IP spoofing

Transparent Proxy and ARM > IP spoofing

IP spoofing configures the proxy to use the IP address of the client when communicating with the origin server, instead of the proxy's own IP address. As a result, requests appear to come from the client rather than the proxy.

IP spoofing is supported for HTTP and HTTPS traffic only.

When IP spoofing is enabled, it is applied to both HTTP and HTTPS. It cannot be configured to apply to only one protocol.

IP spoofing is supported for transparent traffic only.

IP spoofing relies on the ARM.


	Warning Deploying IP spoofing requires precise control of the routing paths on your network, overriding the normal routing process for traffic running on TCP port 80 and 443. With IP spoofing enabled, traditional debugging tools such as traceroute and ping have limited utility.


	Important For a discussion of how the proxy kernel routing table impacts transparent proxy deployment, see the Solution Center article titled, "Web sites in the Static or Dynamic bypass list fail to connect".

IP spoofing and the flow of traffic

The following describes the flow of HTTP and HTTPS traffic when IP spoofing is used with WCCP. Policy-based routing can be implemented to achieve the same results. The numbers in the diagram correspond to the actions described in the numbered list.

1.	A client request arrives at a routed port or Switched Virtual Interface (SVI) looking for traffic with a destination port of HTTP (80) or HTTPS (443).

2.	The switch redirects the client request to Content Gateway (the proxy), and Content Gateway internally routes the traffic to port 8080 (HTTP) or 8070 (HTTPS) of its own IP address.

If needed, the proxy creates a connection to the Web origin server using the original client IP address.

3.	The request is sent to the Web origin server through the switch, NAT and/or firewall.

4.	When the origin server response is returned, the IP packet has the client IP address as the destination.

5.	The origin server response arrives at a routed port or Switched Virtual Interface (SVI) looking for traffic with a source port of HTTP (80) or HTTPS (443). See the note below.

6.	The switch redirects the origin server response to the proxy, completing the proxy-to-Web server TCP connection.

7.	A proxy response to the client is generated and returned to the client on the proxy-to-client TCP connection.


	Note When IP spoofing is enabled, the proxy advertises a reverse service group for each enabled WCCP service. The reverse service group must be applied along the return path of the proxy.

WCCP service group IDs are user defined and must be programmed on the WCCP device(s) and in Content Gateway (see Configuring service groups on the WCCP device and Configuring service groups in Content Gateway Manager.

Following is a set of suggested definitions.


Service ID	Port	Traffic Type
0	destination port 80	HTTP
20	source port 80	HTTP
70	destination port 443	HTTPS (requires SSL Manager)
90	source port 443	HTTPS

Policy-based routing (PBR) uses access control lists (ACL) to identify and redirect flows. In a PBR deployment, all of the configuration is done on the router and there is no corresponding Content Gateway configuration. PBR deployments have to redirect traffic returning from origin servers from port 80 and 443 to Content Gateway.

Enabling IP spoofing:

1.	Navigate to Configure > Networking > ARM > General.

2.	Select IP Spoofing.

3.	Click Apply.

4.	Click Restart on Configure > My Proxy > Basic > General.


	Warning The ARM is a critical component of Content Gateway that should never be disabled. If it is disabled while IP spoofing is enabled, client requests receive a cannot display Web page error and an error message is recorded in /var/log/messages.

For information about configuring WCCP routers, see Configuring WCCP v2 routers.

Transparent Proxy and ARM > IP spoofing

Support

Search

Article Rating:

Related Articles

Quick Links

Service Requests

How are we doing?