WAE-674 WCCP with 3725 router

Hello all,
This is a new install, I am trying to bring up a WAE-674 box at one my remote sites with 2 routers (a 3725 and a 2621) at this remote site and I am using WCCP for traffic redirection. I am having an issue with WCCP on the 3725 router, for some reason when I enable the command "IP wccp 62 redirect in" under the WAN serial interface I suddenly can no longer telnet to the fastethernet interface on the router but I can still ping it and still able to telnet to the loopback interface. And I have no issue with WCCP on the other 2621 router with the same config setup.
Has anyone run into this issue before ? I appreciate any feedbacks on this !!!!
I am running IOS version 12.3(14)T7 on the 3725 router and WAAS software version 4.1.1c
Thanks in advance !!
Danny

You will want to explore CSCsg30875 to see how it applies to your installation
CSCsg30875 wccp blocking telnet to router
Since 12.3T is EOL, it probably was not tested and may or may not exist in that Cisco IOS track.
End-of-Sale and End-of-Life Announcement for Cisco IOS Software Release 12.3T
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6947/ps5207/prod_bulletin0900aecd803a0ffe.html
Thank You,
Dan Laden

Similar Messages

L2 redirection between a 3750 and WAE 674 WCCP

hi
we are using a WAE 674 on a cisco 3750 in WCCP
WCCP is configured to use L2 redirection
but we saw this on the switch
Global WCCP information:
    Router information:
        Router Identifier:                   192.168.100.1
        Protocol Version:                    2.0
    Service Identifier: 61
        Number of Service Group Clients:     1
        Number of Service Group Routers:     1
        Total Packets s/w Redirected:        1
          Process:                           0
          CEF:                               1
        Redirect access-list:                -none-
        Total Packets Denied Redirect:       0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total Bypassed Packets Received:     0
    Service Identifier: 62
        Number of Service Group Clients:     1
        Number of Service Group Routers:     1
        Total Packets s/w Redirected:        11
          Process:                           0
          CEF:                               11
        Redirect access-list:                -none-
        Total Packets Denied Redirect:       0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total Bypassed Packets Received:     0
switch configuration
vlan 1 and 2 : data
vlan 3 routeurs
vlan 4 : WAE
interface Vlan1
ip address 10.0.0.1 255.255.0.0
ip wccp 61 redirect in
standby 0 preempt
standby 1 ip 10.0.0.6
standby 1 priority 150
standby 1 preempt
standby 1 name hsrp_vlan_1
interface Vlan2
ip address 10.1.0.1 255.255.0.0
ip wccp 61 redirect in
standby 2 ip 10.1.0.6
standby 2 priority 150
standby 2 preempt
standby 2 name hsrp_vlan_2
interface Vlan3
description Routage-FT
ip address 192.168.1.4 255.255.255.0
ip wccp 62 redirect in
standby 3 ip 192.168.1.6
standby 3 priority 150
standby 3 preempt
standby 3 name hsrp_vlan_3
interface Vlan4
description VLAN WCCP
ip address 192.168.100.1 255.255.255.0
WAE configuration
wccp router-list 8 192.168.100.1
wccp tcp-promiscuous mask src-ip-mask 0x1741 dst-ip-mask 0x0
wccp tcp-promiscuous router-list-num 8 l2-redirect mask-assign l2-return
wccp version 2

Hi,
This counter on the 3750 is a software counter, but all WCCP redirection should be happening in hardware. Thus, it is expected the number of redirected packets to be zero or very low. The proper way to tell if WCCP is redirecting traffic to your WAE is to issue the command "show wccp gre" on the WAE and look for the line "transparent non-GRE packets received."
Example:
pdi-7341-19#sh wccp gre
Transparent GRE packets received:              0
Transparent non-GRE packets received:          28887345
Transparent non-GRE non-WCCP packets received: 0
Total packets accepted:                        26012975
Invalid packets received:                      0
Packets received with invalid service:         0
Packets received on a disabled service:        0
Packets received too small:                    0
Packets dropped due to zero TTL:               0
----output omitted ------
Cheers,
Mike Korenbaum
Cisco WAAS PDI Help Desk
http://www.cisco.com/go/pdihelpdesk

WAE- 674 with EMC SRDF Traffic Question ?

Hi all,
I have a WAAS demo at a customer.
I have installed two WAE 674 boxes inline, at both ends of a 50mbps Metro Ethernet line between two EMC SANs. These EMC storages perform huge data replication during the day. All of the traffic is EMC SRDF traffic, nothing else.
Before putting the WAEs inline, the Metro line utilization had been around 49Mbps, ok so the WAN link was fully utilized. WAE 674s installed and bandwidth usage has dropped %12 percent, something around 44 Mbps.
EMC guys are telling me that, before WAAS, it used to take 7 hours to copy a 40GB data from one site to the other, with WAAS it came down to 1.5 hours. So yeah I know story is great so far.
What I dont understand is the attached graphics taken from CM, WAE1 and WAE2. All I see is %20 reduction in original traffic. Shouldnt this value be much greater than that ? Otherwise what could be the reason of having much shorter replication times compared to before ?
I have gone through couple of datasheets and marketing slides about WAEs and I have seen that with EMC replication traffic WAAS causes at least 2x optimization.
Both WAEs have default configs, so I havent customized anything in the SRDF classifier on WAAS.
I would really appreciate it, if some of you , can go through the screenshots that I attached and give me some thoughts and diretion to what value to customized and etc.
Thanks in advance.
Dumlu

You will want to explore CSCsg30875 to see how it applies to your installation
CSCsg30875 wccp blocking telnet to router
Since 12.3T is EOL, it probably was not tested and may or may not exist in that Cisco IOS track.
End-of-Sale and End-of-Life Announcement for Cisco IOS Software Release 12.3T
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6947/ps5207/prod_bulletin0900aecd803a0ffe.html
Thank You,
Dan Laden

WCCP problem or routing

Hi,
We have two datacenters same logical LAN.
Two ISP routers and two WAE 674 and using WCCP "egress-method negotiated-return intercept-method wccp"
See attached file.
The problem is when one of the "line" WAN interface goes down, some of the network are not reach from the LAN side and some are.
We are using BGP as routing protocol in the ISP routers.
Any suggestion for the problem?
Jan

Hello I am from the ISP and wanted to address these issues
2. When WAN goes down and LAN remains up, your WCCP is still UP and hence, it continues to forward packets out of same WAN interface but because that interface is down, packets ultimately die / gets blackholed.
3. Another speculation is: Asymmetric routing. When WAN is down but LAN is up, you are forwarding soem traffic out of LAN but as WAN goes down, the return packets then come up on different interface and creates asymmetric routing.
On question 2 with WCCP the router would still try to send packets out the wan interface even though its down?   Wouldn't the router be able to tell that routing changed to the source/dest subnets and not blindly send packets to a down interface?   If not then this most likely is what happened.
Here is the WAN interface config WCCP is enabled for inbound redirection but the same for the actual data LAN interface
interface GigabitEthernet0/0
description link to PE
bandwidth 9000
no ip address
ip route-cache flow
duplex full
speed 10
media-type rj45
no cdp enable
interface GigabitEthernet0/0.22
encapsulation dot1Q 22
ip address **********omit ****** 255.255.255.252
ip wccp 62 redirect in
no cdp enable
and here is the LAN side
interface GigabitEthernet0/1
no ip address
ip access-group 113 in
ip route-cache flow
duplex full
speed 100
media-type rj45
service-policy output CE_OUT_MARK_0
interface GigabitEthernet0/1.2450
description Customer LAN
encapsulation dot1Q 2450
ip address ********* 255.255.255.224
ip wccp 61 redirect in
no cdp enable
interface GigabitEthernet0/1.2459
description Connection to customer-managed WAE Device For WCCP
encapsulation dot1Q 2459
ip address ******** 255.255.255.224
ip wccp redirect exclude in
no cdp enable
interface GigabitEthernet0/1.2460
encapsulation dot1Q 2460
ip address ******* 255.255.255.224
ip wccp redirect exclude in
no cdp enable
The sister router is configured in much the same way.
On question 3
3. Another speculation is: Asymmetric routing. When WAN is down but LAN is up, you are forwarding soem traffic out of LAN but as WAN goes down, the return packets then come up on different interface and creates asymmetric routing.
Wouldn't Asymetric routing just result in non optimized connections as it would never see the tcp option set for optimization?
We are going to run this same test this weekend and I will look at all these things but it seems as though asymetric routing would result in no optimization but not packet blockage.   Regarding question 2 if wccp remains up and is black holing traffic I can see this as an issue for sure.
One last question also regarding the loopbacks and GRE return. There are distribute lists that block each router from learning the others loopback when the WAN is down.   Do you think this would matter?    Reason I ask is because on the Asymetric side again lets say a packet comes into router #1 via the lan and gets redirected to the WAE with source ip of the Loopback.   When the Was returns the packet to the router I would think it would not need routing to the #2 routers loopback as the destination at this point would be back to the client/server.   Also when the router forwards to the WAE what ip on the WAE does it use?

Can WAE be integrated with non-cisco devices?

So far, all documentation that I read, WAE is used in conjunction with Cisco devices. Can WAE be integrated with non-cisco devices?
I guess, In-line mode should work ok, but how about off-path mode? An example or link will be appreciated.
Thanks!
Joe

Hi Joe,
It should be possible to use WAAS with non-cisco routers, as long as they support WCCP.
There are no documents on this because, the configuration from WAAS point of view would be the same, and the router configuration would depend on the vendor.
Regards
Daniel

WCCP with 3560

I have configured a 3560 (122-44 IP Services) switch to communicate WCCP with an WAE-612 v4.1. However the devices don't form WCCP server-client relation with each other.
When I enable "debug wccp all" on the WAE: It complains with:
"2008 Sep 17 13:54:49 CCI-WC-NC-01 wccp: %WAAS-DDBG-7-899998: ISU assignment capability 2
2008 Sep 17 13:54:49 CCI-WC-NC-01 wccp: %WAAS-DDBG-7-899998: wccp2.c:3169:
2008 Sep 17 13:54:49 CCI-WC-NC-01 wccp: %WAAS-DDBG-7-899998: Router cannot support configured capability for assignment method."
WAE-612 is directly connected to the switch through a vlan. I tried GRE and L2 forwarding methods.

the wae config and wccp output:
CCI-WC-NC-01#sh run | i wccp
wccp router-list 8 192.168.192.33
wccp tcp-promiscuous router-list-num 8 l2-redirect assign-method-strict l2-return
wccp version 2
CCI-WC-NC-01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(0)
-NONE-
Routers not Seeing this Wide Area Engine
192.168.192.33
Routers Notified of but not Configured
-NONE-
Multicast Addresses Configured
-NONE-
Router Information for Service: TCP Promiscuous 62
Routers Configured and Seeing this Wide Area Engine(0)
-NONE-
Routers not Seeing this Wide Area Engine
192.168.192.33
Routers Notified of but not Configured
-NONE-
Multicast Addresses Configured
-NONE-
3560 config and wccp outputs:
CCI-SW-NC-BB-01#sh run | i ip wccp
ip wccp 61 redirect-list 101
ip wccp 62 redirect-list 102
CCI-SW-NC-BB-01#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: 192.168.192.254
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 0
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
CEF: 0
Redirect access-list: 101
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
Service Identifier: 62
Number of Service Group Clients: 0
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
CEF: 0
Redirect access-list: 102
Total Packets Denied Redirect: 0
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
thanks

WAE 674 Disk based software not installed.

Hi,
Have an WAE 674 with 4.4.3c installed, with problem.
Using WCCP and I am able to logon to the device.
Have this msg and in in the CM it is down.
System Initialization Finished.
Disk based software not installed.
Some applications may not run correctly!
Any sugestion?
I have reload still problem.
Regards Jan Rockstedt

What steps did you take to resolve the issue? I have the same issue on WAVE 594 running 4.4.5.
I get the error message when I telnet into device.

WAE-674 running 5.1.1.d code

WAE-674 running 5.1.1.d code. The WAE-674 stops working until a reboot or move to another switch port. Are there any known connectivity issues?

Does the switch show any errors on the port before it stops communicating? "Show Logg" on switch to see if it is giving any errors. Are you using WCCP or inline for communication? Is it the management port (WCCP port) or the inline port that is losing communication? I was on 5.1.1c with no issues before I went to 5.3.1, never went to 5.1.1d
If you think it is a version issue, do a quick upgrade to see if it resolves the issue. It is already unreliably bouncing, an upgrade will not hurt any more. Or, even a downgrade to what you were running before 5.1.1.d. Did the issue begin right after you upgraded to 5.1.1.d? Is that why you believe it is the code version causing the issue?

WAE 674 multipurpose

HI there,
I have configured Cisco WAE 674 as Content Engine conntected with Websense Server for filtering.Can I use the same device also as WAAS and configure WCCP ?
thanks a lot!

Hi ,
Yes you can use the 674 as either WAAS device or content engine. To do this you need to use the CD recovery procedure in formating the flash,disk and installing the WAAS IOS image.
If you have WAAS recovery CD then run these steps:
2,3,5,7,8, remove the CD from the CD Drive and 9
Regards,
Bala

WAE and WCCP mismatch

Hello,
I seem to be having a lot of trouble with a very simple implementation. I have 2 routers and a data centre WAE via WCCP. These devices are on the same L2/L3 segment (x.x.x.0/24). The WAN interfaces on the routers are in different networks. The remote WAE is inline. I configured ip wccp 61 redirect in on the LAN interface of each router and ip wccp 62 redirect in on the WAN interface of each router. I get the alarm "WCCP router x.x.x.1(LAN) unusable for service id:61 reason redirection mismatch with router" and "WCCP router x.x.x.1(LAN) unusable for service id:62 reason redirection mismatch with router". For the WAN interfaces I get the alarm they are unreachable for the service ID.
Snadard router config
ip wccp version 2
ip wccp 61
ip wccp 62
int gi0/0
description LAN
ip address x.x.x.1
ip wccp 61 redirect in
int gi0/1
description WAN
ip address y.y.y.1
ip wccp 62 redirect in
Should I only be trapping inbound traffic on the LAN interface ?
The other thing I noticed was these messages from the PIX on the same L2/L3 segment
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER1/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER2/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER1/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER2/2048 on interface outside
Access list
access-list outside_access_in extended permit udp host WADMZJA02 host IROUTER1 log notifications
access-list outside_access_in extended permit udp host WADMZJA02 host IROUTER2 log notifications
access-list outside_access_in extended permit udp host IROUTER1 host WADMZJA02 log notifications
access-list outside_access_in extended permit udp host IROUTER2 host WADMZJA02 log notifications
Best regards
Stephen
WAE config
sh run
2011 Dec 20 07:06:27 WADMZJA02 -admin-shell: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: sh run
! waas-universal-k9 version 4.3.1 (build b6 Nov 13 2010)
device mode application-accelerator
hostname WADMZJA02
clock timezone Europe/Brussels 1 0
ip domain-name fibe.fortis
primary-interface GigabitEthernet 1/0
interface GigabitEthernet 1/0
ip address x.x.x.248 255.255.255.0
exit
interface GigabitEthernet 2/0
shutdown
exit
ip default-gateway x.x.x.4 <== firewall
no auto-register enable
! ip path-mtu-discovery is disabled in WAAS by default
! <== traffic to be rerouted outbound ==>
ip route a.a.a.0 255.255.255.0 x.x.x.1 <== Outbound HSRP
ip access-list extended HK
permit ip any 0.0.0.0 255.255.255.0
exit
logging console enable
logging console priority debug
interception access-list HKWAAS
wccp router-list 1 z.z.z.202 y.y.y.122 x.x.x.1 x.x.x.2 x.x.x.3
wccp tcp-promiscuous router-list-num 1 hash-source-ip hash-destination-ip l2-redirect l2-return
wccp version 2
egress-method negotiated-return intercept-method wccp
ip icmp rate-limit unreachable df 0
directed-mode enable
transaction-logs flow enable
--More--
! [K
inetd enable rcp
sshd allow-non-admin-users
sshd enable
tfo tcp optimized-send-buffer 2048
tfo tcp optimized-receive-buffer 2048
accelerator http metadatacache enable
accelerator http metadatacache https enable
accelerator http dre-hints enable
central-manager address x.x.x.247
cms enable
! End of WAAS configuration

Hi Stephen,
The "Redirection mismatch" messages indicate that the redirection or return method configured on the WAE is not compatible with the router. Probably, the routers you are using don't support L2 redirection
Moving forward, I would recommend you to change the line "wccp tcp-promiscuous router-list-num 1 hash-source-ip hash-destination-ip l2-redirect l2-return" for "wccp tcp-promiscuous router-list-num 1". This will negotiate hash assignment, as well as GRE redirection and return, which are the parameters supported by most platforms.
As for the firewall messages, it seems that some WCCP negotiation packets (UDP port 2048) are being dropped. Unfortunately, my firewall knowledge is very limited, so I cannot really help you with that part.
Regards
Daniel

WAE 674 booting issues

I am having issues with my WAE 674.
Powered on for the first time and was hanging at the booting the kernel screen.
Then used the software recovery CD waas-rescue-cdrom-4.4.1.12-npe-k9.iso, it went through all the steps of installation.
After reboot it hangs at booting the kernel, it does not move from this point. Nothing on the hyperterminal.
I have attached the screenshot.
Any ideas?
Thanks,
Suhail.

Hi Suhail,
How are you connected to the WAE?
If you are directly connected to the WAE through a screen/keyboard, I believe that what you see is expected: the WAAS software stop redirecting it's console output on the screen after booting it's kernel and move it to the serial port.
This is explained in the hardware specs of your device:
You can connect a keyboard to any USB port and connect a monitor to the video connector to troubleshoot the BIOS boot process. However, video output is for troubleshooting only during the BIOS boot process. The video output stops displaying when the serial port becomes active. To monitor the boot process in normal operation, use the serial console port.
http://www.cisco.com/en/US/partner/docs/app_ntwk_services/waas/wae/installation/7341-7371/guide/7300intr.html#wp1040565
Could you have a look at the boot sequence from the serial port and see if everything looks fine from there?
Regards,
Nicolas

Cisco WAAS WAE-674 - Slow response in IE-7 PC's while trying to access the SAP application through cisco WEA

Hi,
From location A when we are trying to access the SAP application in location B through WAE-674 via internet Explorer there is a slow response in IE-7 PC's compare to IE-8 PC's,But when we try without WAE-674 the response is normal.
We also found that optimization in location A WAAS device as 70-90% but still users are facing slowness while opening the Webpage.
Please suggest how to address the problem ASAP.
Thanks & Regards,
P.Ramkumar

I would suggest that you open a case with the tac to look at this. Matthew

WAE 674 Max TCP Connections

Does anyone know how many TCP connections the 674 will support with various memory options?
TIA
mike

Mike,
The WAE-674 will support the following memory/connection options:
4GB = 2,000 Connections
8GB = 6,000 Connections
Regards,
Zach

WAE-674 as a Content Engine

Dear All Experties,
We are using a Cisco Content engine 7325 as a proxy server.recently we brough WAE-674 as a replacement of these old content engine.After turn on WAE-674,Blue screen pop up on moniter.I am not able to access anything with GUI as well through command line.That why i am not able to configure that one.
Please advise me if anybody else also faced this problem or if anybody have any idea what i can do ???
Thanks in advance

Hi,
How are you connected to the WAE?
If you are directly connected to the WAE through a screen/keyboard, what you see might be expected: the WAAS/ACNS software stop redirecting it's console output on the screen after booting it's kernel and move it to the serial port.
This is explained in the hardware specs of your device:
You can connect a keyboard to any USB port and connect a monitor to the video connector to troubleshoot the BIOS boot process. However, video output is for troubleshooting only during the BIOS boot process. The video output stops displaying when the serial port becomes active. To monitor the boot process in normal operation, use the serial console port.
http://www.cisco.com/en/US/partner/docs/app_ntwk_services/waas/wae/installation/7341-7371/guide/7300intr.html#wp1040565
Could you have a look at the boot sequence from the serial port and see if everything looks fine from there?
Regards,
Nicolas

NME-WAE-502 wccp config example?

I have a branch deployed with an appliance using WCCP and I just purchased a module for a smaller site. I am having trouble equating my appliance wccp config over to the module. Read all the white papers but I am missing something really simple.
In the appliance deployment I have a subinterface on my router with a dedicated segment for the appliance (lets say .1 on the router and .5 on the appliance)
On the module I am not able to give the IN 1/0 interface an IP on the same segment as my subinterface, hence my confusion. none of the documents I have read really address the config to that level of detail (IP schemes)
I have given the module a dummy IP and its configured other than the fact that im not sure how to IP it vs the router to get the traffic to flow properly.
a config example would be greatly appreciated.
Thanks,
-Scott

Here is the router using wccp with the appliance, see if this looks okay.
ip wccp 61 redirect-list 111
ip wccp 62 redirect-list 111
interface Multilink1
bandwidth 3072
ip address x.x.x.x 255.255.255.252
ip wccp 62 redirect in
no peer neighbor-route
ppp chap hostname p1672490-1810058
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
service-policy output wanQOS
interface GigabitEthernet0/0
description DATA
ip address 10.75.121.3 255.255.255.0
ip helper-address 10.60.6.119
ip wccp 61 redirect in
ip flow ingress
duplex auto
speed auto
standby 0 ip 10.75.121.1
standby 0 priority 110
standby 0 preempt
interface GigabitEthernet0/0.74
description waas
encapsulation dot1Q 74
ip address 10.74.121.2 255.255.255.0
ip helper-address 10.60.6.119
ip wccp redirect exclude in
ip flow ingress
standby 0 ip 10.74.121.1
standby 0 priority 110
standby 0 preempt
interface GigabitEthernet0/0.76
description VOICE
encapsulation dot1Q 76
ip address 10.76.121.3 255.255.255.0
ip helper-address 10.60.6.119
ip wccp redirect exclude in
ip flow ingress
standby 0 ip 10.76.121.1
standby 0 priority 110
standby 0 preempt
access-list 111 deny ip 10.60.200.0 0.0.0.255 any <--callmanager segment
access-list 111 deny ip 10.76.0.0 0.0.255.255 any
access-list 111 permit ip any any

WAE-674 WCCP with 3725 router

Similar Messages

Maybe you are looking for