Retaining the client IP address as the source IP address

About IP spoofing

You can use the appliance IP spoofing feature to configure NetCache to use the client IP address as the source address when communicating with servers. Requests originating from a client retain the client's source address even if requests are passed through a chain of proxy-cache servers. The requests, therefore, appear to originate from the client rather than from the appliance.

Note
Even when IP spoofing is enabled, the appliance can continue to send one of its IP addresses to the origin server, instead of using the client's. For example, if a DNS lookup results in an IP address that is different than the one the client requested, the appliance uses one of its IP addresses to ensure that content is redirected back to it. You can force the appliance to always send the client IP address by enabling the "Force HTTP IP spoofing for certain servers" option (Setup tab > Transparency > Transparency and IP Spoofing Enable).

Unlike request forwarding, NetCache intercepts the responses from origin servers and caches objects fetched on behalf of the spoofed client. The symmetric routing allows you to gather more accurate client statistics in origin server logs than would be possible if the appliance IP address were used to initiate the connection to the server.

To access the IP spoofing options, select Setup tab > Transparency > Transparency and IP Spoofing Enable.

IP spoofing restrictions

The following restrictions apply to IP spoofing:

IP spoofing must be set by protocol. It is not applicable to DNS, FTP, NNTP, and QuickTime RTSP transparent proxying.
Routing between the client and the origin server must be symmetric so that server responses are redirected to the same appliance that the client traffic was sent through.
If a hierarchy is configured on your appliance and parent caches are identified, the appliance must be in a location on the network where it can intercept the traffic between the requesting client and the parent caches.
To enable IP spoofing for streaming media, you should enable IP spoofing for HTTP, in addition to RTSP or MMS, so that server-side HTTP-encapsulated streaming media is also redirected to the appliance.
IP spoofing is incompatible with the request forwarding options (Setup tab > Transparency > Request Forwarding). If you have IP spoofing enabled and want to bypass specific IP addresses, you should use the "Enable tunneling of server IP addresses" option to bypass them.

IP spoofing deployment requirements for WCCP

IP spoofing deployments require symmetric routing so that server responses are redirected to the same appliance that received the client request. To implement IP spoofing for WCCP, the following conditions must be met:

The WCCP router must support an inbound redirection feature.
Separate router interfaces must be assigned to appliances, clients, and servers.
Inbound redirection filters must be set on the WCCP router for both client-side and server-side traffic.

The following sections describe these conditions.

WCCP router inbound redirection feature support

Before implementing IP spoofing, contact your Cisco representative to ensure that your WCCP router supports inbound redirection. At the time of this writing, Cisco routers that support the MAC address rewriting feature do not support the inbound redirection feature. Therefore, you cannot deploy IP spoofing with routers that support MAC address rewriting.

Assignment of separate router interfaces

In addition to dedicating one interface on the router to clients and another interface to origin servers, you must dedicate a router interface for the appliances, as shown in the following illustration (A, B, and C represent the separate interfaces).

Inbound redirection filters

In the router configuration, an inbound redirection filter based on the client-side WCCP service group must be applied on the client-side interface of the router in order to route client-to-server traffic to the appliances. Similarly, an inbound redirection filter based on the server-side WCCP service group must be applied on the server-side interface of the router to route server-to-client traffic to the appliances.