Overview

Web Cache Communications Protocol (WCCP) supports the redirection of any TCP or UDP connections to appliances participating in WCCP Service Groups. The appliance intercepts only those packets that have been redirected to it. The appliance accelerates traffic flows that match its Route Policy; all other traffic passes through the appliance unmodified.

The two active Silver Peak appliances participating in the WCCP service group must be deployed out-of-path (Router mode). In this example, those appliances are at Site A. For the purposes of this specific example, Site B at the remote end deploys the appliance in-line (Bridge mode); there is no inherent restriction on what mode it needs to be.

WCCP at Site A

n	Each of the peered appliances at headquarters uses WCCP to redirect traffic from the router to the appliances.

n	WCCP redirects all traffic that is in a WCCP Service Group shared by the appliance and router.

A service group consists of a set of WCCP-enabled routers and appliances that exchange WCCP messages. The routers send traffic to the appliances in the service group. The configuration of the service group determines how traffic is distributed to appliances in the service group.

n	To use WCCP, you must create a separate WCCP Service Group for each protocol (TCP and UDP) used in the SiteA-to-SiteB tunnel.

Network Diagram

Out-of-Path Deployment: Redundant Silver Peak Appliances peered with an L3 router using WCCP

The Silver Peak appliances optimize traffic to/from 10.110.31.0/24 and 10.110.11.0.0/24.

Summary

Appliance Placement	Both appliances are attached in network, reachable by WAN router • Each appliance’s wan0 interface connects to network • Do not connect lan0 interface of either appliance
Fail-Safe Behavior	WCCP recognizes the failed appliance: • Failed appliance is removed from WCCP Service Group • WCCP forwards all traffic to the redundant Silver Peak appliance • Remote appliances switch to the redundant appliance
IP Addresses	This deployment model requires four IP addresses:   • Each appliance needs a Silver Peak Appliance IP data path address (to originate and terminate tunnels) • Each appliance needs a Silver Peak Management IP Address (for appliance configuration and management)   Configure WCCP on Site A’s Silver Peak Appliances and the WAN router. Service Group IDs on the router and appliance must match. • Configure two WCCP Service Groups on each Silver Peak appliance (one for TCP and one for UDP) • Configure two WCCP Service Groups on the WAN router (one for TCP and one for UDP)

Fail-Safe Behavior

Fail-safe behavior should always be tested before production deployment by ensuring that traffic continues to flow in each of the following cases:

1	With the appliance in bypass state

2	With the appliance powered off

3	With the tunnels administratively down.

Summary of Configuration Tasks

	Task	Notes	For detailed instructions, see...
1	Gather all the IP addresses needed for setup	Saves time and avoids mistakes.	“Collecting the Necessary Information”.
2	Install the Appliance A into the network	Physical appliance: Connect both appliances to the same available subnet via an Ethernet LAN switch. Verify connectivity, connect power, and verify LEDs. Virtual appliance: Configure the hypervisor, with the required interfaces.	Silver Peak Appliance Manager Operator’s Guide Quick Start Guides
3	Configure the Site A router for WCCP	Access the Site A router’s command line interface (CLI) to: • Configure an Access Control List (ACL) that redirects all traffic from the Site A subnet to the Site B subnet • Configure two WCCP Service Groups — one for UDP, one for TCP • Associate the ACL with the Service Group • Enable WCCP on the appropriate router interface	“Configuring the Site A Router for WCCP”
4	Configure Appliance A1	In a browser, access and use the Initial Configuration Wizard to configure the appliance. Reboot the appliance after finishing the configuration.	“Using the Initial Config Wizard with A1”.
5	Configure the WCCP Service Groups on Appliance A1	• Create a pair of Service Groups (TCP, UDP) for outbound redirection. • Create a pair of Service Groups (TCP, UDP) for inbound redirection.	“Configuring WCCP on A1”
6	Configure Appliance A2	In a browser, access and use the Initial Configuration Wizard to configure the appliance. Reboot the appliance after finishing the configuration.	“Using the Initial Config Wizard with A2”
7	Configure the WCCP Service Groups on Appliance A2	• Create a pair of Service Groups (TCP, UDP) for outbound redirection. • Create a pair of Service Groups (TCP, UDP) for inbound redirection.	“Configuring WCCP on A2”
8	Configure flow redirection for the Site A peers	When you create a cluster, the peers keep track of which appliance owns each flow. If the path between client and server isn’t the same in both directions, the flow is redirected to the appliance that first saw it and “owns” it.	“Configuring Flow Redirection”
9	Configure Appliance B	In a browser, access and use the Initial Configuration Wizard to configure the appliance. Reboot the appliance after finishing the configuration.	“Using the Initial Config Wizard with B”
10	Verify appliance connectivity	Tests data path connectivity. Do NOT proceed until you verify connectivity.	“Verifying Appliance Connectivity”
11	Enable subnet sharing	This prepares each appliance to share local subnets.	“Enabling Subnet Sharing”.
12	Create a tunnel on each appliance	Specify the local and remote endpoints for the tunnel.	“Creating Tunnels”.
13	Manually add Site A’s non-local subnets	Manually add subnets that aren’t directly connected to an appliance interface so they can be advertised.	“Configuring A1 and A2 to Advertise Non-Local Subnets”
14	Test the connectivity from both ends	Verify that the tunnel is up and that flows are being optimized.	“Verifying Traffic”

Collecting the Necessary Information

The example makes the following assumptions:

n	You’re not using DHCP.

n	Speed and duplex for all interfaces are left at the default, auto-negotiation.

n	Although it isn’t a requirement, it’s considered a best practice to use different subnets for mgmt0 and the Appliance IP.

Out-of-Path Deployment: Redundant Silver Peak Appliances peered with an L3 router using WCCP

Hostname	A1	A2	B
Mode	Router / Out-of-Path	Router / Out-of-Path	Bridge / In-Line
Admin Password: Old	admin	admin	admin
Admin Password: New / Confirm
Time Zone
NTP Server IP Address
License (for virtual appliance only)
mgmt1 IP Address / Mask	10.10.10.1/24	10.10.10.2/24	---
mgmt0 IP Address / Mask1	192.168.1.7/24	192.168.1.8/24	192.168.1.9/24
mgmt0 Next-hop IP Address	192.168.1.1	192.168.1.1	192.168.1.1
Appliance data path IP Address / Mask	10.110.31.100/24	10.110.31.101/24	10.110.11.100/24
Appliance data path Next-hop IP	10.110.31.1/24	10.110.31.1/24	10.110.11.1/24
LAN Next-hop IP Address (optional) 2	not applicable	not applicable	---
WCCP Service Groups for outbound redirection	53 (TCP) 54 (UDP)	53 (TCP) 54 (UDP	--- ---
WCCP Service Groups for inbound redirection	55 (TCP) 56 (UDP)	55 (TCP) 56 (UDP	--- ---
WCCP Weight (default)	100	200	not applicable

---

1

In this example, all mgmt0 IP addresses are in the same subnet. In your actual network, it’s likely that mgmt0 IP addresses are in different subnets.

2

LAN next-hop IP is only required when there are subnets for which the Silver Peak appliance does not have a configured IP address.

Please send comments or suggestions regarding user documentation to techpubs@silver-peak.com.