When transparent proxying is deployed, the client software is unaware of the existence of a proxy-cache server. The addition of the caching service is transparent to end users because you perform all the configuration necessary to deploy transparent proxying--configuration of your NetCache appliances and the network devices with which you are deploying transparent proxying. Users do not have to configure client applications, such as Web browsers or media players, to use a particular NetCache appliance, as is the case with a nontransparent client access method.
Transparent proxying eliminates the possibility of users reconfiguring their Web browsers or media players (RealNetworks RTSP and Microsoft WMP 7 only) to bypass a NetCache appliance without the knowledge of NetCache administrators.
Note
The RTSP for RealNetworks media player, Apple QuickTime player, and Microsoft Windows Media player 7 can be used with transparent proxying.
Additional benefits of transparent proxying include the following:
The following traffic can be transparently redirected to NetCache appliances:
You can implement DNS caching transparently or nontransparently. Users do not need to configure their browsers for nontransparent DNS caching. See the Administration Guide for details about setting up transparent and nontransparent DNS caching.
FTP over HTTP, Gopher, and tunnel traffic (for example, HTTPS and SNEWS) cannot be serviced transparently. For these protocols, you can set up proxy service by having users configure their browsers to point to the NetCache appliance or use the NetCache protocol tunneling feature.
You can use any of the following network devices to deploy transparent proxying for DNS, HTTP, FTP, NNTP, MMS, and RTSP traffic:
Switches typically include multiple methods for handling traffic. When this guide refers to L4 or L7 switches, it refers to a feature on a switch that can support transparent proxying; that is, a feature that operates on the L4 or L7 layer of the Open Systems Interconnection (OSI) Reference model. Switch names vary by vendor.
NetCache supports the use of Web Cache Communication Protocol (WCCP) 2.0 for redirecting traffic to NetCache appliances. WCCP defines the protocol that is used between proxy-cache servers (such as NetCache appliances) and routers to exchange information. WCCP 2.0 is supported on Cisco routers running IOS 12.0(4) T images and later versions. See the Cisco Web site for more information about IOS versions.
Few organizations use this method for transparent proxying because of significant limitations, as follows:
Subsequent sections about transparent proxying discuss deploying transparent proxying with an L4 switch, an L7 switch, and a WCCP router. If you need additional information about deploying transparency with a policy-based router, contact your NetCache sales engineer.
When determining your client access strategy, you must consider the drawbacks of implementing a transparent proxy deployment as well as the benefits. The following list shows the drawbacks of transparent proxy deployment. These drawbacks apply to transparency provided by any vendor.
A stable route is essential between the clients and the NetCache appliance. If a routing flap occurs, a client route might not continue to go through the NetCache appliance. If routing flaps occur frequently, you cannot take full advantage of your NetCache appliance.
Network Appliance recommends that you deploy transparent proxying only in locations where network routing cannot become asymmetric through the NetCache appliance.
With transparent proxying, the browser is not aware that it is using a proxy-cache server. Some Web browsers cannot request the proxy-cache server to fetch a new copy from the Internet when the user clicks the Reload button. Instead the Web browser delivers the object that is in the cache again. Therefore, with some browsers, users might not receive refreshed versions of Web pages when they click the Reload button.
Users can receive error messages generated by NetCache for conditions such as the Web server being unavailable. If you do not want users to receive error messages generated by NetCache, you can configure Stealth Mode in NetCache to prevent these messages from appearing.
Note
Stealth mode is available for nontransparent HTTP requests also.
Sites using IP-based authentication, for example, electronic commerce Web sites, expect to receive the client's IP address with a request. However, when a request is redirected through a NetCache appliance, the NetCache appliance replaces the client IP address with the appliance IP address. (A proxy-cache server belonging to any vendor routinely replaces the client IP address with the proxy-cache server IP address.)
If you expect your users to send requests to sites that require the client IP address, you need to plan how to handle those requests. Some switches and WCCP routers provide features that enable you to send requests for sites that require the client IP address directly to those sites; that is, requests for those sites bypass the NetCache appliance. Alternatively, NetCache provides the transparency configuration options in the following list that you can use to ensure that the client IP address arrives at the destination server intact.
You can use the NetCache appliance IP spoofing feature to configure NetCache to use the client IP address as the source address when communicating with servers. Requests originating from a client retain the client's source address even if requests are passed through a chain of proxy-cache servers. The requests, therefore, appear to originate from the client rather than from the NetCache appliance.
On the server side, NetCache intercepts the responses from origin servers and caches objects fetched on behalf of the spoofed client. The symmetric routing allows you to gather more accurate client statistics in origin server logs than is possible if the NetCache appliance IP address was used to initiate the connection to the server.
If you do not want NetCache to service some client requests, you can configure NetCache to forward these requests directly to origin servers. Therefore, requests arrive at the origin server with the client's IP address intact. This method of request bypass is called request forwarding. Request forwarding is particularly useful for listing URLs that you know are not cacheable or for sites that use IP authentication.
See the transparent proxying chapter in the Administration Guide for more details about NetCache IP spoofing and request forwarding features, their use, and their limitations.
An L4 or L7 switch or a WCCP router redirects traffic to a NetCache appliance based on your specifications for the port traffic to be redirected, which you provide in your switch or router configuration and in NetCache configuration.
The following illustration shows the traffic flow from the clients to the NetCache appliance when an L4 or L7 switch or a WCCP router is deployed.
If the NetCache appliance cannot resolve a request, it redirects the request back through the switch or the WCCP router to the origin server--a Web server, news server, or streaming server--as applicable. The origin server returns the requested data to the NetCache appliance. The NetCache appliance returns the requested data to the client while caching the data, if it is cacheable.
For DNS, FTP, and MMS, required ports for traffic redirection are as follows:
For the other protocols, common ports for traffic redirection are as follows:
If you are using QuickTime for streaming, you must also redirect RTCP port traffic, typically TCP port 2001.
Additional port information for streaming media service is as follows:
Failover to another appliance and to the Internet are standard features of transparent proxying with an L4 or L7 switch or a WCCP router. Only standard setup is required to ensure that transparent proxying has the failover functionality. Failover with transparent proxying is very reliable.
The following illustration shows one switch or WCCP router and one NetCache appliance added to the network to handle HTTP requests transparently. If no NetCache appliances are available, the switch or WCCP router directs traffic to the Internet. Although this illustration shows failover for HTTP traffic only, switches and WCCP routers fail over to the Internet by default for all types of traffic.
If you set up your L4 or L7 switch or WCCP router for failover to the Internet, be sure that you are not relying on NetCache features to provide controls over your requests. For example, if the switch fails over to the Internet directly, no URL blocking or logging of client access to URLs is available. If you need to monitor or restrict access to the Internet all the time, you do not want automatic failover to the Internet. You can configure a switch or WCCP router so that it does not fail over to the Internet automatically.
You cannot set up a failover mechanism to handle media streams that are in the process of being delivered to clients. The reason is that streaming connections are dropped if a problem occurs between the streaming media cache and the streaming server, or between the streaming media cache and clients. Ensuring that your network is sound should reduce the number of dropped connections.
Copyright © 1994-2002, Network Appliance, Inc. All rights
reserved.
Part No. 210-00372
File: access4.htm
Last updated: 11/13/02 18:10:53