Cisco WCCP (multicast method ) with Bluecoat Implementation

[vishal_2007]

hi

Cisco WCCP with Bluecoat Implementation  . during implemetation multicast packet not flow to other vlan interface.

few observation .

• Cisco wccp with bluecoat proxy ( Multicast method )  - Multicast IP # 224.1.1.103 , Group 11, dense-mode
• Same Vlan  its working ( user and Proxy SG )
• Different Vlan not working ( user Vlan 10 and server Vlan 20 )

sample configuration :

-----------------------

ip multicast-routing
ip wccp 11 group-address 224.1.1.103 redirect-list 103

sh ip access-lists 103
Extended IP access list 103
   
    40 permit tcp 10.10.10.0 0.0.0.31 any eq 443
    50 permit tcp 10.10.10.0 0.0.0.31 any eq www
    60 permit tcp 10.10.10.0 0.0.0.31 any eq ftp
    70 deny ip any any

interface Vlan10 description "AP_User_Range"
 ip address 10.10.10.0 255.255.255.0
 ip helper-address 10.10.20.100
 ip wccp 11 redirect in
 ip wccp 11 group-listen
 ip pim dense-mode

[Jon Marshall]

With WCCP the traffic from the clients is not multicast so you do not need to enable multicast routing because there is no mutlicast traffic to route. The client traffic is normal unicast http/https etc. traffic.

The multicast group is used for the switch to communicate with the proxy server(s) and it does not need to be routed.

So you should remove the multicast routing and PIM configuration.

The "ip wccp 11 group-listen" command should be removed from the client vlan  SVI and added to the SVI for the vlan the proxy server is in.

Jon

[vishal_2007]

thanks for update .Jon

below configuration is correct ? , any changes required

interface Vlan10 ( client Vlan )

 ip address 10.10.10.0 255.255.255.0
 ip helper-address 10.10.20.100
 ip wccp 11 redirect in

int vlan 20 ( server Vlan )
 ip wccp 11 group-listen
 

[vishal_2007]

Dear Jon,

After changes the WCCP Command  ,still  WCCP not working

but  both client and Proxy Same VLAN its working fine with Multicast mode

interface Vlan10
 description "AP_User_Range"
 ip address 10.10.10.10 255.255.255.0
 ip helper-address 10.10.10.100
 ip wccp 11 redirect in

interface Vlan20
 description PROXY_WAN_VLAN
 ip address 10.10.20.10 255.255.255.0
 ip helper-address 10.10.10.100
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip wccp 11 group-listen

ip wccp 11 group-address 224.1.1.103 redirect-list 103

sh ip access-lists 103
Extended IP access list 103
    
    40 permit tcp 10.10.10.0 0.0.0.255 any eq 443
    50 permit tcp 10.10.10.0 0.0.0.255 any eq www
    60 permit tcp 10.10.10.0 0.0.0.255 any eq ftp
    70 deny ip any any

sh ip wccp
Global WCCP information:
    Router information:
        Router Identifier:                   -not yet determined-
        Protocol Version:                    2.0

    Service Identifier: 11
        Number of Service Group Clients:     0
        Number of Service Group Routers:     0
        Total Packets s/w Redirected:        0
          Process:                           0
          CEF:                               0
        Service mode:                        Open
        Service Access-list:                 -none-
        Total Packets Dropped Closed:        0
        Redirect access-list:                103
        Total Packets Denied Redirect:       0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total GRE Bypassed Packets Received: 0

[Jon Marshall]

Have you confiured the multicast address on the proxy server ?

Jon

[vishal_2007]

Yes, running with multicast method

From client vlan traffic flow to 2 or more blue coat proxy server, so we implementing multicast mode.

after removed command not working .

please find the bluecoat sample setting

[Jon Marshall]

Looking at the outputs you provided it doesn't look like the switch is seeing any proxy servers.

Have you tried using the unicast method just to rule out any other potential issues with switch and proxy servers ?

Jon
 

[vishal_2007]

we tried unicast method also not working , but same vlan -its working fine

in WCCP - not getting the router identifier

Switch#sh ip wccp
Global WCCP information:
    Router information:
        Router Identifier:                   -not yet determined-

 l

interface Vlan10
 ip address 10.10.10.10 255.255.255.0
 ip wccp 11 redirect in
end

Switch#sh run int vl 20
Building configuration...

Current configuration : 112 bytes
!
interface Vlan20
 ip address 20.20.20.1 255.255.255.0
 ip wccp 11 group-listen
 ip pim sparse-dense-mode
end

Switch#sh run | in wccp
ip wccp 11 group-address 10.10.10.10 redirect-list 103
 ip wccp 11 redirect in
 ip wccp 11 group-listen

can you share any working configuration (multicast )

[Jon Marshall]

If unicast is not working either then it suggests a more fundamental problem.

Try a very basic unicast configuration ie.

ip wccp redirect-list 103

int vlan 10

ip wccp 11 redirect in

and that's it. Remove all other WCCP configuration from the switch.

And then configure your proxy server with the IP address of the switch and test.

Jon