Transparent interception with WCCP v2 devices

Help | Content Gateway | Version 8.1.x

Related topics:

WCCP load distribution

Configuring WCCP v2 routers

Enabling WCCP v2 in Content Gateway

ARM bypass and WCCP

Content Gateway supports transparent interception with WCCP v2-enabled routers and switches.

HTTP, HTTPS, FTP, and DNS protocols are supported. Default ARM redirection rules are included for HTTP, HTTPS, and FTP communicating on standard ports.

A list of WCCP v2 supported features follows the setup outline.


	Important The network clients, Content Gateway proxy servers, and destination Web servers (default gateway) must reside on separate subnets.

Following is a WCCP v2 setup outline.

Install and configure your WCCP v2 devices.

On each WCCP v2 device:

Configure the service groups.

Configure password security, if needed.

Configure multicast communication, if needed.

See Configuring WCCP v2 routers.

Configure Content Gateway to work with your WCCP devices.

Define matching service groups.

In addition to network interface, protocols, ports, authentication (if used), and multicast communication (if used), also configure:

The IP addresses of the WCCP v2 devices.

The Packet Forward Method and Packet Return Method.

If Content Gateway is deployed in a cluster, assignment method load distribution, if desired.

Create ARM NAT rules for non-standard ports.

See Enabling WCCP v2 in Content Gateway and The ARM.

Validate the configuration with test traffic.

WCCP v2 supported features

Content Gateway supports the following WCCP v2 features:

Multiple routers in a proxy cluster

Multiple ports per service group

Multiple service groups per protocol. Sometimes it is necessary or convenient to have different service groups for different WCCP devices. For example, for Cisco ASA firewall, different service groups are required for each WCCP device in the network.

Dynamic load distribution in a cluster through assignment method HASH or MASK. See WCCP load distribution.

Packet Return Method and Packet Forward Method negotiation

MD5 password security per service group

Multicast mode

In a Content Gateway cluster, it is recommended that you not enable virtual IP failover in WCCP environments. WCCP v2 and the Content Gateway configuration handles node failures and restarts. (See WCCP load distribution and Virtual IP failover.) However, if a Content Gateway cluster uses WCCP exclusively, virtual IP failover can be used if no user authentication features are used. Note that the WCCP assignment method - not virtual IP failover - is the recommended method for managing load distribution. If a Content Gateway cluster receives requests both explicitly and transparently (the networks must be separate; this type of deployment is not recommended), virtual IP failover can be used on the explicit proxy network segment.

Content Gateway also supports cache affinity. If a node becomes unavailable and then recovers, the node's cache does not need to be repopulated.

How WCCP v2 interception works:

WCCP v2 devices send HTTP, HTTPS, FTP, and DNS traffic, per the configuration of the service group, to the proxy server or cluster of servers.

The ARM readdresses traffic. For example, HTTP traffic on port 80 is readdressed to Content Gateway port 8080.

The proxy processes the request as usual, sending the response back to the client.

The ARM readdresses the proxy port in the response header to port 80 (undoing the readdressing it did on the way to the proxy). As a result, the user sees the response as if it had been sent directly from the origin server.