Section E: About tunneling HTTP-based traffic

Overview of HTTP tunneling options  

Several features are available to support tunneling of traffic directed to HTTP ports on the appliance. All options to support these features are on the HTTP - Tunneling page (Setup tab > HTTP > Tunneling).

Options to support CONNECT traffic  

The following options are available for you to optimize handling of CONNECT requests:

• Authenticate HTTP-Based Tunneling Requests option

  You can require user login and authentication for HTTP-based CONNECT requests to this appliance.

• HTTP-Based Tunneling ACL option

  You can specify ACL rules specific to handling HTTP-based CONNECT requests to this appliance, for example, to allow server port 443 or 563 traffic.

  Note
  The Destination Ports option on the Network - General page can be used to deny access to nonstandard HTTP ports (for example, port 8080). However, Network Appliance recommends that you use the HTTP-Based Tunneling ACL option for that purpose. The reason is that using the Destination Ports option might be a more complex method of allowing traffic for nonstandard ports for protocols that do not pose the same security risks as HTTP.

Handling non-HTTP traffic on HTTP proxy ports  

Some organizations use standard HTTP ports for non-HTTP traffic. Their L4 or L7 switches or WCCP routers are configured to redirect such traffic to the NetCache HTTP proxy port. Ordinarily, NetCache returns an error in such a case because it cannot recognize the traffic as HTTP traffic. However, you can use the Tunnel Non-HTTP Traffic option to instruct the NetCache appliance to accept non-HTTP traffic on its HTTP proxy ports and tunnel this traffic to the origin server.

This feature can be used only when HTTP transparent proxying is configured.

Tunneling traffic for specific server IP addresses  

Some applications use traffic on port 80 that looks similar to HTTP but is not. NetCache ordinarily would return an error message in this circumstance. You can, however, configure NetCache so that NetCache tunnels all traffic destined to server IP addresses that you specify. NetCache then passes through the traffic to those servers through without examining it.

The options you can use to configure NetCache to tunnel this traffic are

• Enable Tunneling of Server IP Addresses
• Tunnel Server IP Addresses

This feature can be used only when HTTP transparent proxying is configured.

Copyright © 1994-2002, Network Appliance, Inc. All rights reserved.
Part No. 210-00369
File: webcac16.htm
Last updated: 11/12/02 12:13:42