Hello,
I seem to be having a lot of trouble with a very simple implementation. I have 2 routers and a data centre WAE via WCCP. These devices are on the same L2/L3 segment (x.x.x.0/24). The WAN interfaces on the routers are in different networks. The remote WAE is inline. I configured ip wccp 61 redirect in on the LAN interface of each router and ip wccp 62 redirect in on the WAN interface of each router. I get the alarm "WCCP router x.x.x.1(LAN) unusable for service id:61 reason redirection mismatch with router" and "WCCP router x.x.x.1(LAN) unusable for service id:62 reason redirection mismatch with router". For the WAN interfaces I get the alarm they are unreachable for the service ID.
Snadard router config
ip wccp version 2
ip wccp 61
ip wccp 62
int gi0/0
description LAN
ip address x.x.x.1
ip wccp 61 redirect in
int gi0/1
description WAN
ip address y.y.y.1
ip wccp 62 redirect in
Should I only be trapping inbound traffic on the LAN interface ?
The other thing I noticed was these messages from the PIX on the same L2/L3 segment
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER1/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER2/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER1/2048 on interface outside
Dec 20 2011 05:49:52: %PIX-2-106006: Deny inbound UDP from WADMZJA02/2048 to IROUTER2/2048 on interface outside
Access list
access-list outside_access_in extended permit udp host WADMZJA02 host IROUTER1 log notifications
access-list outside_access_in extended permit udp host WADMZJA02 host IROUTER2 log notifications
access-list outside_access_in extended permit udp host IROUTER1 host WADMZJA02 log notifications
access-list outside_access_in extended permit udp host IROUTER2 host WADMZJA02 log notifications
Best regards
Stephen
WAE config
sh run
2011 Dec 20 07:06:27 WADMZJA02 -admin-shell: %WAAS-PARSER-6-350232: CLI_LOG log_cli_command: sh run
! waas-universal-k9 version 4.3.1 (build b6 Nov 13 2010)
!
device mode application-accelerator
!
!
hostname WADMZJA02
!
clock timezone Europe/Brussels 1 0
!
!
ip domain-name fibe.fortis
!
!
!
primary-interface GigabitEthernet 1/0
!
!
!
interface GigabitEthernet 1/0
ip address x.x.x.248 255.255.255.0
exit
interface GigabitEthernet 2/0
shutdown
exit
!
!
ip default-gateway x.x.x.4 <== firewall
!
no auto-register enable
!
! ip path-mtu-discovery is disabled in WAAS by default
!
! <== traffic to be rerouted outbound ==>
ip route a.a.a.0 255.255.255.0 x.x.x.1 <== Outbound HSRP
!
ip access-list extended HK
permit ip any 0.0.0.0 255.255.255.0
exit
!
!
logging console enable
logging console priority debug
!
!
interception access-list HKWAAS
!
!
wccp router-list 1 z.z.z.202 y.y.y.122 x.x.x.1 x.x.x.2 x.x.x.3
wccp tcp-promiscuous router-list-num 1 hash-source-ip hash-destination-ip l2-redirect l2-return
wccp version 2
!
egress-method negotiated-return intercept-method wccp
!
ip icmp rate-limit unreachable df 0
!
directed-mode enable
!
!
transaction-logs flow enable
--More--
! [K
!
!
!
!
inetd enable rcp
!
!
sshd allow-non-admin-users
sshd enable
!
!
!
tfo tcp optimized-send-buffer 2048
tfo tcp optimized-receive-buffer 2048
!
accelerator http metadatacache enable
accelerator http metadatacache https enable
accelerator http dre-hints enable
!
!
!
!
central-manager address x.x.x.247
cms enable
!
!
!
!
!
!
! End of WAAS configuration
