1 is configured with a route map to set the MED for its locally originated routes in AS 65001 to 100.
The MED attribute only being exchanged between neighbors ASes and not be propagated further to downstream or upstream ASes. So RT3 won't be able to see the MED value for 192.168.1.0/24 originated from AS 65001.

RT3#sh ip bgp
BGP table version is 8, local router ID is 192.168.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      23.23.23.2                             0 65002 65001 i
*> 192.168.2.0      23.23.23.2               0             0 65002 i
*> 192.168.3.0      0.0.0.0                  0         32768 i
RT3#

Notice the blank value in the Metric column for 192.168.1.0/24? So far, so good...

Now let's issue the command in question on RT2. :-)

RT2#sh ip bgp neighbors 23.23.23.3 advertised-routes
BGP table version is 11, local router ID is 192.168.2.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      12.12.12.1             100             0 65001 i
*> 192.168.2.0      0.0.0.0                  0         32768 i
RT2#

hey, RT2 claims that it advertised the MED value for 192.168.1.0/24 to RT3.
WHAT!?! What I see is not what I really get!?! ~!@#$%^&*()

Conclusion:
The output of the show ip bgp neighbors {ip-addr} advertised-routes is actually displaying the routes in the Loc-RIB instead of the Adj-RIB-Out, which means that the routes that are yet to be processed by the output policy engine that performs the actions for manipulating routes, eg: MED, AS path prepending, etc. Period. :-)

So, this should be the way. :-)

Router#sh ip bgp neighbors 2.2.2.2 ?
  advertised-routes  Display the routes that are going to be advertised to a BGP neighbor
  dampened-routes    Display the dampened routes received from neighbor
  flap-statistics    Display flap statistics of the routes learned from
                     neighbor
  paths              Display AS paths learned from neighbor
  received           Display information received from a BGP neighbor
  received-routes    Display the received routes from neighbor
  routes             Display routes learned from neighbor
  |                  Output modifiers
  <cr>

Router#

P/S: The values in the AS path column further support our conclusion.