- Introduction
- Firewall Considerations
- WAAS Directed Mode
- Configuring Multiple IP Addresses on a Single Interface
- Directed Mode Considerations
- Related Information
Introduction
The WAAS system consists of a set of devices called wide area application engines (WAEs) that work together to optimize TCP traffic over your network. WAAS Central Manager GUI is used to centrally configure and monitor the WAEs and application policies in your network. The Cisco WAAS uses redirect method and assignment method to move packets between router to waas and to load balance packets among WAAS respectively. If one WAE fails or experiences issues this reflects in overall system performance. Data replication applications are dependent on the IP network infrastructure for their performance.
Firewall Considerations
When deploying a Cisco WAAS where a non-Cisco firewall is logically between two WAEs, firewall can drop connections due to changes done by WAE to the packet. The firewall should be configured specifically to allow optimized traffic through it. WAAS devices transparently sets up new TCP connections to peer WAEs, which can cause firewall traversal issues when a WAAS device tries to optimize the traffic. WAAS devices mark TCP packets with the option 0x21. This marking allows the WAAS devices to know if there is another WAAS device on the other end of the WAN connection. After acceleration is confirmed, WAAS devices will add 2 Million to the sequence numbers of accelerated traffic, to be able to differentiate between accelerated and non-accelerated traffic. Cisco firewalls can be configured to allow TCP options by using the "ip inspect waas" command (for IOS 12.4(11)T2 and later) or the "inspect waas" command (for FWSM 3.2(1) and later and PIX 7.2(3) and later).
WAAS Directed Mode
In WAAS directed mode, all TCP traffic that is sent to a peer WAE is encapsulated in UDP, which allows a firewall to either bypass the traffic or inspect the traffic (by adding a UDP inspection rule). Firewalls typically would scrub out TCP options, resulting in WAAS devices not discovering each other in the first place. Firewalls might drop traffic as a result of a sequence number shift introduced by WAAS to discriminate between the accelerated and non accelerated traffic; this feature must be disabled in most cases. WAAS Directed Mode encapsulates optimized traffic over one UDP port. The firewall should be configured to allow traffic flow on that single port. The port is configurable and it is set to UDP port 4050 by default. If a WAE at either end of a peer WAE connection specifies directed mode, and both WAEs support directed mode, then both WAEs use directed mode, even if one is not explicitly configured for directed mode. If a peer WAE does not support directed mode, then the peers pass through traffic unoptimized. WAE peer deiscovery or auto discovery is the first step and requires that the firewall passes the TCP option 0x21; only if both devices are able to do optimization, the traffic will pass over the UDP port.
Configuring Multiple IP Addresses on a Single Interface
You can configure up to four secondary IP addresses on a single interface. This configuration allows the device to be present in more than one subnet and can be used to optimize response time because it allows the data to go directly from the WAAS device to the client that is requesting the information without being redirected through a router. The WAAS device becomes visible to the client because both are configured on the same subnet.
Network Diagram
This document uses this network setup:
Configure Directed mode
To configure directed mode through the central manager, follow these steps:
a) Select MyWAN -> Manage Devices -> (select the WAE) -> Configure -> Network -> Directed Mode Settings
b) Check the "Enable Directed Mode" box.
c) Enter the custom UDP port number for accelerated traffic or keep the default port 4050.
d) click "Submit" to save the changes.
Directed Mode Considerations
a) On WAAS 4.1 and later if directed mode is configured on any of the peer devices all connections between the devices will be using directed mode.
b) If mixed versions exist such as WAAS 4.1 or later on a data centre and WAAS 4.0 on a remote branch site then all the connections between these WAEs will be in pass-through mode.
