Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Transparent Proxy and ARM > Transparent interception strategies > Transparent interception with WCCP v2 devices
Transparent interception with WCCP v2 devices
Help | Content Gateway | Version 7.8.x
 
Related topics:
*
WCCP load distribution
*
Configuring WCCP v2 routers
*
Enabling WCCP v2 in Content Gateway
*
ARM bypass and WCCP
Content Gateway supports transparent interception with WCCP v2-enabled routers and switches.
HTTP, HTTPS, FTP, and DNS protocols are supported. Default ARM redirection rules are included for HTTP, HTTPS, and FTP communicating on standard ports.
A list of WCCP v2 supported features follows the setup outline.
 
* 
Important 
The network clients, Content Gateway proxy servers, and destination Web servers (default gateway) must reside on separate subnets.
Following is a WCCP v2 setup outline.
1.
Install and configure your WCCP v2 devices.
On each WCCP v2 device:
*
Configure the service groups.
*
Configure password security, if needed.
*
Configure multicast communication, if needed.
See Configuring WCCP v2 routers.
2.
Configure Content Gateway to work with your WCCP devices.
*
Define matching service groups.
In addition to network interface, protocols, ports, authentication (if used), and multicast communication (if used), also configure:
*
The IP addresses of the WCCP v2 devices.
*
The Packet Forward Method and Packet Return Method.
*
If Content Gateway is deployed in a cluster, assignment method load distribution, if desired.
*
Create ARM NAT rules for non-standard ports.
See Enabling WCCP v2 in Content Gateway and The ARM.
3.
Validate the configuration with test traffic.
WCCP v2 supported features
Content Gateway supports the following WCCP v2 features:
*
Multiple routers in a proxy cluster
*
Multiple ports per service group
*
Multiple service groups per protocol. Sometimes it is necessary or convenient to have different service groups for different WCCP devices. For example, for Cisco ASA firewall, different service groups are required for each WCCP device in the network.
*
Dynamic load distribution in a cluster through assignment method HASH or MASK. See WCCP load distribution.
*
Packet Return Method and Packet Forward Method negotiation
*
MD5 password security per service group
*
Multicast mode
In a Content Gateway cluster, it is recommended that you not enable virtual IP failover in WCCP environments. WCCP v2 and the Content Gateway configuration handles node failures and restarts. (See WCCP load distribution and Virtual IP failover.)
Content Gateway also supports cache affinity. If a node becomes unavailable and then recovers, the node's cache does not need to be repopulated.
How WCCP v2 interception works:
1.
WCCP v2 devices send HTTP, HTTPS, FTP, and DNS traffic, per the configuration of the service group, to the proxy server or cluster of servers.
2.
The ARM readdresses traffic. For example, HTTP traffic on port 80 is readdressed to Content Gateway port 8080.
3.
The proxy processes the request as usual, sending the response back to the client.
4.
The ARM readdresses the proxy port in the response header to port 80 (undoing the readdressing it did on the way to the proxy). As a result, the user sees the response as if it had been sent directly from the origin server.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Transparent Proxy and ARM > Transparent interception strategies > Transparent interception with WCCP v2 devices
Copyright 2016 Forcepoint LLC. All rights reserved.