Transparent Cache & Failover Bypass

[estebanmartin]

Hi,

i'm using transparent caching on a 11501 sending all http traffic to a BlueCoat Cache.

I have set the failover bypass option.

When the cache is down, the CSS bypass the cache, but the problem is that i want the http requests to have the CSS source address so the firewall let them pass.

But the http requests have the client ip.

Is there a solution to this?

the cache rule is L5

Thanks

[jfoerster]

Hi,

yes there is a way. This sort of functionaliy is needed in a one armed scenario but you can use the method in a normal one to.

Just followup the steps described in step 5 of the following link (http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a0080093dff.shtml#topic1)

What is basicaly does is to do client nat and replaces the original Client IP by a configuered IP-adress. I think this will do the job.

Kind Regards,

Joerg

[estebanmartin]

Hi Joerg,

thanks for the answer.

I think that could work, but i'd need to do client nat only when bypassing the cache.

any ideas?

[jfoerster]

HI,

configure the firewall as a service and use it as backupservice for the bluecoat. The source-group will only include the firewall as service so only Client nat is done when the bluecoat fails and get's bypassed.

Maybe this is a posibility depending on the setup of your network.

Kind Regards,

Joerg

[estebanmartin]

Hi,

i'm going to try that configuration.

but how can i use the firewall service as a backupservice?

thanks in advance.

[jfoerster]

HI,

just use the primarySorryServer command (see http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_command_reference_chapter09186a008028fe78.html#wp1140863). This command takes care or requestes if all other services in a content rule failed. In your case this will take place if your Caches are failing. The sorryserver (your firewall) will than take over the job until the caches return working.

Btw. be aware that this service should only do "routing". So no need for destination NAT.

Regards,

Joerg