OK - I am assuming the CISCO kit are connecting the two LANs as a WAN.
If you want both networks to use the one Internet connection - behind the one masquarading IP address - I would recommend that the device in direct connection to the Internet is the masquarading firewall (NAT or PNAT).
Simplistically, the WAN connection needs to be behind this Internet firewall so the topology should look like:
Internet
|
|
|
WAN--------officeB
|
|
|
officeA
Now, with the need for the two WAN endpoint bridges/routers you can use one as the Internet connection in a third interface.
Internet
|
|
|
CiscoA--------CiscoB---------officeB
|
|
|
OfficeA
for which you would configure the CiscoA box to act as the firewall.
Now if you're going to bring in a Linux proxy you have two options - either 1, put it between CiscoA and the Internet as the firewall with Squid proxy to handle internet access.
Internet
|
|
Linux
|
|
CiscoA-----CiscoB---officeB
|
|
OfficeA
Option 2, Still use CiscoA as the boundary firewall and put the linux proxy in the office A LAN and configure CiscoA to only allow that proxy's IP address to access the Internet, therefore all clients have to access the porxy to access the Internet.
Internet
|
|
CiscoA----CiscoB---OfficeB
|
|
officeA with Linux
Option3 is as you have it (topology anyway)
Option4 is as option3 but with another linux box between CiscoB and OfficeB LAN.
Now which one.... I would say option1 is the most obvious. The advantage is simplicity - the cisco's just route everything and the proxy firewalls the internet. The disadvantage is that you'll have to make sure the linux box is screwed down tight.
With option2 (and all other options in fact) you'll need to make sure that the Ciscos have the firewalling kit installed at the boundary. For option2 specifically, having a proxy installed like that would only work if you were giving folks web access only - with the boundary CiscoA doing all the real work. Bit pointless really.
Option4 is reasonably good but a bit wasteful on resourses - as you are effectively working with 3 boundary devices. However, it would be secure because of the levels of functional redundancy and would allow the office PCs to name the proxy server in the browser configs. Option3 is really worst of all worlds.
So I would say option1 - Have the linux box use the ISP IP address on the outside interface - create a small subnet between that and ciscoA - though the proxy would have to run in a transparent mode if you don't want the subnet between the linux box and CiscoA to be visible to the office lans. Don't know how you have the WAN set up but I will assume you are using a private subnet - 192.168.1.0 say.... So:
Internet
|
|
| aaa.bbb.ccc.ddd (eth0)
Linux masquarading firewall/proxy
| 192.168.100.1 (eth1)
|
|
| 192.168.100.2
|
CiscoA 192.168.1.1----192.168.1.2 CiscoB 192.168.2.1--LANB
|
| 192.168.2.1
|
|
LANA
Set up the ciscos to route the various private subnets appropriately. Set up the routers' default gateways to 'cascade' up to the next box. Set up all local office machines' default gateway to point to their router. Set up the linux box to firewall appropriately amd masquade all behind the aaa.bbb.ccc.ddd interface - don't forget to add static routes so it knows how to get back to the office lans.
Finally, network neighborhood uses broadcasts to identify the machines on the network. Broadcasts only travel on their own subnet so you won't see the office B machines in the office A LAN and vice versa. To get around this - install a WINS server in each office LAN and configure each office machine to use both the LAN A and LAN B WINS servers. Bit of a pain but the only way.
