Deploying NetCache inside a firewall

About deploying a NetCache appliance inside a firewall

Some organizations have a security policy that does not allow other devices to be added as part of the security interface to their company. You can easily add a NetCache appliance to the network without disturbing the existing security scheme. In this type of deployment, NetCache is just an internal service.

What you need to do to deploy a NetCache appliance inside a firewall depends on the type of firewall you have and how you want to use it.

NetCache appliance deployed inside a transparent firewall

If you are deploying a NetCache appliance inside a transparent firewall, you use the firewall as a default gateway for NetCache, as the following illustration shows. You do not have to perform any additional configuration in NetCache to send requests through the firewall to the Internet. However, to avoid a traffic loop, you must configure the firewall to recognize the NetCache IP addresses and to not apply the diversion rules.

Note
A transparent firewall is a firewall that NetCache can connect through without having to know the IP address of the firewall.

NetCache appliance deployed inside a nontransparent firewall

The following example shows a NetCache appliance deployed inside a nontransparent firewall running as a proxy.

Note
A nontransparent firewall is a firewall that NetCache must be aware of in order to connect through it. That is, NetCache must send requests directly to the correct firewall IP address and port.

In the NetCache configuration, you set up a logical hierarchy. This hierarchy enables NetCache to send cache misses to the nontransparent firewall for routing to the Internet. See Section A, Request resolution hierarchies for more information about hierarchies.

Note
Defining logical clusters is not possible for NNTP.

If origin servers are inside your firewall

To speed up performance, you want NetCache to fetch URLs directly from any origin servers inside the firewall instead of trying to fetch the URLs outside the firewall. See information in the Administration Guide about hierarchies for details.