WCCP suppport with CatOS

I am beginning an implementation of a 7305 content engine. There are 2 6509's running CatOS. Does CatOS support WCCP? Is there a specific version of CatOS I need to run?
Thank you in advance
Mike

Mike,
WCCP is an IOS feature; although some work has been done to perform hardware forwarding of WCCP redirected traffic in the 6500/7600 platforms. More information is available here:
http://www.cisco.com/warp/public/732/Tech/switching/wccp/docs/WCCP_Implementation.pdf
So ... if you don't have a MSFC in your 6509's, they won't interfere with WCCP. If you do have a MSFC, you can use it to switch your WCCP redirected traffic in the hardware path.
~Zach

Similar Messages

Telnet problem of Cat6509 with CatOS 6.4 (8)

When telnet to a Catalyst 6509 with CatOS 6.4 (8), first nothing appeared, then press enter, showed the screen with 2 "Enter pasword:". This behavior prevent Cisco works from updating configuration to these devices. Does anyone have the idea how to resolve this problem?
Thak you in advance.

Take a look at the following bug
http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCed45576
You will need to upgrade CAT OS to get past this bug.

AAA with CatOS and ACS (shell command autorization set)

Hi,
I have an ACS that authenticates and authorizes IOS devices.
I use "shell command autorization set" to authorize some commands for some groups.
Is it possible to do so with CatOS?
For example, I'd like that the groupe FULL can access all command and the group LOW can onmy access "sho" commands?
Regards,
ROMS

Console> (enable) set tacacs server [IP] [primary]
set tacacs key [key]
set tacacs attempts [number] (optional)
set localuser user [user] password [password] privilege 15
set authentication login local enable
set authentication login tacacs enable [all | console | http | telnet] [primary]
set authorization exec enable tacacs+ [deny | none] [console | telnet | both]
set authorization commands enable [config | all] tacacs+ [deny | none] [console |telnet | both]
regards,
~JG

Compatibility of WS-X6148-RJ-21 with CATOS 6.4(4A)

Hi All,
I've few Cat6509 running with WS-X6K-SUP1A-2GE and WS-X6248A-TEL. I've purchase the WS-X6148-RJ-21 to replace the EOL WS-X6248A-TEL. However, I'm not sure is WS-X6148-RJ-21 compatible with Sup1A and CATOS 6.4(4A) Kindly advise.
Thanks

According to below release note. The 6148-RJ21 min. CatOS is 6.4(1) and recommeded 6.4(11). However, you also need to determine the PoE support in this module is Cisco pre-standard PoE ot 802.3af.
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/relnotes/78_11235.htm
And the other way is to use software advisor from Cisco that can tell the software requirement of particular hardware. Or use configuration tool to setup the whole system and verify the compatibility between modules, sup, CatOS, etc.
You can search Cisco web for these kind of information.
Hope this helps.

WCCP Deployment with VSS

I am looking at deploying a redundant, load balancing WAAS solution at a Data Center.
Hardware:
2 x 694 WAE's Application Accelerators
1 x 294 WAE Central Manager
2 x 6506 Catalyst core switches running VSS
2 x 3925 ISR WAN routers connecting to seperate WAN clouds.
We will not be using AppNav thus I will use WCCP to provide high availability and load sharing.
I have some basic questions for the Application Accelerators:
- Which interfaces do a patch to the switches? I assume I do not use the inline ports for a WCCP deployment?
- Can the Gi0/0 and Gi0/1 interfaces be in a port-channel?
- Which WCCP pack-forwarding method would be recommended with my hardware?
- Which egress method would be recommended?
Any assistanace is appreciated.

based on you setup, and considering 6500 doing redirection rather than routers (we can also build setup where router will act as WCCP server and take role of traffic redirection, and 6500 is only used a L2 media between router and WAE), belows is the best recommendation for 6500---
assignement method----mask (reduce it from default value to satisfy our need and save TCAM resource)
redirection--GRE
Egress---generic GRE
interception--in direction (61in ,62 in)
Abve combination will fully supported in H/w.
And yes gig0/1 and gi0/0 can be configured as etherchannel
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_c11-629052.pdf for more detail

Cisco ASA not returning traffic when wccp peering with Bluecoat.

Experts,
My setup has a Cisco ASA where we are doing wccp with a Bluecoat SG box. The traffic gets redirected to the Bluecoat due to the wccp settings so it's just transparent to the end users. Theye do not have to do any manual proxy settings in their IE.
We however notice that somehow the ASA does not return these connection back to the requesting hosts and somehere the connection table breaks. The message we see on the ASA that state table is somehow not being maintained. Any idea where this connection must be breaking?
Regards,
Nikhil Kulkarni.

Nikhil,
Let me give you a little bit of backgrounf in regards to WCCP that can help you. As you stated the ASA will do transparent redirection, so the client doesn't have to configure anything on the PC.
The traffic will get to the ASA (port 80/443 or any configured port) and then the ASA will establish a GRE tunnel with WCCP server and will redirect the traffic. After the Bluecoat receives the traffic it will "spoof" the IP address of the requested web page (the WCCP server needs to have direct comunication with the client PC without passing through the ASA). I have seen some issues where the ASA and the WCCP server are unable to establish the GRE tunnel becuase the ASA uses the highest IP address as the router ID and uses this IP address to establish the tunnel. The WCCP keepalives (Here I am, I see you) are sent using the IP address of the closest IP address to the WCCP server.
At this point you may turn on the WCCP debugs and run some "show WCCP" commands.
I hope it helps
Luis Silva

WCCP Multicast with 6500

I have two 6500s (6509-1 and 6509-2)and two WAE-674 devices. I am trying to configure these devices in a redundant way. However the WAEs form wccp relation only with the 6509-2.
6509-2#sh ip wccp 61 detail
WCCP Cache-Engine information:
Web Cache ID: 172.27.249.65
Protocol Version: 2.0
State: Usable
Redirection: GRE
Packet Return: GRE
Assignment: HASH
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
00000000000000000000000000000000
Hash Allotment: 128 (50.00%)
Packets Redirected: 0
Connect Time: 00:36:19
Web Cache ID: 172.27.249.66
Protocol Version: 2.0
State: Usable
Redirection: GRE
Packet Return: GRE
Assignment: HASH
Initial Hash Info: 00000000000000000000000000000000
00000000000000000000000000000000
Assigned Hash Info: 00000000000000000000000000000000
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Hash Allotment: 128 (50.00%)
Packets Redirected: 0
Connect Time: 00:36:18
however on the 6509-1
6509-1#sh ip wccp 61 detail
WCCP Cache-Engine information:
Web Cache ID: 172.27.249.66
Protocol Version: 2.0
State: NOT Usable
Redirection: L2
Packet Return: L2
Packets Redirected: 0
Connect Time: 01:17:18
Assignment: MASK
Web Cache ID: 172.27.249.65
Protocol Version: 2.0
State: NOT Usable
Redirection: L2
Packet Return: L2
Packets Redirected: 0
Connect Time: 00:00:15
Assignment: MASK
Redirection (L2 on 6509-1 and GRE on the 6509-2) methods are shown differently on the 6500 switches.
However the configurations on the WAE side is same:
HOAE1674#sh run
<outputs omitted>
primary-interface Standby 1
interface Standby 1
ip address 172.27.249.65 255.255.255.240
exit
interface GigabitEthernet 1/0
standby 1 priority 250
exit
interface GigabitEthernet 2/0
standby 1
exit
ip default-gateway 172.27.249.78
<outputs omitted>
wccp router-list 1 224.10.10.10
wccp tcp-promiscuous router-list-num 1
wccp version 2
And the 6500 configurations:
6509-2#sh run int vlan 311
interface Vlan311
description WAAS-Normal
ip address 172.27.249.77 255.255.255.240
ip wccp 61 group-listen
ip wccp 62 group-listen
ip pim dense-mode
standby 211 ip 172.27.249.78
6509-2#sh run | i redire
ip wccp 61 group-address 224.10.10.10 redirect-list 101
ip wccp 62 group-address 224.10.10.10 redirect-list 102
I know that L2-redirection and masking advised on the 6500s, however when I configure, 6500 sh ip wccp output shows that GRE masking is used.
The WAE devices are connected directly to the 6509-2, I suspected a multicast issue, to test I shutdown the 6509-2 vlan interface but no help
The version on the 6500s are same (12.2SXF8), as I know that 12.2SXF14 is suggested. However a software upgrade requires a lot of change management procedures. I want to be sure that I did not make a configuration mistake.

Thanks Dan, Matthew
After I remove l2-return, wccp seems to be ok:
HOAE1674#sh run | i wccp
wccp router-list 1 224.10.10.10
wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign
wccp version 2
6509-1#sh ip wccp 61
Global WCCP information:
Router information:
Router Identifier: 192.168.2.253
Protocol Version: 2.0
Service Identifier: 61
Number of Cache Engines: 2
Number of routers: 2
Total Packets Redirected: 0
Redirect access-list: 101
Total Packets Denied Redirect: 13843
Total Packets Unassigned: 0
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
6509-1#sh ip wccp 61 de
WCCP Cache-Engine information:
Web Cache ID: 172.27.249.66
Protocol Version: 2.0
State: Usable
Redirection: L2
Packet Return: GRE
Packets Redirected: 0
Connect Time: 01:32:23
Assignment: MASK
Mask SrcAddr DstAddr SrcPort DstPort
0000: 0x00001741 0x00000000 0x0000 0x0000
Value SrcAddr DstAddr SrcPort DstPort CE-IP
0032: 0x00001000 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0033: 0x00001001 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0034: 0x00001040 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0035: 0x00001041 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0036: 0x00001100 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0037: 0x00001101 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
0038: 0x00001140 0x00000000 0x0000 0x0000 0xAC1BF942 (172.27.249.66)
Now I am trying to redirect packets over the these appliances.
However TCP connections could not be established between redireced subnets. I can sniff that packet is forwarded to the WAAS but it did not send a respond. I saw that bad bucket error are incrementing when I try new connections.
HOAE1674#sh wccp gre | i buckets
Packets dropped due to bad buckets: 516
regards,
Bulent

Catalyst 6500 with CatOS ISCSI

Hi, I'm configuring a Catalyst 6500 with for ISCSI.
Following the recommendations I have to configure: portfast, jumbo frames, flow control and disable unicast storm control
- Portfast: on the server and ISCSI SAN ports
>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Tabla normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
set spantree portfast
- Jumbo frames: Set port jumbo
- Flow Control:
> set port flow control receive desired
Questions:
1. Where I have to configure flow control? only on the SAN ports and NIC servers? or server ports too?
2. Unicast Storm control: how can i configure this option?
Thanks

We are having the same exact problem. We've done what you've tried with no luck also. Strange thing is that in another building we have the same setup but only with a 6148V blade and that Tandberg has no issues. We're using a 6148AF with the one we're having problems with. We've tried with a 6348 blade and it works fine. I'm thinking it's something with the 6148AF firmware (ver. 8.2(2)).
Were you able to solve your problem?

Problem with VPN by ASA 5505 and PIX 501

Hi
I have this scenario: Firewall ASA 5505, Firewall Pix 501 (with CatOS 6.3(5) ).
I have configured this appliance for Easy VPN (server is ASA) and PIX, and remote Access with Cisco client vpn (for internal lan ASA).
When i configure the ASA i have this problem, when i configure nat for easy vpn.
This is my nat configuration:
nat (inside) 0 access-list 100
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
nat (inside) 0 0.0.0.0 0.0.0.0 outside
when i put this command:
nat (inside) 0 access-list no-nat
this command is necessary for configuration of easy vpn, but the previous nat:
nat (inside) 0 access-list 100
is replace with the latest command.

To identify addresses on one interface that are translated to mapped addresses on another interface, use the nat command in global configuration mode. This command configures dynamic NAT or PAT, where an address is translated to one of a pool of mapped addresses. To remove the nat command, use the no form of this command.
For regular dynamic NAT:
nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
no nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
For policy dynamic NAT and NAT exemption:
nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]
no nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]

Reoccurring problem with email.

Anyone else having trouble sending emails? Incoming is not a problem.

For about a week, none of my outgoing emails from my Eudora email client have been going through. I can send from Eudora and it looks like everything is going through but then none of the messages are received in the destination inboxes. This seems to have been happening for more than a week, but it could have been happening longer. The problem is that when I send a message to my comcast email I see it in my online email portal, in the spam folder. It does not go to the inbox and I cannot download it to my email client with all of my other emails. Additionally, when I send an email to any other address - I have 3 other email addresses that I tested this with - none of those emails arrive in those inboxes when I send from my email client. This problem is not my settings as I am already using smtp port 587 - I went online and found all the help and how to set up email pages and I am able to receive email fine, it is the sending that is the problem. I use this email for businesses purposes and it is imperative that the issue be corrected immediately. A support ticket has already been created (when I called, the technician acknowledged that it looked like there was a problem on the server side), however today I received 2 emails from Comcast suppport with links to 'how to set up email' pages and this is not the problem. I have been using Comcast email for many years and do not need a primer on email basics. Friends who use Comcast are also experiencing the same problem so it is not an isolated situation. Any help in getting this resolved ASAP would be greatly appreciated. Thanks!

WSA redundancy and WCCP questions

Hello! My customer bought a pair of S370 WSA prior to deployment planning. I need to deploy both of them into existing network and I'd like to ask few questions with somebody who knows how to do it.
1. As I know from manuals, WSA doesn't support any clustering but I'd like to use both of my S370 for redundancy. I'm planning to use WCCP only, no explicit proxy mode will be used. What methods can I use to deploy redundant WCCP cache on pair of WSA? If it possible, I'd prefer to use something like Active\Passive but not load balancing scheme. Does it have Centralized management feature like ESA to share configs between devices?
2. I have fusion router which "mixes" traffic from different vrf. Is it possible to configure router such way that every vrf(which corresponds every interface and different subnets) will be seen with its own ip address in internet or all of them will be using just WSA's address like in explicit proxy mode?
3. When I tried to test my WSA in explicit proxy mode prior to configuring WCCP, I found out that I can use it as a proxy without any authentication, just setting it's address and port in my browser. How can I disable explicit proxy mode or set any authentication(no LDAP or NTLM) to prevent unauthorized access to using my proxy?
I'm newbie with IronPorts so I will appreciate any help including links to manuals

The WCCP protocol allows for automatic detection of all connected devices, both proxies and routers/firewalls/switches. When configuring WCCP with multiple WSAs, they're all in the WCCP cluster, with the router doing the load balancing beween the detected proxies. From what I've seen, you can't configure an active/passive scenario.
As you mentioned , WSAs don't support clustering seen in ESAs. You could use a M-series box to provide central management and reporting for multiple WSAs in your enviromment.
Regarding VRFs: WSAs support IP spoofing, which allows you to send out requests with the client's instead of WSA's external address. You could perform PAT of multiple addresses on the edge router/firewall to send the requests out with a different IP address for each VRF for example.
I don't think you can fully disable the explicit proxy on the WSA. You can set up a firewall rule to prevent direct client access to the proxy ports..
Sent from Cisco Technical Support iPad App

C3750 & WCCP redirection

Hi all,
I am trying to setup a web cache using a WAE-612 and a C3750 switch. The switch is configured with three interfaces:
CLIENTS ----- VLAN 1 ----- SWITCH ----- GI1/0/1 routed ---- SERVER(s)
        WAE-ENGINE ---- VLAN2--|
I have configured inbound redirection on vlan 1 and inbound redirection on gi1/0/1
ip wccp web-cache redirect in
I am using L2 redirect & L2 return & my state is "enabled":
Switch#show ip wccp web-cache detail
WCCP Client information:
        WCCP Client ID:          10.101.2.202
        Protocol Version:        2.0
        State:                   Usable
        Redirection:             L2
        Packet Return:           L2
        Packets Redirected:    0
        Connect Time:          02:24:08
        Assignment:            MASK
First, the "packets redirected" counter doesn't increment, is this normal (maybe due to hardware redirection ?)
Second, i am seeing HTTP GET requests from my clients going to my WAE-engine and i am also seeing the WAE-engine sending them back to the switch (changed mac address, L2 redirection)
Third, my cache savings are 0 %
Fourth, i don't see any traffic returning into the WAE-engine. How can the WAE cache traffic if he never sees the server return traffic ?
Fifth, i have "spoof client ip" enabled on the WAE (need this for security reasons, web server verifies source ip address)
Now i am thinking it is logical that my cache savings are 0% . The web-cache service group redirects port 80 packets and the switch supports only "inbound" direction. This means that the switches never redirects the ANSWER of the server,so how on earth can it ever "cache" the response ?
Am i correct or am i wrong ? How to solve it ?
Should i use different WCCP service groups on the interfaces (for example: based on source ip redirection, the other on destination ip redirection)
PS. I am running 12.2(44)SE6 on the switch and 5.5.9.B9 on the WAE
regards,
Geert

Hi Geert,
With L2 redirection 'packets redirected' counter won't increment since its Hardware redirection. You might want to
check on WAE counter 'Transparent non-GRE packets received:' by running 'show wccp gre'
With wccp ip-spoofing enabled, requests will be sent to web server with Clients IP address. So yes you will need
to configure WCCP to catch return traffic coming from web server to be redirected to WAE.
To redirect return traffic you will need to configure WCCP Dynamic Service group ,
By default web-cache service will Mask on Destination address. Since we need to make sure return traffic is sent to
same WAE as forwarding traffic, we need to Mask return traffic on Source IP address.
This will config Service group 95 and it will Mask on Source IP which will be Webservers IP address
wccp service-number 95 mask src-ip-mask 0x1741 dst-ip-mask 0x0
wccp service-number 95 router-list-num 1 port-list-num 1 application cache l2-redirect mask-assign l2-return
wccp version 2
wccp spoof-client-ip enable
You will then need to enable 'ip wccp 95 redirect in' on the WAN interface.
Hope this helps,
Best Regards,
Rahul

WCCP load balancing

If I have the below settings:
Site model: regional hub / data center
Number of WAE: 4 (e.g. 7541)
WCCP server: Catalyst 6500 / 7600
WCCP redirect ACL entries: range from 4000 to 5000
To follow the Best Practice for WCCP integration with Catalyst 6500, I would set the WCCP source IP mask to "0x3", so that the ACL TCAM can retain within 32K entries.
However, does it mean that by setting a smaller mask value, there will be less chance for a repetitive flow to "hit" the same cache on the same WAE? Consequently would the optimization benefit be affected?
Thanks!
Joe

Hi Joe,
If WCCP services (61,62) are properly configured on the WCCP router/SW, having a less amount of buckets wont affect optimization.
If there is no asymmetrical effect by changing the default mask to a lower value.
Adriana.

Getting started with WAAS

Hello everyone -
We've recently purchased a Cisco WAAS solution 2x WAE 674 applicances, and I find myself running into a few questions. I'm configuring the devices in a test enviornment, just to get familliar with the interfaces / OS / CLI.
Our WAAS deployment is going to be fairly simple, one remote site (for now), with a DS3 as the pipe back to our datacenter. I'm still in the middle of reading through the massive amount of documentation available for this product, but would just like to ask a few basic questions. The WAAS boxes we purchased are the WAE-674's, with 4GB memory, and enterprise licenses. The orignial quote didn't include inline adapters for these boxes, and I'm trying to figure out what the differences are between inline interception, and configuring WCCP on my routers.
Another assumption that I'm making is that one of the boxes I'll need to configure as the central manager, and my remote box will be my WAE. Or am I wrong about this do they both need to be configured as WAE's, and if I need to add another site later on, I can configure a CM box at that time.
Any help is appreciated, I'm very comfortable with Cisco IOS / routers / switches / callmanager, but I'm fairly new to this product.
Thanks!
Jonathan Kloza
Systems Engineer
CACI Technologies

Zach,
I have done the change now for one of my wccp farm, with success.
See below.
Is there any command to see the loadbalacing?
I can see there is equel connection on both with "sh statistics connection"
Jan
01#sh egress-methods
Intercept method : WCCP
TCP Promiscuous 61 :
      WCCP negotiated return method : WCCP GRE
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          WCCP Negotiated Return WCCP GRE
TCP Promiscuous 62 :
      WCCP negotiated return method : WCCP GRE
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          WCCP Negotiated Return WCCP GRE
Intercept method : Generic L2
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          not configurable        IP Forwarding
02#sh egress-methods
Intercept method : WCCP
TCP Promiscuous 61 :
      WCCP negotiated return method : WCCP GRE
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          WCCP Negotiated Return WCCP GRE
TCP Promiscuous 62 :
      WCCP negotiated return method : WCCP GRE
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          WCCP Negotiated Return WCCP GRE
Intercept method : Generic L2
                        Egress Method      Egress Method
      Destination        Configured            Used
      any          not configurable        IP Forwarding

Cisco Security Advisory: Denial-of-Service of TCP-based Services in CatOS

Hi,
Anybody who is aware or is affected of this flaw? My problem is that, we have a couple of 6500s with CatOS here. I don't know how to evaluate if our box is affected or not. Catalyst 6000 running a CatOS versions are listed as affected. Anybody can help me?
Thank you.
jon
http://www.cisco.com/warp/public/707/cisco-sa-20030709-swtcp.shtml

Hi,
I have this CatOS version:
WS-C6509 Software, Version NmpSW: 6.3(3)
and Hardware version:
Hardware Version: 2.0 Model: WS-C6509
What i can't be sure of is, is 6500 the same family series as 6000 as what is listed on the advisory?
Thanks for your quick reply.
jon

WCCP suppport with CatOS

Similar Messages

Maybe you are looking for