Configuring service groups in Content Gateway Manager

Transparent Proxy and ARM > Transparent interception strategies > Transparent interception with WCCP v2 devices > Configuring service groups in Content Gateway Manager

Configuring service groups in Content Gateway Manager

Help | Content Gateway | Version 7.7.3

Every WCCP service group that redirects traffic to a Content Gateway server must have a corresponding service group defined for it in the Content Gateway server or cluster.

Important

All service group attributes are propagated around the cluster except the service group enabled/disabled state, the specified network interface, and the weight.

This means:

Service groups need only be configured once within the cluster.

Except the enabled/disabled setting, the specified network interface, and the weight, if used, which must be set on each node.

This supports the ability to specifically exclude service group activity on a given node. And also, by excluding weight, make proportional load distribution possible (see WCCP load distribution).

To define service groups, go to Configure > Networking > WCCP.

The Service Groups table displays the list of configured service groups and a subset of their configuration settings.

Entries are stored in the wccp.config file.

The Refresh button rereads wccp.config and refreshes the table.

To add, modify, delete, or reorder service groups, click Edit File.

Configuring a service group (editing wccp.config)

1.	On Configure > Networking > WCCP, click Edit File to open wccp.config in the editor.

Defined service groups are summarized at the top of the page.

Click an entry in the list to view its complete details, modify, or reposition it.

When an entry is selected, the down and up arrows to the left of the list reposition the entry in the list.

Click "X" to delete a selected entry.

2.	Service Group Information

a.	Service Group Status: To enable a service group, select Enabled. A service group can be defined but not active. The enabled/disabled status is not propagated around the cluster.

b.	Service Group Name: Specify a unique service group name. The service group name is an aid to administration.

c.	Service Group ID: Specify a WCCP service group identification number from 0-255. This ID must match a corresponding service group ID configured on the router. See Configuring service groups on the WCCP device.

d.	Protocol: Specify the network protocol applicable to the service group, either TCP or UDP.

e.	Ports: Specify the ports that this service group will use. You can specify up to 8 ports in a comma-separated list.


	Important Every port in the service group must have a corresponding ARM NAT rule to redirect the traffic to Content Gateway. See The ARM.

Network Interface: From the drop down list, select the network interface on the Content Gateway host system that this service group will use. The Network Interface value is not propagated around the cluster and, therefore, like the Service Group Status value, must be specified on every member of the cluster.

3.	Mode Negotiation

The Packet Forward Method determines how traffic is transmitted from the WCCP router to the proxy.

The Packet Return Method specifies the method used to return traffic back to the WCCP router.

Typically the router supports only one method.

Typically, the forward and return methods match.

a.	If traffic is routed to the proxy by a Cisco ASA firewall, select ASA Firewall in the Special Device Profile drop down box. When this option is selected, GRE is automatically selected for both Packet Forward Method and Packet Return Method. These settings cannot be changed.

b.	If traffic is routed to the proxy by a router or switch, select the Packet Forward Method and Packet Return Method that matches the capabilities and position of your router or switch.

If Content Gateway is configured with a Forward/Return method that the router does not support, the proxy negotiates a method supported by the router.

Packet Forward Method: Select L2 or GRE.

If L2 is selected, L2 is automatically selected as the return method (GRE is not an option).


	Important Selecting L2 requires that the router or switch be Layer 2-adjacent (in the same subnet) as Content Gateway.

If GRE is selected, for every router in the service group a unique Content Gateway tunnel endpoint IP address must be specified in the WCCP Routers section (see the Router Information step, below).

Packet Return Method: Select L2 or GRE.


	Important GRE cannot be used with WCCP multicast mode.

4.	Advanced Settings

a.	Assignment Method: Specify the parameters used to distribute intercepted traffic among multiple nodes in a cluster. It can be used in combination with Weight to provide dynamic load distribution. For a description of the WCCP load distribution feature, see WCCP load distribution.

HASH applies a hash operation to the selected distribution attributes.

With HASH, more than one distribution attribute can be selected.

The result of the hash operation determines the cluster member that receives the traffic.

MASK applies a mask operation to the selected distribution attribute.

Only one distribution attribute can be selected, typically the destination IP address.

The result of the mask operation determines the cluster member that receives the traffic.

The following distribution attributes can be selected:

Destination IP address

Destination Port

Source IP address

Source Port

The MASK value is applied up to 6 significant bits (in a cluster, a total of 64 buckets are created). See your WCCP documentation for more information about assignment method HASH and MASK operations. Use the value recommended in the manufacturer's documentation for your device.

b.	Weight: For proportional load distribution, specify a value from 0-255. This value determines the proportional distribution of load among servers in a cluster.

All cluster members have a value of 0 by default, which results in a balanced distribution of traffic. If weight is set to 1 or higher, the value guides proportional distribution among the nodes. For example, if there are 3 nodes in a cluster and Proxy1 has a weight of 20, Proxy2 has a weight of 10, and Proxy3 has a weight of 10, Proxy1 will get one half of the traffic, Proxy2 will get one-quarter of the traffic, and Proxy3 will get one-quarter of the traffic.


	Important When the value of weight is greater than 0 on any member of the cluster, any member of the cluster with a weight of 0 receives no traffic. If you plan to use weight, be sure to set the weight on every member of the cluster.


	Note Because the value of weight determines the proportional distribution relative to the value set on other cluster members, the value of weight is not propagated around the cluster.

For more information about load distribution, see WCCP load distribution.

c.	Reverse Service Group ID: Allows you to specify a reserve service group ID.

When IP spoofing is enabled, you must define a reverse service group for each HTTP and HTTPS (if enabled) forward service group.


	Note Only HTTP and HTTPS are supported for IP Spoofing.

Using the specified ID, Content Gateway creates a reverse service group that is a mirror of the forward service group. For example, if the forward service group has assignment method based on destination IP address, the reverse service has an assignment method based on the source IP address.


	Note IP spoofing is not supported with service groups that use a hashing assignment method with both destination and source attributes. If IP spoofing is enabled on such a service group, an alarm is raised and IP spoofing is disabled.

5.	Router Information


	Note It may take up to a minute for the router to report that a new proxy server has joined a service group.

a.	Security: To use optional WCCP authentication, select Enabled and enter the same password used for service group authentication on the router. See Enabling WCCP v2 security on the router.

b.	Multicast: To run in multicast mode, select Enabled and enter the multicast IP address. The multicast IP address must match the multicast IP address specified on the router. See Transparent interception and multicast mode.


	Important GRE packet Forward/Return method cannot be used with multicast mode.

c.	WCCP Routers: Specify up to 10 WCCP Router IP Addresses. These routers must be configured with a corresponding service group.

If GRE is selected for Packet Forward Method or Packet Return Method, also specify a Local GRE Tunnel Endpoint IP address for each router, (including ASA firewall, and optionally, a GRE Tunnel Next Hop Router IP Address.

The Local GRE Tunnel Endpoint IP address is the Content Gateway tunnel endpoint for the associated Router IP Address.

The Local GRE Tunnel Endpoint IP Address:

Must be IPv4

Must be unique and not assigned to any device

Must be a routable IP address

Should reside on the same subnet as the proxy. If it is not, you must define a route for it.

Is not intended to be a client-facing proxy IP address

Is bound to the physical interface specified for the service group (on a V-Series appliance, eth0 = P1; eth1 = P2)

When GRE Packet Return Method is configured and Content Gateway does not have a route back to the WCCP router, specify a GRE Tunnel Next Hop Router IP Address.

You can use "ping" to test connectivity to the router.

From Content Gateway, ping each router defined in the service group (in the Router IP Address field).

If ping doesn't return a response, you need to define a GRE Tunnel Next Hop to that router. Intervening routers must have a route to the WCCP router, or a next hop.


	Note WCCP routers that have multiple interfaces assign the Router ID to the interface with the highest numeric value IP address. Content Gateway must be able to connect to the router ID to negotiate the method. To ensure connectivity and that the router ID doesn't change unexpectedly, it is a best practice to make the router loopback address the highest IP address. This also ensures that traffic and statistics reported on the Monitor > Networking > WCCP page are reported against a known router ID.

6.	Click Add to an entry, or click Set to save changes to an existing entry.

7.	Click Close to close the editor.

8.	On the Configure > Networking > WCCP page, click Apply to apply changes. Navigating away from the page before clicking Apply results in the loss of all changes.

9.	Restart the proxy to cause the changes to take effect. Go to Configure > My Proxy > Basic > General and click Restart.


	Note To check that the router is sending traffic to the proxy, examine the statistics in the Content Gateway Manager Monitor pane. For example, check that the Objects Served statistic in the My Proxy > Summary section increases.

Transparent Proxy and ARM > Transparent interception strategies > Transparent interception with WCCP v2 devices > Configuring service groups in Content Gateway Manager

Support

Search

Article Rating:

Related Articles

Quick Links

Service Requests

How are we doing?