Recommended WCCPv2 Configuration for WAE

Question

Hi Sir,
I have a Catalyst 6509 with redundant Supervisor Engine 720 in a data center. It is hybrid mode (i.e. CatOS and MSFC IOS).
It's connected to an edge WAN router connecting to branch offices. I'm implementing a WAE at the data center to optimize TCP traffic between the various server farms in the data center and the branch offices.
The WAE is L2 adjacent to the Catalyst 6509. The WCCPv2 config of the C6509 is as follows:
ip wccp version 2
ip wccp 61
ip wccp 62
int vla 100
description *** Connection to WAN Router to Branch Offices ***
ip address 172.16.100.1 255.255.255.0
ip wccp 61 redirect out
ip wccp 62 redirect in
int vla 200
description *** Connection to Data Center WAE (L2 adjacent) ***
ip address 172.16.200.1 255.255.255.0
ip wccp redirect exclude in
int vla 10
description *** Server Farm 1 ***
ip address 172.16.10.1 255.255.255.0
int vla 20
description *** Server Farm 2 ***
ip address 172.16.20.1 255.255.255.0
int vla 30
description *** Server Farm 3 ***
ip address 172.16.30.1 255.255.255.0
int vla 40
description *** Server Farm 4 ***
ip address 172.16.40.1 255.255.255.0
router ospf 1
netw 172.16.0.0 0.0.255.255 ar 0
Because it is not known which server farm the remote users need to access to, I do not want to apply inbound redirection on the server farm interfaces. Instead, I'm doing both inbound and outbound redirection on the interface connecting to the edge WAN router. Is my config valid and recommended for production environment?
I came across a note that says:
*** Setting outbound redirection on Cat6k/76xx may lead to 100% CPU on the switch ***
Can anyone verify the above statement?
Thank you.
B.Rgds,
Lim TS

Answer 1

Hi Zach,
My WAE deployment yesterday wasn't a successful one. After I enabled interception on the Cat6509 and the remote WCCP router, I could ping to remote hosts but they could not access to Internet (i.e. TCP apps fail).
I understand this is one of the common issues of misconfiguration of network interception which can lead to traffic being "black-holed", i.e. distant devices are pingable, but no application traffic can pass.
The traffic redirection at data center to its local WAE seems not working fine. I suspect bugs because the current MSFC IOS version [12.2(17d)SXB6] does not meet minimum recommended version for WCCP [12.2(18)SXF5].
In my scenario, I'd like to only optimize traffic between remote segments (e.g. 172.16.90.0/24 & 172.16.91.0/24) and the data center. So I use redirect-list on the Cat6509 as follows:
Data Center Cat6509
ip access-list extended WAAS_ACL
permit ip any 172.16.90.0 0.0.0.255
permit ip 172.16.90.0 0.0.0.255 any
permit ip any 172.16.91.0 0.0.0.255
permit ip 172.16.91.0 0.0.0.255 any
ip wccp 61 redirect-list WAAS_ACL
ip wccp 62 redirect-list WAAS_ACL
int vla 100
description *** Connection to WAN Router to Branch Offices ***
ip wccp 61 redirect out
ip wccp 62 redirect in
int vla 200
description *** Connection to Data Center WAE (L2 adjacent) ***
ip address 172.16.200.1 255.255.255.0
ip wccp redirect exclude in
Data Center WAE
ip default-gateway 172.16.200.1
wccp router-list 1 172.16.200.1
wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign
wccp version 2
Am I running into Bug ID CSCsh98343? I don't fully understand the workaround. Can you kindly help me?
Thank you.
B.Rgds,
Lim TS