Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About pevaneyn
06-20-2018
pevaneyn
Member since
05-01-2008
Cisco Employee
CCIE 23042 (Security)
Created by
pevaneyn
in Other Network Architecture Subjects
in Other Network Architecture Subjects
04-03-2014
05:46 AM
04-03-2014
05:46 AM
Hi, When I see 5.3.5 and 674 I think of CSCun85976. Are you using an inline card on that device? Otherwise I would do a 'cms deregister force' on the SRE, followed by an identity recovery, see: http://www.cisco.com/c/en/us/td/docs/app_ntwk_services/waas/waas/v531/configuration/guide/cnfg/maint.html#wp1105458 Best regards, Peter
... View more
02-02-2014
05:32 AM
To avoid having too much client to client traffic on your network you can use ' ipv6 nd prefix default ... off-link ', don't forget to also add a route towards the interface on the router itself so: interface GigabitEthernet0/0/0 ipv6 address 2001:0db8:5150:F016::1/64 ipv6 enable ipv6 nd reachable-time 600000 ipv6 nd prefix default infinite infinite off-link ipv6 nd other-config-flag ipv6 nd router-preference High ipv6 nd ra lifetime 9000 ipv6 nd ra dns server ... ipv6 dhcp server ... ipv6 verify unicast source reachable-via rx allow-default ... ipv6 route 2001:0db8:5150:F016::/64 GigabitEthernet0/0/0 (this is a configuration optimized for wireless networks with very long timers) This means that the client gets a default route, but no route towards the /64: Internet6: Destination Gateway Flags Netif Expire default fe80::72ca:9bff:fe88:da83%en0 UGc en0 ::1 ::1 UHL lo0 ... And your client will only see the router as neighbour: $ ndp -a -n Neighbor Linklayer Address Netif Expire St Flgs Prbs ... fe80::72ca:9bff:fe88:da83%en0 70:ca:9b:88:da:83 en0 23h59m57s S R So all the client to client traffic in the /64 will work, but will go via the router.
... View more
Labels:
Created by
pevaneyn
in Networking Documents
in Networking Documents
02-01-2014
12:50 AM
02-01-2014
12:50 AM
At the Fosdem conference in 2014 we used a IPv6 only network for the main wireless access. To configure this we used as upstream link: interface GigabitEthernet0/0/0 description ---------- Uplink to COLT ---------------- ip address 213.246.232.54 255.255.255.252 ... ipv6 address 2001:920:0:1::5F/127 nat64 enable And the IPv6 only network used: interface GigabitEthernet0/0/3.1400 description ----------- WiFi Internet client traffic ---------------- ipv6 address 2001:67C:1810:F051::1/64 ipv6 enable nat64 enable While the legacy dualstack network had: interface GigabitEthernet0/0/3.1402 description ----------- WiFi FOSDEM-dualstack Internet client traffic ---------------- ip address 151.216.63.254 255.255.240.0 ipv6 address 2001:67C:1810:F055::1/64 ipv6 enable nat64 enable To allow traffic to IPv4 only devices we use stateful nat64 with: ipv6 access-list nat64-acl sequence 20 permit ipv6 any 2001:67C:1810:F050::/96 nat64 prefix stateful 2001:67C:1810:F050::/96 nat64 v4 pool nat-pool 151.216.42.1 151.216.42.254 nat64 v6v4 list nat64-acl pool nat-pool overload This will NAT the IPv6 clients behind the 151.216.42.0/24 network range. The DNS server will lie to you and give an artificial IP. So while a normal DNS server like google's 8.8.8.8 will give the IPv4 only: $ host ipv4.imset.org 2001:67c:1810:f050::808:808 Using domain server: Name: 2001:67c:1810:f050::808:808 Address: 2001:67c:1810:f050::808:808#53 Aliases: ipv4.imset.org has address 94.23.24.89 Our resolver lies and gives the nat64 IPv6 IP too: host ipv4.imset.org 2001:67c:1810:f056::2 Using domain server: Name: 2001:67c:1810:f056::2 Address: 2001:67c:1810:f056::2#53 Aliases: ipv4.imset.org has address 94.23.24.89 ipv4.imset.org has IPv6 address 2001:67c:1810:f050::5e17:1859 Notice that to reach the IPv4 8.8.8.8 we had to lie and use 2001:67c:1810:f050::808:808 , and 94.23.24.89 in hex 5E 17 18 59 became 2001:67c:1810:f050::5e17:1859 . Alternatively we could also have used 2001:67c:1810:f050::8.8.8.8 (depending on the support in the OS for this notation). We can check that it works with: asr1k#show nat64 mappings dynamic Dynamic mappings configured: 1 Direction ID ACL Pool Flags RG ID Mapping ID v6v4 3 nat64-acl nat-pool 0x00000001 (overload) 0 0 asr1k#show nat64 pools Pools configured: 1 Protocol HSL ID Name Is Single Range Ranges IPv4 3 nat-pool TRUE (151.216.42.1 - 151.216.42.254) 151.216.42.1 - 151.216.42.254 asr1k#show nat64 prefix stateful global Global Stateful Prefix: is valid, 2001:67C:1810:F050::/96 IFs Using Global Prefix Gi0/0/0 Gi0/0/3.1400 Gi0/0/3.1402 Gi0/0/3.1401 asr1k#show nat64 statistics mapping dynamic NAT64 Statistics Dynamic Mapping Statistics v6v4 access-list nat64-acl pool nat-pool refcount 4196 pool nat-pool: start 151.216.42.1 end 151.216.42.254 total addresses 254, allocated 1 (0%) address exhaustion packet count 0 asr1k#show nat64 statistics global NAT64 Statistics Total active translations: 4062 (0 static, 4062 dynamic; 4062 extended) Sessions found: 2632830 Sessions created: 10314 Expired translations: 6251 Global Stats: Packets translated (IPv4 -> IPv6) Stateless: 0 Stateful: 1971206 MAP-T: 0 Packets translated (IPv6 -> IPv4) Stateless: 0 Stateful: 671944 MAP-T: 0 asr1k#show nat64 translations port 80 total Total number of translations: 2008 To check connections for a certain IPv6 IP use: asr1k#show nat64 translations v6 original 2001:67c:1810:f051:e984:cbe2:d169:8ded verbose Proto Original IPv4 Translated IPv4 Translated IPv6 Original IPv6 ---------------------------------------------------------------------------- tcp 173.36.12.72:443 [2001:67c:1810:f050::ad24:c48]:443 151.216.42.1:4801 [2001:67c:1810:f051:e984:cbe2:d169:8ded]:49407 created: 01 Feb 2014 09:06:30, last-used: 01 Feb 2014 09:07:38, inactivity-time: 00:03:38 flags: syn-in entry-id: 0x83a976e0, use-count: 1 ... Attached is a censored 'show run' of the router, please note that we have ACL's on all interfaces mainly to count traffic.
... View more
- Tags:
- asr
- asr1k
- dual-stack
- ios_ipv6_configuration_guide
- ipv6
- ipv6_nat64
- ipv6_support_cisco_ios_device_router
- nat64
Labels:
Created by
pevaneyn
in Data Center Documents
in Data Center Documents
08-27-2013
04:59 AM
08-27-2013
04:59 AM
Hmm. The Nexus configuration is actually wrong. The "service-list wae mode closed" piece means: if there is no WCCP client to which we redirect traffic, then all traffic matching the wae ACL will be dropped. This not a replacement for the group-list argumnt on the cat6k.
... View more
03-28-2013
12:53 AM
Introduction The Web Cache Communication Protocol (WCCP) was initially designed as a component of IOS whose purpose was to intercept HTTP traffic traversing a router and redirect that traffic to a local cache with the aim of reducing access times to web sites and conserving wide area bandwidth. Typically the packets are redirected from their destination web server on the Internet to a content engine that is local to the client. In some WCCP deployment scenarios, redirection of traffic may also be required from the web server to the client. WCCP enables you to integrate content engines into your network infrastructure. With the introduction of WCCPv2 the scope of the protocol widened to include traffic types other than HTTP allowing the protocol to be used as a more general interception mechanism. In WCCPv2 clients specify the nature of the traffic to be intercepted and forwarded to external devices which are then in a position to provide services, based upon the traffic type, such as WAN optimisation and application acceleration. This document should give the current suported features and options for WCCP. It is structured per device as using a matrix would be unwealdy. For modern versions of IOS there is ' show ip wccp capabilities ' which gives more or less the same info. HW: hardware accelerated We give the minum version if > 12.4 or > 12.2(18)SXF Catalyst 7600 Minimum version: 12.2(16)SXF16 12.2(33)SXI IPv6 support: 15.1(3)S Recommended settings: IN/MASK/L2/L2 WCCP: version 1 and version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: 15.1(3)S Multicast IPv4: yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: 15.1(3)S VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full extended ACL Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: HW IPv4 Return IP Forward: HW IPv4 Return L2: 12.2(33)SRA Catalyst 6500 Sup 2T Minimum version: 15.0(1)SY IPv6 support: 15.1(1)SY Recommended settings: IN/MASK/L2/L2 WCCP: version 1 and version 2 MD5 security: Yes Closed Services: ? Variable Timers: 15.1(1)SY Configurable Router ID: 15.1(1)SY Multicast IPv4: yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: Yes VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full extended ACL Interception ACL IPv6: Full extended ACL from 15.1(1)SY IN interception: HW Out Interception: HW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: SW IPv4 Redirection WCCP GRE: HW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: HW IPv4 Return Generic GRE: HW IPv4 Return IP Forward: HW IPv4 Return L2: HW Catalyst 6500 Sup720 Minimum version: 12.2(33)SXH IPv6 support: 15.1(1)SY Recommended settings: IN/MASK/L2/L2 WCCP: version 1 and version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: 15.1(1)SY Configurable Router ID: 15.1(1)SY Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended Interception ACL IPv6: IN interception: HW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: SW IPv4 Redirection WCCP GRE: HW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: HW IPv4 Return IP Forward: HW IPv4 Return L2: HW Catalyst 6500 sup32 Minimum version: 12,2(18)SXF16 IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/IP forward WCCP: Version 1 and Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended ACL Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: SW IPv4 Redirection WCCP GRE: HW from 12.2(33)SXH before NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: HW from 12.2(33)SXH before NOT SUPPORTED IPv4 Return Generic GRE: HW IPv4 Return IP Forward: HW IPv4 Return L2: HW from 12.2(33)SXH before NOT SUPPORTED Catalyst 6500 Sup2 Minimum version: 12,2(18)SXF16 IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 1 and Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended ACL Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: HW IPv4 Return IP Forward: HW IPv4 Return L2: HW Catalyst 4500 Sup IV and V Minimum version: 12.2(46)SG IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 8 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4:NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: NOT SUPPORTED Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: NOT SUPPORTED Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: NOT SUPPORTED IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: HW Catalyst 4500 Sup VI Minimum version: 15,0(2)SG IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: Yes Configurable Router ID: Yes Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 8 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended ACL from 15.0(2)SG1 Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: HW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: NOT SUPPORTED IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: HW Catalyst 4500 Sup VII Minimum version: 15.1(1)SG IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: Yes Configurable Router ID: Yes Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 8 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: Yes VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended Interception ACL IPv6: IN interception: HW Out Interception: HW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: HW Catalyst 3750/3560 Minimum version: 12.2(46)SE IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: NOT SUPPORTED Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 8 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: No denies, denies on 3750X/E and 3560X/E above 12.2(58)SE Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: NOT SUPPORTED Exclude redirect In: NOT SUPPORTED Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: NOT SUPPORTED IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: HW Catalyst 3550 Minimum version: 12.2(46)SE IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: NOT SUPPORTED Closed Services: NOT SUPPORTED Variable Timers:NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: NOT SUPPORTED Multicast IPv6: NOT SUPPORTED Maximum number of service groups: Maximum number of routers: Maximum number of clients: Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Extended ACL, no denies Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: NOT SUPPORTED Exclude redirect In: NOT SUPPORTED Redirection Methods: MASK Assignment: HW HASH Assigment:NOT SUPPORTED IPv4 Redirection WCCP GRE: NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: NOT SUPPORTED IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: HW ISR G1 or Cisco 7200 router Minimum version: 12.4(10) IPv6 support: NOT SUPPORTED Recommended settings: IN/HASH/WCCP GRE/WCCP GRE WCCP: Version 1 and Version 2 MD5 security: Yes Closed Services: 12.4(9)T Variable Timers: NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: 15.0(1)M VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended Interception ACL IPv6: NOT SUPPORTED IN interception: SW Out Interception: SW Exclude redirect In: 12.1(3)T Redirection Methods: MASK Assignment: SW from 12.4(20)T recommended at least 12.4(24)T HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: SW from 12.4(20)T recommended at least 12.4(24)T IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: SW IPv4 Return L2: SW from 12.4(20)T recommended at least 12.4(24)T ISR G2 with NME Minimum version: 15.0(1)M1 IPv6 support: 15.2(3)T Recommended settings: WCCP: Version 1 and Version 2 MD5 security: Yes Closed Services: Yes Variable Timers: 15.2(3)T Configurable Router ID: 15.2(3)T Multicast IPv4: Yes Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: Yes VRF Aware IPv6: 15.2(3)T Interception ACL IPv4: Full Extended ACL Interception ACL IPv6: Full Extended ACL from 15.2(3)T IN interception: SW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: SW HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: SW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: IPv4 Return IP Forward: SW IPv4 Return L2: SW ISR G2 with SM-SRE Minimum version: 15.0(1)M2 IPv6 support: 15.2(3)T Recommended settings: WCCP: Version 1 and Version 2 MD5 security: Yes Closed Services: Yes Variable Timers: 15.2(3)T Configurable Router ID: 15.2(3)T Multicast IPv4: Yes Multicast IPv6:NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: Yes VRF Aware IPv6: 15.2(3)T Interception ACL IPv4: Full Extended ACL Interception ACL IPv6: Full Extended ACL from 15.2(3)T IN interception: SW Out Interception: SW Exclude redirect In: Yes Redirection Methods: MASK Assignment: SW HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: SW IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: SW IPv4 Return L2: SW Nexus 7000 Minimum version: NX-OS 4.2(1) IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NX-OS 5.1(1) Configurable Router ID: NOT SUPPORTED Multicast IPv4: NOT SUPPORTED Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: Yes VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Full Extended ACL (beware of limited TCAM space) Interception ACL IPv6: IN interception: HW Out Interception: HW Exclude redirect In: Yes Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: NOT SUPPORTED IPv4 Redirection L2: HW IPv4 Return WCCP GRE: NOT SUPPORTED IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: HW IPv4 Return L2: HW ASR1000 Minimum version: IOS-XE 2.2 IPv6 support: NOT SUPPORTED Recommended settings: IN/MASK/L2/L2 WCCP: Version 2 MD5 security: Yes Closed Services: From IOS-XE 3.1.0S Variable Timers: From IOS-XE 3.1.0S Configurable Router ID: From IOS-XE 3.1.0S Multicast IPv4: From IOS-XE 3.1.0S Multicast IPv6: NOT SUPPORTED Maximum number of service groups: 256 Maximum number of routers: 32 Maximum number of clients: 32 Interception Methods: VRF Avare IPv4: From IOS-XE 3.1.0S VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: From IOS-XE 3.1.0S: Full Extended ACL, no port ranges Interception ACL IPv6: NOT SUPPORTED IN interception: HW Out Interception: HW From IOS-XE 3.1.0S Exclude redirect In: From IOS-XE 3.1.0S Redirection Methods: MASK Assignment: HW HASH Assigment: NOT SUPPORTED IPv4 Redirection WCCP GRE: HW IPv4 Redirection L2: HW IPv4 Return WCCP GRE: HW IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: HW IPv4 Return L2: HW ASA Firewall Minimum version: 7.2(1) IPv6 support: NOT SUPPORTED Recommended settings: IN/HASH/WCCP GRE WCCP: Version 2 MD5 security: Yes Closed Services: NOT SUPPORTED Variable Timers: NOT SUPPORTED Configurable Router ID: NOT SUPPORTED Multicast IPv4: NOT SUPPORTED Multicast IPv6: NOT SUPPORTED Maximum number of service groups: Maximum number of routers: Maximum number of clients: Interception Methods: VRF Avare IPv4: NOT SUPPORTED VRF Aware IPv6: NOT SUPPORTED Interception ACL IPv4: Yes Interception ACL IPv6: NOT SUPPORTED IN interception: SW Out Interception: NOT SUPPORTED Exclude redirect In: NOT SUPPORTED Redirection Methods: MASK Assignment: NOT SUPPORTED HASH Assigment: SW IPv4 Redirection WCCP GRE: SW IPv4 Redirection L2: NOT SUPPORTED IPv4 Return WCCP GRE: SW IPv4 Return Generic GRE: NOT SUPPORTED IPv4 Return IP Forward: NOT SUPPORTED IPv4 Return L2: NOT SUPPORTED
... View more
- Tags:
- wccp
03-01-2013
02:42 AM
Hello Hoger, You should enable WAAS on the L3 interface that gets the interesting traffic, so the tunnel, not the physical port. If this is a lab environment I would start by enabling the WAAS Express debugs on the device: log debug output on the console or to a syslog server and do: debug waas auto-discovery events debug waas auto-discovery operations debug waas auto-discovery error Then try a connection. Do this of course on both routers at the same time. Do you get an interesting messages in the logs? Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
01-15-2013
04:19 AM
01-15-2013
04:19 AM
Hi, Severy things could cause the problem. For starts please have a look at http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/white_paper_c11-608042.html (the WCCP Platform support white paper). This will tell you that for a 3750 you need to use: MASK and L2 redirection. You can use a redirection ACL but it cannot contain deny entries. You can only use IN coming redirection. In The WAAS configuration this means: wccp tcp-promiscuous router-list-num 1 l2-redirect l2-return mask-assign There is no need to configure other options. The IP used in the router list must be L2 adjacent to the WAE. After configuring this on all WAE devices please shutdown the WCCP on the switch and then turn it back on again after waiting for a minute or two. Then the WCCP should work correctly. Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
09-21-2012
03:38 AM
09-21-2012
03:38 AM
Hello Zubair, This is a rather ugly cosmetic problem. The root cause is that you should do: conf t
accelerator cifs preposition remove 19927 This will remove the preposition. The 'no ...' syntax is in fact not supported. Hope this helps, Peter
... View more
08-24-2012
02:09 AM
Hello Hal, Be aware that if you turn on SMB signing the optimzations performed will only be TFO/DRE/LZ. The signed SMB/SMBv2traffic is optimized, not accelerated with SMB AO like unsigned SMB/SMBv2 traffic. We know this is confusing, whence: CSCub42695. I hope answers at least some of your questions. Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-24-2012
01:57 AM
08-24-2012
01:57 AM
Hi, With 'not showing' do you mean: not visible at all or not active and alive? What happens if you try a deregister force on the wave and try to do an identity recovery afterwards? Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-23-2012
11:33 PM
08-23-2012
11:33 PM
Hello Kevin, Is wccp smart enough to redirect the return traffic, or do you have to specify both directions in the redirect ACL? In the example you gave above, you only match single direction. No WCCP is not that smart, because you do not want to redirect the traffic in both directions in all cases. You need two WCCP services, with mirrored access-lists, to redirected both directions. Just like WAAS does. This is because WAAS does not terminate the connection, it only modifies the packets in flight. (more of less packets might appear on the WAN then on the LAN, but from a connection point of view it remains the same IP/port combination) To only see one direction, for example for web caching, you only need one service. In this case ACNS for example terminates the connection and there is no real return traffic, because the ACNS will go out and get the data with its own IP. Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-22-2012
08:12 AM
08-22-2012
08:12 AM
Hello Kevin, Exactly right. High CPU is sometimes caused by the WCCP client who keeps sending requests to redirect traffic, causing the switch to spend a lot of time analysing and rejecting these requests. show processes cpu sorted 1min often will tell you more. Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-22-2012
08:10 AM
08-22-2012
08:10 AM
Hello Jorge, I would go through the steps outlined in the troubleshooting document at http://docwiki.cisco.com/wiki/Cisco_WAAS_Troubleshooting_Guide_for_Release_4.1.3_and_Later_--_Troubleshooting_WCCP which is pretty detailed. For the 3550 you can check the TCAM utilization with: remote command all show platform tcam util asic all and the contents of said TCAM with: show platform forward ip tcp 0 but first always check the SDM template selected, as this is often the cause of the problem. Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-22-2012
08:05 AM
08-22-2012
08:05 AM
Hello Kevin, 1. What do you mean by "If the parameters are not ok you either get software redirection/return or WCCP fails"? What kinds of parameters are considered not ok...could you please give me an example? I just want to make sure our switches handle wccp in hardware. For example on the ASR1000 if the client wants to use the HASH method the switch will reject this. On the Catalyst 6500 however it will accept this and process the traffic in software. A good way to determine if the processing is in software or hardware is to generate a decent amount of traffic and then monitor the CPU of the device. If it goes up and down with the traffic load then it is processed in software. 2. Does the option "accelerated" do anything at all? Even when I specify it, it doesn't show up in running-config on a 3560: This was only usefull for WCCP version 1 3. You had said most of the parameters are determined by the lead WCCP client. So what happens if the client's parameters deviate from the "standard" in terms of what a service group is supposed to do? Would the router accept or reject the parameters? I'm asking because we may have non-Cisco products that don't follow the "standard". If it is just regarding the WCCP id's then there is no problem, if this is regarding the rest of the WCCP standard you might have a problem. Please note that in more recent versions we introduced WCCP variable timers, which might cause problems for non-CIsco WCCP clients. Service groups 61 & 62 are defined as "tcp-promiscuous" because that's how WAAS is implemented, correct? Correct During the wccp negotiation, does the cache (WAAS) instruct the router how a service group behaves (61&62 = tcp), or does the IOS device have "built-in" intelligence that knows they're supposed to redirect all tcp traffic? All of this information comes from the lead WCCP client, in this case the WAAS device. Just trying to understand if the dynamic groups in table in https://supportforums.cisco.com/thread/2067558 is just a guideline, or if all vendors must use the standard group numbers. Just a guideline. With WAAS 5.0.1 and multiple WCCP groups it is even outdated. 4. currently the timers are 10sec/30sec for hello/dead. Is there any plan to allow custom values, such as 1sec/3sec? We'd like to be able to detect a cache failure faster than 30 seconds. See above Best regards, Peter
... View more
Created by
pevaneyn
in Application Networking
in Application Networking
08-21-2012
11:53 PM
08-21-2012
11:53 PM
Hello Ramraj, The limitations of the ASA are due to the design objectives. The WCCP support on the ASA was intented only to support web caching/filtering devices on the VLAN of the client devices. So no other features were implemented or tested. Because of this limited scope we also did not use the WCCP parts from IOS as porting that would be more complex then doing the limited WCCP. In short the account teams told the developers that we needed limited WCCP support and that is what we got. So if you think this is not what you want then feel free to talk to your account team... Best regards, Peter
... View more
Created by
pevaneyn
in Other Network Architecture Subjects
04-03-2014 05:46 AM
04-03-2014 05:46 AM
Hi, When I see 5.3.5 and 674 I think of CSCun85976. Are you using an
inline card on that device? Oth...
02-02-2014 05:32 AM
To avoid having too much client to client traffic on your network you
can use 'ipv6 nd prefix defaul...
Created by
pevaneyn
in Networking Documents
02-01-2014 12:50 AM
02-01-2014 12:50 AM
At the Fosdem conference in 2014 we used a IPv6 only network for the
main wireless access.To configu...
Created by
pevaneyn
in Data Center Documents
08-27-2013 04:59 AM
08-27-2013 04:59 AM
Hmm. The Nexus configuration is actually wrong.The "service-list wae
mode closed" piece means:if the...
03-28-2013 12:53 AM
Introduction The Web Cache Communication Protocol (WCCP) was initially
designed as a component of IO...
03-01-2013 02:42 AM
Hello Hoger,You should enable WAAS on the L3 interface that gets the
interesting traffic, so the tun...
Created by
pevaneyn
in Application Networking
01-15-2013 04:19 AM
01-15-2013 04:19 AM
Hi,Severy things could cause the problem. For starts please have a look
at
http://www.cisco.com/en/U...
Created by
pevaneyn
in Application Networking
09-21-2012 03:38 AM
09-21-2012 03:38 AM
Hello Zubair,This is a rather ugly cosmetic problem. The root cause is
that you should do:conf t acc...
08-24-2012 02:09 AM
Hello Hal,Be aware that if you turn on SMB signing the optimzations
performed will only be TFO/DRE/L...
Created by
pevaneyn
in Application Networking
08-24-2012 01:57 AM
08-24-2012 01:57 AM
Hi, With 'not showing' do you mean: not visible at all or not active and
alive?What happens if you t...
Created by
pevaneyn
in Application Networking
08-23-2012 11:33 PM
08-23-2012 11:33 PM
Hello Kevin,Is wccp smart enough to redirect the return traffic, or do
you have to specify both dire...
Created by
pevaneyn
in Application Networking
08-22-2012 08:12 AM
08-22-2012 08:12 AM
Hello Kevin,Exactly right.High CPU is sometimes caused by the WCCP
client who keeps sending requests...
Created by
pevaneyn
in Application Networking
08-22-2012 08:10 AM
08-22-2012 08:10 AM
Hello Jorge,I would go through the steps outlined in the troubleshooting
document at
http://docwiki....
Created by
pevaneyn
in Application Networking
08-22-2012 08:05 AM
08-22-2012 08:05 AM
Hello Kevin,1. What do you mean by "If the parameters are not ok you
either get software redirection...
Created by
pevaneyn
in Application Networking
08-21-2012 11:53 PM
08-21-2012 11:53 PM
Hello Ramraj,The limitations of the ASA are due to the design
objectives.The WCCP support on the ASA...
Public Statistics
| Date Registered | 05-01-2008 09:56 PM |
| Date Last Visited | 06-20-2018 01:41 AM |
| Total Messages Posted | 97 |
| Total Helpful Votes Received | 74 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
