topic Ask the Expert:Understanding WAAS Platform in Application Networking

Ask the Expert:Understanding WAAS Platform

ciscomoderator — Fri, 04 Nov 2011 20:19:01 GMT

With Michael Schueler

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn about resolving configuration problems on the WAAS platform that are not directly related to the WAAS software.

Peter Van Eynde is a customer support engineer in the Technical Assistance Center in Belgium, where he supports content technologies including Cisco Wide Area Application Services (WAAS), Cisco Application and Content Networking System (ACNS), and Cisco Content Delivery System Internet Streaming (CDS-IS). He holds CCIE certification #23042 in Security.

Michael Schueler has been a Cisco support engineer in the Cisco Technical Support Assistance team in Germany for more than 4 years. He and is an expert on content technologies including Cisco Wide Area Application Services (WAAS), Cisco Application and Content Networking System (ACNS), Cisco Content Delivery System Internet Streaming (CDS-IS), and Cisco Digital Media Suite (DMS). He holds CCIE certification #23835 in Security.

Remember to use the rating system to let Peter and Michael know if you have received an adequate response.

They might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the discussion forum shortly after the event. This event lasts through November 18, 2011. Visit this forum often to view responses to your questions and the questions of other community members.

There will also be a live webcast on this subject on Tuesday, November 15, at 2 p.m. Pacific Time and 5 p.m. Eastern Time. During the live event, Cisco subject matter expert Bhavin Yadav will be presenting on how to troubleshoot WAAS Application Optimizations (AO) effectively. He will focus more on individual AO troubleshooting and he will explain about the different ways to work around AO issues with minimum impact to the traffic.

To register for this live webcast: visit, http://www.ciscolive.com/ate/index.php?sid=203284_2

Ask the Expert:Understanding WAAS Platform

tenaro.gusatu.novici — Sat, 05 Nov 2011 07:01:35 GMT

Hi there,

can you quickly compare WAAS with ACNS and ECDS?

Regards,

Tenaro

Ask the Expert:Understanding WAAS Platform

CSCO10662744_2 — Sun, 06 Nov 2011 04:30:57 GMT

Could you please tell me if WAAS supports the following features:

1. cache multimedia content such as YouTube video clips

2. optimize external SSL traffic on the Internet (websites whose SSL certs are not under our control)

3. optimize cloud / Internet traffic, when there's no peer WAAS on the other end of the flow

thanks,

Kevin

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Mon, 07 Nov 2011 16:57:32 GMT

Hello Kevin,

> 1. cache multimedia content such as YouTube video clips

Yes, WAAS supports caching of multimedia content including YouTube and Cisco Show and Share video clips via its DRE ("Data Redundancy Elimination") feature.

The DRE feature has been further enhanced in WAAS version 4.4. Please find further information on these enhancements here:

http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/white_paper_c11-676350.html

> 2. optimize external SSL traffic on the Internet (websites whose SSL certs are not under our control)

WAAS can do TFO (TCP Flow Optimization) on such SSL traffic only, which includes optimizations like TCP Window Scaling or Selective ACK (SACK). To be able to apply any application layer (layer 7) optimization or effective compression and caching to SSL traffic WAAS needs to have the SSL key.

Please find further information on TFO here:

http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/prod_white_paper0900aecd8051d5b2.html#wp9000046

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/intro.html#wp1122178

> 3. optimize cloud / Internet traffic, when there's no peer WAAS on the other end of the flow

WAAS always requires a peer at the other end of the flow in order to be able to apply any optimizations.

Best regards,

Michael

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Mon, 07 Nov 2011 17:49:28 GMT

Hello Tenaro,

ACNS and ECDS are designed for efficient delivery of video and other media assets. In addition, ACNS can also act as an HTTP/HTTPS proxy. Both ACNS and ECDS require a device at the client-side only in order to apply their optimizations (although in most network designs a device close to the server is recommended as well). In terms of ECDS clients are usually redirected to the appropriate service engine using DNS. With ACNS we can also leverage WCCP or even configure ACNS as direct or dynamic proxy in the client's browser.

WAAS on the other hand can provide benefits with a much larger variety of content and protocols - like HTTP, HTTPS, CIFS, NFS, MAPI (Exchange), VDI, live video and even legacy protocols (via TFO, LZ and DRE) -, but has less features and is thus not as flexible in terms of video. WAAS always requires accelerators to be installed at both the client side and the server side. With WAAS traffic optimization is completely transparent to both the clients and the servers. Also, while ACNS and ECDS can only help with server to client traffic, WAAS optimization works in both directions and even between multiple branch offices.

Please find further information on WAAS features here:

http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/prod_white_paper0900aecd8051d5b2.html

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/intro.html#wp1122157

Good further reading regarding ACNS and ECDS can be found here:

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/acns/v55_13/configuration/central/guide/9136intr.html

http://www.cisco.com/en/US/partner/docs/video/ecds/2.5/configuration_guide/prodview.html

Best regards,

Michael

Ask the Expert:Understanding WAAS Platform

pevaneyn — Tue, 08 Nov 2011 10:43:30 GMT

Hello Kevin,

I would like to add a few minor comments to the answer of Michael:

1 the caching for multimedia content will be better then using a normal web proxy because we cache the content based on the content itself, not on the URL. So if the video is the same, but the URL is different we will still service it from the DRE cache.

However the 'central' WAAS device still needs to download the whole video again to check if the content is indeed the same. So the saving will be on the internal WAN connection, not on the connection to the internet.

3 For the cloud we now have vWAAS (http://www.cisco.com/en/US/products/ps11231/index.html) which you can run on your cloud setup to accelerate traffic. Provided of course you have a Nexus 1000v switch to redirect traffic from the virtual client machines to the vWAAS.

Best regards, Peter

Ask the Expert:Understanding WAAS Platform

CSCO10662744_2 — Tue, 08 Nov 2011 12:07:58 GMT

Thank you both for the prompt responses.

Ask the Expert:Understanding WAAS Platform

Sveta Prutikova — Wed, 09 Nov 2011 17:28:12 GMT

Hi, Quick question: How can I monitor the health of the WAE device using SNMP?

Ask the Expert:Understanding WAAS Platform

Andreas_Seybold-Epting — Wed, 09 Nov 2011 23:58:21 GMT

Hi,

i have a Problem with the new Cisco Wave 694 and the Power Supply.

In this Hardware are two Power Supplys are installed. Both Supplys are running good but in the Central Manager i have a Message that called "Power Supply Unit (PSU1) reports AC lost".

The Software Version ist 4.4.1.

Any Idea?

Thanks for help

Andreas

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Thu, 10 Nov 2011 08:38:04 GMT

Hi Andreas,

This sounds related to the issue documented in bug ID CSCtq33146 ("PSU "No Power" Alarm Raised After AC Power Cycle") , which is fixed in WAAS version 4.4.3 (I would rather recommend 4.4.3b, though, unless you are using virtual blades, as it addresses a recently discovered Apache vulnerability) and later.

Please try, if any of the following workarounds fixes the issue:

---snip---

Perform a graceful DC power off using the CLI command "shutdown poweroff" before turning off the AC power supply.

If the device lost power for any unexpected reason and the "no power" alarm exists, check the PSU status by using the command "show hardware | inc Power". Look for status of the PSU reported in the alarm. If there is a mismatch in the status, clear SEL logs using "clear bmc event-log" and reboot the device.

---snip---

If the above should not help, I would recommend to open a TAC case, as we would need to get a sysreport from the device to further analyze this.

Best regards,

Michael

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Thu, 10 Nov 2011 09:16:16 GMT

Hi Steva,

There are several things you can do to check the health of a WAAS device using SNMP:

Monitor the WAAS for any alarms using CISCO-CONTENT-ENGINE-MIB.
Via HOST-RESOURCES-MIB you can monitor system uptime (hrSystemUptime) and CPU usage (hrProcessorLoad).
Use CISCO-WAN-OPTIMIZATION-MIB to monitor the number of currently optimized connections via the cwoTFOStatsActiveConn object.
Use IF-MIB to monitor the interfaces (ifOperStatus, ifHCInOctets, ifHCInUcastPkts, ifHCOutOctets, ifHCOutUcastPkts).

Note, that memory usage usage is expected to be high on WAAS systems in production. So monitoring memory usage usually does not make much sense.

You can find further information regarding what SNMP MIBs are supported on WAAS and how to configure SNMP here:

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/SNMP.html#wp1118306

Best regards,

Michael

Ask the Expert:Understanding WAAS Platform

03324184905M — Sun, 13 Nov 2011 09:45:47 GMT

hi sir.

I have been assigned a project to install 20 ip cameras at 7 different locations ..and one locations would be considered as a head office .. and the data of 7 locations cameras should be stored at head office ... can you please guide me thourgh this ,, espically regarding the selcetion of cisco routers for routing ,,, your cooperation in this regard will be highly appreciated

Ask the Expert:Understanding WAAS Platform

pevaneyn — Mon, 14 Nov 2011 10:34:04 GMT

Hello Ahsan,

I fear that we support WAAS and assorted technologies, physical security products are not one of them. Maybe you should ask this question the in forums for physical security:

https://supportforums.cisco.com/community/netpro/security/physical-security?view=discussions

A quick search shows some interesting documents at

http://www.cisco.com/en/US/partner/netsol/ns929/networking_solutions_design_guidances_list.html

But it is not clear to me that this is the products you have to use. Still they in any case seem worth a read.

Good luck, Peter

Ask the Expert:Understanding WAAS Platform

robertsoto — Mon, 14 Nov 2011 15:36:42 GMT

Hello,

My client have a ALLOT and they need that Cisco WAAS can to work with it.

I need to know what is the best design for this case.

First : SW - WAAS - ALLOT - ROUTER

Second: SW - ALLOT - WAAS - ROUTER.

Well thanks,

I hope your soon answer.

Thanks,

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Mon, 14 Nov 2011 18:24:46 GMT

Hi Robert,

I have never heard about ALLOT. Can you give some more details on what this exactly is and what it does? Does it touch traffic at layer 4 or above?

If it only works at layer 3 or below, WAAS should work fine across it.

If it's a firewall or something similar, you might want to consider using Directed Mode, see here:

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/network.html#wp1059477

Best regards,

Michael

Ask the Expert:Understanding WAAS Platform

robertsoto — Mon, 14 Nov 2011 19:48:44 GMT

Michael,

About ALLOT can work in layer 4 or layer 7 , the ALLOT is working in priorization of traffic and inspect traffic because It has a Signature for application.

Regards,

Robert soto.

Ask the Expert:Understanding WAAS Platform

Stoyan Stoitsev — Mon, 14 Nov 2011 20:58:14 GMT

Hello,

It woud be good to see a clearly written document on calculation the maximum MSS size for WAAS with GRE and IPSec tunnels. This is a very common scenario for enterprise customers and documentation on this is somehow inconsistent. Additionally some "best pracitce" needs to be defined on whether to configure MSS on the Tunnel interface, on the LAN interface and how exactly to calculate - based on L2 or L3; what should be the MTU and MSS on the router and what on the WAAS box.

It is a very very common issue when WAAS "breaks" SSL aplications due to packet fragmentation which was not accuring before deploying it.

Regards,

Stoyan

Ask the Expert:Understanding WAAS Platform

pevaneyn — Tue, 15 Nov 2011 07:38:08 GMT

Hello Stoyan,

The interaction of WAAS with MTU/MSS is a bit complex. Due to the nature of WCCP redirection WAAS cannot use Path MTU discovery to determine the maximum MTU on a path. (the ICMP messages are not redirected, so the WAAS cannot know the packet it just send was too big) Nor does it work for inline cards, as the card will only send TCP trafic to the WAAS system, again not the ICMP messages.

Not adjusting the MSS properly is bad because it will cause fragmentation, leading to higher CPU load on the router and the WAAS device.

What the WAAS does is to modify the MSS on every SYN packet it sees to a configured value. By default it will set the MSS on both LAN and WAN side to 1432 bytes. See:

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/policy.html#wp1042887

If you want you can modify these settings with "tfo tcp optimized-mss" or tfo tcp original-mss", see:

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/command/reference/glob_cfg.html#wp1050385

The overhead due to redirection is variable and depends on the redirection, return and egress method (you need to consider all three):

- layer 2, ip forwarding or inline: no overhead only the MAC address is modified

- WCCP GRE: IP (20) + TCP (20) + GRE with WCCP option (28) = 68 bytes so 1432 remain from a standard 1500 bytes MSS.

- Generic GRE: IP (20) + TCP (20) + GRE (24) = 64 bytes

So you need to measure the maximum MSS you can use and then substract these numbers from that to get the MSS you need to configure.

There should be no need to configure MSS on the tunnel interface on the router, nor on the ethernet ports of the WAAS device itself.

The breaking of SSL appliactions due to MSS problems should be a thing of the past. Are you seeing this with a recent (4.3.x or 4.4.x) release?

Best regards, Peter

Ask the Expert:Understanding WAAS Platform

tasoskypraios — Tue, 15 Nov 2011 08:43:14 GMT

Hi,

We have install in our network 12 WAAS devices all with WCCP Configuration. Now we are looking to install 3 more but we prefer to install them inline. If the Core WAE has WCCP configuration and the WAE in braches are inline this will not be a problem am i correct?

Thank you

Ask the Expert:Understanding WAAS Platform

Michael Schueler — Tue, 15 Nov 2011 08:57:05 GMT

Hello Robert,

If ALLOT is configured to work in layer 4 or layer 7 you need to consider the following:

WAAS uses TCP option 33 (0x21) in all TCP packets with the SYN flag set (to negotiate optimization parameters with the peer WAAS) on the WAN side.
If optimization was successfully negotiated for a given connection, WAAS will increment the TCP SEQ and ACK numbers by 2G in all packets on the WAN side, that do not have the SYN flag set.

So you would need to configure ALLOT as follows:

Allow TCP option 33 (0x21) to be used.
Ignore the increment in TCP SEQ and ACK numbers (this is often called normalization).
Not apply any TCP sequence number randomization.

If any of these is not configurable with ALLOT, you would need to use the Directed Mode I mentioned yesterday. When using Directed Mode WAAS encapsulates all traffic on the WAN side in UDP. In this case you would only need to allow UDP traffic on port 4050 between the two WAAS peers to pass through ALLOT.

The only drawback of using Directed Mode is, that on the WAN side all traffic appears as UDP traffic on port 4050 with source and destination IP addresses beeing the two WAAS peers themselves. You do not see the real IP addresses of your clients and servers on the WAN side anymore.

This all only applies, if you have ALLOT on the WAAS's WAN side, as it appears to be in your "First" scenario. If ALLOT is inserted on the WAAS's LAN side, as it appears to be in your "Second" scenario, all should continue to work fine without any configuration changes on ALLOT even after introducing WAAS - on the LAN side WAAS does not apply any changes to the traffic.

Best regards,

Michael