Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jeffreykolek
Stats
Member since
03-28-2011
4
Posts
0
Helpful
0
Solutions
05-31-2011
02:15 PM
That is a great question. We have many different VLAN's relating to different physical locations and/or security VLAN's inbound on both 6500's. There would be about 40 or 50 "redirect In's" assigned to each of the inbound interfaces on both 6500's. I am new at WCCP and learning via the school of hard knocks and incorrect configurations, so I don't know the answer to this: would that be something that would be considered best practice? Due to needing to configure this on many (but not all) interfaces on both 6500's, the configuration maintenance would be high, but I will definitely add that to the list of possibilities. Our team is viewing the answers and we are discussing all possibilities. Thank you Edison!
... View more
05-31-2011
01:53 PM
Hello all, We are trying to implement WCCP to redirect traffic to a URL Filtering device and we want to do the redirect prior to the traffic getting to the ASA. Therefore, we can’t use the URL redirect on the ASA. Our issue is this – we have two core switches (6513) with the same VLAN’s configured on both, but they have different switches and servers attached to each using different interface configurations – so they are NOT identical (i.e., not candidates for Active/Standby configuration). Both switches connect to a single interconnect switch which then connects to ASA firewalls (Active/Standby). The outbound traffic from each core switch is on the same VLAN. We attempted to do a “WCCP redirect in” using a VLAN IP address on the interconnect switch, but it seems the packets never got to the L3 level and traffic was never redirected. Without further confusing the issue, here are the important parts of each config of the Cisco devices: Core Switch 1 (6513): interface GigabitEthernet1/9 description to Interconnect switch - Interface Gi 1/0/27 switchport switchport access vlan 1 switchport mode access no ip address interface Vlan1 ip address 192.168.1.252 255.255.255.0 standby 1 ip 192.168.1.254 standby 1 preempt router eigrp 801 redistribute static network 192.168.0.0 0.0.255.255 ! ip route 0.0.0.0 0.0.0.0 192.168.2.251 (address of the inside interface of the ASA) Core Switch 2 (6513) interface GigabitEthernet1/16 description to Interconnect switch - Interface Gi 1/0/25 switchport switchport access vlan 1 switchport mode access no ip address interface Vlan1 ip address 192.168.1.253 255.255.255.0 standby 1 ip 192.168.1.254 (same standby address as other core switch so we can use a single route and gateway statement) standby 1 preempt router eigrp 801 redistribute static network 192.168.0.0 0.0.255.255 ! ip route 0.0.0.0 0.0.0.0 192.168.2.251 (address of the inside interface of the ASA) Interconnect Switch (3750) ip wccp 0 ip wccp 70 interface GigabitEthernet1/0/1 description to Web Cache device for WCCP redirected traffic (at 192.168.1.213) switchport mode access interface GigabitEthernet1/0/25 description from Core Switch 2 interface Gi1/16 switchport ip wccp 0 redirect in ip wccp 70 redirect in ! interface GigabitEthernet1/0/26 description to Primary Firewall Inside interface switchport trunk encapsulation dot1q ! interface GigabitEthernet1/0/27 description to Core Switch 1 interface Gi1/9 switchport ip wccp 0 redirect in ip wccp 70 redirect in ! interface GigabitEthernet1/0/28 description to Standby Firewall Inside interface switchport trunk encapsulation dot1q interface Vlan1 ip address 192.168.1.249 255.255.255.0 ip default-gateway 192.168.1.254 ASA Firewall (ASA 5520) interface GigabitEthernet1/0 nameif inside ip address 192.168.2.251 255.255.255.0 standby 192.168.2.250 route inside 192.168.1.0 255.255.255.0 192.168.1.254 1 Using this configuration, WCCP is enabled and recognizes the url filter device as a valid web cache when doing a “show ip wccp”. Traffic is successfully accessing internet sites. However, no packets are ever redirected – WCCP packet count always remains at zero and no HTTP or HTTPS traffic ever gets to the URL Filter/Web-cache device. It seems that the packets never get to L3 so WCCP never kicks in. A few things we can try to do are: 1. Try to enable WCCP on the inside interface of the ASA (but we need to ensure that LAN usernames are still identifiable) 2. Do a “ip wccp 0 redirect out” on the outbound interface of each core switch (although it’s recommended by Cisco experts to NOT do redirect out’s due to CEF overhead issues) It seems that all examples I see from Cisco deal with a single switch attached to a single router (or layer 3 switch) attached to a single firewall. Any suggestions on how to connect two disparate switches to a single interconnect switch and get WCCP redirect IN’s working on the interconnect switch? Or any other suggestions besides the two I posted above to get the this to work? Thanks for any and all assistance the community can provide!
... View more
Labels:
Created by
jeffreykolek
in Switching
in Switching
03-29-2011
09:08 AM
03-29-2011
09:08 AM
Thank you Ian! It was the ip route I needed to define on the 3560 back to the 6506 that did the trick. These IP ROUTES are killing me everytime... :-) You are a gentleman and a scholar sir!
... View more
03-28-2011
05:28 PM
Hello all, We have some spare equipment and I'm trying to access the internet via our production LAN, from a test LAN. I have a 6506 as our core switch, a 3560 acting as a Layer 3 switch connected to the 650 and an ASA 5520 firewall. I will post all configs below. First, the connections: GigabitEthernet3/1 on the 6506 is directly connected to GigabitEthernet0/25 on the 3560. (our test LAN) GigabitEthernet0/26 on the 3560 is directly connected GigabitEthernet0/1 on the ASA, which is designated as the Inside interface. (The internet access "router") GigabitEthernet0/0 on the ASA (outside) is directly connected to the Production Core switch, which is a 6513. (the firewall prior to the "internet") Also, VLAN 500 with an ip address of 10.50.0.254 is defined on the Production 6513 so that the NAT address from the test ASA will be able to communicate In the configurations below, I can successfully ping all production IP addresses from both the ASA and the 3560 (they are 192.168.x.x IP's) I can successfully ping the IP addresses on the 3560 and the inside interface of the ASA from the 6506. I cannot ping production IP addresses from the 6506 - basically anything outside the firewall. I know it's something simple that I'm missing. Here are configs for each. Note that on the 6506, I can't enter switchport trunk encapsulation dot1q but when I check the capabilities of the interfaces, they are all dot1q enabled: 6506: vtp domain domain-name vtp mode transparent ip subnet-zero ! vlan 120 ! interface GigabitEthernet3/1 description To 3560 Gi0/25 switchport trunk native vlan 120 switchport mode trunk ! interface Vlan1 no ip address shutdown ! interface Vlan120 ip address 10.10.20.254 255.255.255.0 ! ip classless ip route 0.0.0.0 0.0.0.0 10.10.20.1 3560: vtp domain domain-name vtp mode transparent ip routing ! vlan 120 ! interface GigabitEthernet0/25 description From 6506 Gi3/1 switchport trunk encapsulation dot1q switchport trunk native vlan 120 ! interface GigabitEthernet0/26 description To ASA inside interface no switchport ip address 10.10.40.254 255.255.255.0 ! interface Vlan1 no ip address shutdown ! interface Vlan120 ip address 10.10.20.1 255.255.255.0 ! ip classless ip route 0.0.0.0 0.0.0.0 10.10.40.1 ASA 5520: interface GigabitEthernet0/0 nameif outside security-level 0 ip address 10.50.0.1 255.255.255.0 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.10.40.1 255.255.255.0 ! same-security-traffic permit intra-interface access-list traffic_out extended permit ip any any access-list traffic_in extended permit ip any any ! global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 access-group traffic_in in interface outside access-group traffic_out out interface inside route outside 0.0.0.0 0.0.0.0 10.50.0.254 1 That's all. I'll crank down the security on the firewall if I can ever get the test 6506 to communicate with production. Thank you for any help on this annoying and probably extremely simple problem.... This is my first post ever, so please let me know if I didn't do something correctly :-)
... View more
Labels:
05-31-2011
That is a great question.We have many different VLAN's relating to
different physical locations and/...
05-31-2011
Hello all,We are trying to implement WCCP to redirect traffic to a URL
Filtering device and we want ...
03-29-2011
Thank you Ian! It was the ip route I needed to define on the 3560 back
to the 6506 that did the tric...
Public Statistics
| Date Registered | 03-28-2011 04:30 PM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 4 |
