About transparent proxying with a WCCP router

About WCCP

WCCP provides a way for routers to redirect traffic to proxy-cache servers. WCCP has built-in mechanisms for request distribution and redundancy.

Router location

The following table discusses issues related to WCCP router location.

Router location in relation to...	Comments
NetCache appliances	When you have multiple subnets, the router and NetCache appliances can be on different subnets. However, Network Appliance recommends that, for efficiency, the router and NetCache appliances be on the same subnet. You can directly connect a WCCP router to a NetCache appliance. However, a direct connection is not a requirement or a best practice recommendation.
Clients	The router must be located so that it can view all network traffic for the clients that it is expected to serve.
Firewalls	Do not place the WCCP router in a location where a firewall that uses Network Address Translation (NAT) is located between it and the appliance. Firewall configuration for WCCP traffic can be difficult. Consult your Network Appliance service engineer for configuration help and deployment recommendations.

Router location in relation to...

Comments

NetCache appliances

When you have multiple subnets, the router and NetCache appliances can be on different subnets. However, Network Appliance recommends that, for efficiency, the router and NetCache appliances be on the same subnet.

You can directly connect a WCCP router to a NetCache appliance. However, a direct connection is not a requirement or a best practice recommendation.

Clients

The router must be located so that it can view all network traffic for the clients that it is expected to serve.

Firewalls

Do not place the WCCP router in a location where a firewall that uses Network Address Translation (NAT) is located between it and the appliance.
Firewall configuration for WCCP traffic can be difficult. Consult your Network Appliance service engineer for configuration help and deployment recommendations.

Traffic redirection methods available

The following table shows the methods that NetCache supports for WCCP routers to redirect traffic to NetCache appliances.

Traffic redirection method	Description
MAC address rewriting (sometimes referred to as L2 rewriting)	Rewriting of the destination MAC address. The router replaces the packet's destination address with the address of the target proxy-cache server. The router and the NetCache appliances must be on the same subnet to use MAC address rewriting. A router can redirect traffic more quickly when MAC address rewriting instead of IP-GRE encapsulation is used.
IP-GRE encapsulation (default)	IP packets are encapsulated in another IP packet. IP-GRE encapsulation must be used when the router and NetCache appliances are on separate subnets, but can be used when the router and NetCache appliances are on the same subnet.

Note
Not all routers are capable of L2 rewriting. See the Cisco documentation for information about additional limitations with MAC address rewriting.

WCCP service groups control communication

In WCCP, traffic redirection and distribution are based on logical WCCP service groups. A service group is a group of one or more routers and one or more proxy-cache servers that can work together in traffic redirection and distribution because they have been defined, through a service group definition, with the same settings.

Information you provide in a service group definition on a NetCache appliance includes the following:

An ID
The traffic to be redirected to the appliance (for example, client-side HTTP TCP port 80 traffic)
A specification for how the traffic will be distributed over the NetCache appliances (for example, by destination IP address)
Transmission method (unicast or multicast)

The WCCP routers in the same service group have the corresponding configuration, which ensures that they can redirect client-side HTTP TCP port 80 traffic to those NetCache appliances. You can also set passwords by service group to ensure that a WCCP router and proxy-cache server authenticate with each other.

The following illustration shows several NetCache appliances, some that are configured as Web caches handling client-side HTTP traffic and others that are configured as news caches handling client-side NNTP traffic. The router is configured to redirect both HTTP and NNTP traffic. The service groups to which the router and specific appliances "belong" determine the appliances to which the router can redirect a particular type of traffic.

In the preceding illustration, the two NetCache appliances on the left handle only one type of traffic, HTTP (TCP port 80). Service group 0 has been defined in NetCache as the service group for HTTP (TCP port 80) traffic, and the router has been configured to listen for requests from service group 0.

The NetCache appliances on the right handle NNTP (TCP port 119) requests only. Service group 1 has been defined in NetCache as the service group for NNTP traffic, and the router has been configured to listen for requests from service group 1.

Typically, administrators configure a separate service group for each protocol. A single NetCache appliance that handles multiple protocols could, therefore, be configured with multiple service groups. Likewise, a WCCP router can belong to multiple service groups.

Note
Third-party proxy-cache servers must support transparency and WCCP 2.0 to be included in a service group.

Number of routers with which a NetCache appliance can interact

Each service group can consist of 64 WCCP routers and up to 32 NetCache appliances (or third-party proxy-cache servers). The routers that a specific NetCache appliance can communicate with depends on the service groups to which the NetCache appliance and the WCCP routers belong.

Transmission methods between WCCP routers and NetCache appliances

NetCache supports both unicast and multicast transmission between WCCP routers and NetCache appliances. If your WCCP routers are configured for WCCP multicast, you can configure WCCP service groups for multicast transmission between WCCP routers and NetCache appliances. Unicast and multicast are defined as follows:

With unicast transmission, communication occurs between one host and another, in this case, between a WCCP router and a NetCache appliance.
With multicast transmission, multiple hosts can listen for transmission from one host. For example, all transmissions from a NetCache appliance for a service group configured for multicast will be detected by all devices listening to the multicast address for that service group.

The advantages of using multicast transmission between members of a service group are as follows:

Use of multicast significantly reduces network traffic.
Less configuration is required in NetCache.
With unicast transmission, you must explicitly identify WCCP routers with which the NetCache appliance interacts. If a router is later removed from the network, you must remove the router's IP address from the NetCache configuration.

Network Appliance recommends that you select one transmission scheme for your WCCP transparency deployment--either unicast or multicast. The reason is that your configuration and management will be simpler.

Plan for your service groups

Setting up transparent proxying with WCCP routers and NetCache appliances involves planning for service groups and completing the configuration supporting service groups on both the router and NetCache appliance.

Consider the following requirements:

A service group must be defined in the same way on each NetCache appliance that offers the service for which the service group is being set up. That is, if you define a service group for client-side TCP port 119 traffic on one NetCache appliance and assign an ID of 4 to that service group, all service groups that you define on your NetCache appliances for TCP port 119 traffic must be identified as service group 4. Additionally, all other settings for that service group must be the same on all the appliances.
You must coordinate your NetCache appliance settings with the WCCP router configurations.

See your WCCP router documentation and the Administration Guide for help with planning your service groups.

Advantages of using a WCCP router instead of a switch

Some advantages of using a WCCP router instead of a switch are as follows:

The router can dynamically add to and delete from its list of known caches the proxy-cache servers in service groups the router listens for. No explicit configuration is necessary to make the router aware of NetCache appliances that are in service groups that the router is listening for, as is the case with L4 or L7 switches. You can add and remove NetCache appliances to and from your network without having to reconfigure your WCCP routers.
Because WCCP configuration on the NetCache appliance provides information to WCCP routers, configuring a WCCP router is less complex than configuring a switch.
NetCache support for the WCCP service group scheme provides you with the flexibility to set up service groups to handle specialized needs, for example, for traffic using nonstandard ports and for IP spoofing.
You do not have to buy an extra router. WCCP is typically installed on an existing router.
You do not have to configure the router with information about a new proxy-cache server that you have added to the network.

WCCP and IP spoofing

IP spoofing deployments require symmetric routing so that server responses are redirected to the same NetCache appliance that received the client request. To implement IP spoofing for WCCP, the following conditions must be met:

The WCCP router must support an inbound redirection feature.
A separate router interface must be assigned to appliances, clients, and servers.
Inbound redirection filters must be set on the WCCP router for both client-side and server-side traffic.

The following sections describe these conditions.

WCCP router inbound redirection feature support

Before implementing IP spoofing, contact your Cisco representative to ensure that your WCCP router supports inbound redirection. At the time of this writing, Cisco routers that support the MAC address rewriting feature do not support the inbound redirection feature. Therefore, you cannot deploy IP spoofing with routers that support MAC address rewriting.

Assignment of separate router interfaces

In addition to dedicating one interface on the router to clients and another interface to origin servers, you must dedicate a router interface for the NetCache appliances, as shown in the following illustration (A, B, and C represent the separate interfaces).

Inbound redirection filters

In the router configuration, an inbound redirection filter based on the client-side WCCP service group must be applied on the client-side interface of the router in order to route client-to-server traffic to NetCache appliances. Similarly, an inbound redirection filter based on the server-side WCCP service group must be applied on the server-side interface of the router to route server-to-client traffic to NetCache appliances.