Доброго дня.

Может кто сталкивался с такой проблемой. Уже месяц бьюсь, решить не могу.

Есть cisco по wccp2 подключенная к серверу на FreeBSD 11.0 с установленным SQUID.
SQUID выполняет фильтрацию.
CISCO в соответствии с Access-list заворачивает по IP нужные сайты на squid
По HTTP фильтрует отлично. А по HTTPS не работает. Не пропускает все пришедшие запросы от  cisco на HTTPS.

#squid -v
Squid Cache: Version 3.5.23
Service Name: squid
configure options:  '--with-default-user=squid' '--bindir=/usr/local/sbin' '--sbindir=/usr/local/sbin' '--datadir=/usr/local/etc/squid' '--libexecdir=/usr/local/libexec/squid' '--localstatedir=/var' '--sysconfdir=/usr/local/etc/squid' '--with-logdir=/var/log/squid' '--with-pidfile=/var/run/squid/squid.pid' '--with-swapdir=/var/squid/cache' '--without-gnutls' '--enable-auth' '--enable-zph-qos' '--enable-build-info' '--enable-loadable-modules' '--enable-removal-policies=lru heap' '--disable-epoll' '--disable-linux-netfilter' '--disable-linux-tproxy' '--disable-translation' '--disable-arch-native' '--enable-eui' '--enable-cache-digests' '--enable-delay-pools' '--disable-ecap' '--disable-esi' '--enable-follow-x-forwarded-for' '--enable-htcp' '--enable-icap-client' '--enable-icmp' '--enable-ident-lookups' '--enable-ipv6' '--enable-kqueue' '--with-large-files' '--enable-http-violations' '--without-nettle' '--enable-snmp' '--enable-ssl' '--with-openssl=/usr/local' 'LIBOPENSSL_CFLAGS=-I/usr/local/include' 'LIBOPENSSL_LIBS=-lcrypto -lssl' '--enable-ssl-crtd' '--disable-stacktraces' '--enable-forw-via-db' '--enable-wccp' '--enable-wccpv2' '--without-heimdal-krb5' '--without-mit-krb5' '--without-gss' '--disable-ipf-transparent' '--enable-ipfw-transparent' '--disable-pf-transparent' '--without-nat-devpf' '--enable-auth-basic=DB SMB_LM MSNT-multi-domain NCSA PAM POP3 RADIUS fake getpwnam NIS' '--enable-auth-digest=file' '--enable-external-acl-helpers=file_userip time_quota unix_group' '--enable-auth-negotiate=none' '--enable-auth-ntlm=fake smb_lm' '--enable-storeio=aufs diskd rock ufs' '--enable-disk-io=DiskThreads DiskDaemon AIO Blocking IpcIo Mmapped' '--enable-log-daemon-helpers=file' '--enable-url-rewrite-helpers=fake' '--enable-storeid-rewrite-helpers=file' '--prefix=/usr/local' '--mandir=/usr/local/man' '--disable-silent-rules' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.0' 'build_alias=amd64-portbld-freebsd11.0' 'CC=cc' 'CFLAGS=-O2 -pipe  -fstack-protector -fno-strict-aliasing' 'LDFLAGS= -pthread -Wl,-rpath,/usr/local/lib -fstack-protector' 'LIBS=' 'CPPFLAGS=' 'CXX=c++' 'CXXFLAGS=-O2 -pipe -fstack-protector -fno-strict-aliasing  -Wno-unknown-warning-option -Wno-undefined-bool-conversion -Wno-tautological-undefined-compare -Wno-dynamic-class-memaccess' 'CPP=cpp' --enable-ltdl-convenience

squid.conf:

cache_effective_user squid
cache_effective_group squid

visible_hostname reestr-proxy

#debug_options ALL,5

http_port 192.168.2.230:9090

http_port 192.168.2.230:3128 intercept
https_port 192.168.2.230:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/etc/squid/squ

always_direct allow all

acl ssl_sites ssl::server_name "/var/db/zapret-info/denied_https.conf"
acl step1 at_step SslBump1
acl step2 at_step SslBump2
ssl_bump peek step1
ssl_bump bump ssl_sites
ssl_bump splice all
sslproxy_cert_error allow all
sslproxy_options NO_SSLv2,NO_SSLv3,SINGLE_ECDH_USE
sslproxy_options ALL
sslproxy_cipher ALL
sslcrtd_program /usr/local/libexec/squid/ssl_crtd -s /var/squid/ssl_db -M 4MB

icp_port 0
#hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
cache_mem 1 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 1 KB
maximum_object_size_in_memory 50 KB
cache_replacement_policy heap LFUDA
cache_dir ufs /var/squid/cache 1 1 1 no-store
logfile_rotate 7
dns_nameservers 8.8.8.8
hosts_file /etc/hosts
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
quick_abort_min 0 KB
quick_abort_max 0 KB
half_closed_clients off
acl purge method PURGE
acl CONNECT method CONNECT
acl SSL_ports port 16869
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 8001
acl Safe_ports port 81
acl Safe_ports port 888
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow all
http_reply_access allow all
icp_access allow all
cache_mgr root@server.ru
memory_pools off
log_icp_queries off
cachemgr_passwd q1w2e3r4 all
client_db off
buffered_logs on

wccp2_router 192.168.2.229

wccp2_rebuild_wait on

wccp2_forwarding_method 2

wccp2_return_method 2

wccp2_assignment_method 1

wccp2_service dynamic 0
wccp2_service_info 0 protocol=tcp flags=dst_ip_hash,dst_port_hash priority=240 ports=80,8001,8080,8081,81,888
wccp2_service dynamic 70
wccp2_service_info 70 protocol=tcp flags=dst_ip_hash,dst_port_hash priority=240 ports=16869,443

wccp2_address 192.168.2.230

redirect_program /usr/local/etc/squid/redirector.pl
url_rewrite_children 60 startup=10 idle=1 concurrency=0

/var/log/squid/cache.log:

2017/06/22 23:54:18 kid1| Current Directory is /var/squid
2017/06/22 23:54:18 kid1| Starting Squid Cache version 3.5.23 for amd64-portbld-freebsd11.0...
2017/06/22 23:54:18 kid1| Service Name: squid
2017/06/22 23:54:18 kid1| Process ID 16050
2017/06/22 23:54:18 kid1| Process Roles: worker
2017/06/22 23:54:18 kid1| With 1171206 file descriptors available
2017/06/22 23:54:18 kid1| Initializing IP Cache...
2017/06/22 23:54:18 kid1| DNS Socket created at [::], FD 6
2017/06/22 23:54:18 kid1| DNS Socket created at 0.0.0.0, FD 7
2017/06/22 23:54:18 kid1| Adding nameserver 92.50.201.2 from squid.conf
2017/06/22 23:54:18 kid1| helperOpenServers: Starting 5/32 'ssl_crtd' processes
2017/06/22 23:54:18 kid1| helperOpenServers: Starting 10/60 'redirector.pl' processes
2017/06/22 23:54:18 kid1| Logfile: opening log daemon:/var/log/squid/access.log
2017/06/22 23:54:18 kid1| Logfile Daemon: opening log /var/log/squid/access.log
2017/06/22 23:54:18 kid1| Unlinkd pipe opened on FD 45
2017/06/22 23:54:18 kid1| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec
2017/06/22 23:54:18 kid1| Store logging disabled
2017/06/22 23:54:18 kid1| Swap maxSize 1024 + 1024 KB, estimated 157 objects
2017/06/22 23:54:18 kid1| Target number of buckets: 7
2017/06/22 23:54:18 kid1| Using 8192 Store buckets
2017/06/22 23:54:18 kid1| Max Mem  size: 1024 KB
2017/06/22 23:54:18 kid1| Max Swap size: 1024 KB
2017/06/22 23:54:18 kid1| Rebuilding storage in /var/squid/cache (clean log)
2017/06/22 23:54:18 kid1| Using Least Load store dir selection
2017/06/22 23:54:18 kid1| Current Directory is /var/squid
2017/06/22 23:54:18 kid1| Finished loading MIME types and icons.
2017/06/22 23:54:18 kid1| Accepting WCCPv2 messages on port 2048, FD 48.
2017/06/22 23:54:18 kid1| Initialising all WCCPv2 lists
2017/06/22 23:54:18 kid1| HTCP Disabled.
2017/06/22 23:54:18 kid1| Pinger socket opened on FD 53
2017/06/22 23:54:18 kid1| Squid plugin modules loaded: 0
2017/06/22 23:54:18 kid1| Adaptation support is off.
2017/06/22 23:54:18 kid1| Accepting HTTP Socket connections at local=192.168.2.230:9090 remote=[::] FD 49 flags=9
2017/06/22 23:54:18 kid1| Accepting NAT intercepted HTTP Socket connections at local=192.168.2.230:3128 remote=[::] FD 50 flags=41
2017/06/22 23:54:18 kid1| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=192.168.2.230:3129 remote=[::] FD 51 flags=
2017/06/22 23:54:18 kid1| Done reading /var/squid/cache swaplog (0 entries)
2017/06/22 23:54:18 kid1| Store rebuilding is 0.00% complete
2017/06/22 23:54:18 kid1| Finished rebuilding storage from disk.
2017/06/22 23:54:18 kid1|         0 Entries scanned
2017/06/22 23:54:18 kid1|         0 Invalid entries.
2017/06/22 23:54:18 kid1|         0 With invalid flags.
2017/06/22 23:54:18 kid1|         0 Objects loaded.
2017/06/22 23:54:18 kid1|         0 Objects expired.
2017/06/22 23:54:18 kid1|         0 Objects cancelled.
2017/06/22 23:54:18 kid1|         0 Duplicate URLs purged.
2017/06/22 23:54:18 kid1|         0 Swapfile clashes avoided.
2017/06/22 23:54:18 kid1|   Took 0.03 seconds (  0.00 objects/sec).
2017/06/22 23:54:18 kid1| Beginning Validation Procedure
2017/06/22 23:54:18 kid1|   Completed Validation Procedure
2017/06/22 23:54:18 kid1|   Validated 0 Entries
2017/06/22 23:54:18 kid1|   store_swap_size = 0.00 KB
2017/06/22 23:54:18| pinger: Initialising ICMP pinger ...
2017/06/22 23:54:18| pinger: ICMP socket opened.
2017/06/22 23:54:18| pinger: ICMPv6 socket opened
2017/06/22 23:54:19 kid1| storeLateRelease: released 0 objects

При этом /var/squid/ssl_db:
index.txt  0
size       1
каталог certs - пустой

#sockstat -4 | grep 3129
squid    squid      16050 51 tcp4   192.168.2.230:3129    *:*
#sockstat -4 | grep 3128
squid    squid      16050 50 tcp4   192.168.2.230:3128    *:*

# ipfw list
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 80 via igb1 in
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 8001 via igb1 in
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 8080 via igb1 in
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 8081 via igb1 in
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 81 via igb1 in
00050 fwd 192.168.2.230,3128 tcp from not me to any dst-port 888 via igb1 in
00050 fwd 192.168.2.230,3129 tcp from not me to any dst-port 16869 via igb1 in
00050 fwd 192.168.2.230,3129 tcp from not me to any dst-port 443 via igb1 in