APPLICATION NOTE Juniper Networks WX Series Large Deployment with WCCP Off-Path Integration on Cisco Integrating Multiple Juniper Networks WX Series Application Acceleration Platforms into a Cisco Infrastructure Copyright 2009, Juniper Networks, Inc.
Table of Contents Introduction...1 Scope...1 Design Considerations...1 Lab...1 Important Technical Points...2 Juniper Networks WXC Series Application Acceleration Platforms High Availability... 2 Different Load-Balancing Modes for WCCP... 2 WCCP Different Communication Modes... 3 WCCP Unicast or Multicast Communication... 4 Important Cisco Configuration Sections...4 IOS Version... 4 WCCP Configuration... 4 Important WXC Series Configuration Sections...6 WXOS Version... 6 Data Center WXC Series Configuration... 6 Branches WXC Series Configuration... 8 Appendix: Full Cisco Configuration...9 Summary...17 About Juniper Networks...17 ii Copyright 2009, Juniper Networks, Inc.
Introduction Scope In large deployments, one of the Juniper Networks WX Series Application Acceleration Platforms (or Juniper Networks WX Stack) at the data center may not scale enough to support the throughput or all the locations. In that case, the traffic has to be distributed to multiple WX Series (or WX Stacks). There are multiple options to achieve this distribution, such as WCCP or PBR on routers. This document focuses on WCCP. Design Considerations Lab The goal of this application note is to provide you an understanding on: WCCP protocol and its different options How to configure WCCP on Cisco How to deploy Juniper Networks WX Series with WCCP off-path WCCP is a Cisco protocol also available on other network vendors, such as the Juniper Networks WX Series. Cisco enhanced its WCCP support. We recommend the minimum Cisco IOS release 12.2.33. Juniper Networks WX Series also enhanced its WCCP support. We recommend minimum 5.4.4 for WCCP Hash mode and 5.7 for WCCP Mask mode. The lab is composed of: One Data Center -- 1 Cisco 6500 router -- 1 Server -- 2 Juniper WX Series off-path (4 for high availability, HA) Two Branches -- 1 Client (in each) -- 1 of the WX Series In-Line (in each) WCCP redirects traffic to the right WXC Series Server 8.0.0.100/24 GW=8.0.0.9 DATA CENTER Cisco6500 8.0.0.9(GE1/12)/9.0.0.9(GE1/11)/10.0.0.9(GE1/10) GW=10.0.0.1 No WCCP needed on that interface WXC500 WXC-DC1A 9.0.0.10/24 WXC-DC1B 9.0.0.11/24 GW=9.0.0.9 WXC500 WXC-DC1A 9.0.0.12/24 WXC-DC1B 9.0.0.13/24 GW=9.0.0.9 WXC-DC1x are used for Branch1 WXC-DC2x are used for Branch2 Monowall 10.0.0.1/20.0.0.1/30.0.0.1 GW=10.0.0.9 WXC250 WXC-Branch1 20.0.0.10/24 GW=20.0.0.1 WXC-Branch2 30.0.0.10/24 GW=30.0.0.1 WXC250 BRANCH1 Client-Branch1 20.0.0.100/24 GW=20.0.0.1 Client-Branch2 30.0.0.100/24 GW=30.0.0.1 BRANCH2 Copyright 2009, Juniper Networks, Inc. 1
Traffic flow: Client-Branch1 to Server -- The Client-Branch1 sends traffic to the Server. -- The traffic is intercepted by the WXC-Branch1. -- The WXC-Branch1 sends that flow in its optimized tunnel to the WXC-DC1A. -- The WXC-DC1A sends the traffic to the Server. Server to Client-Branch1 Important Technical Points -- The Server sends traffic to the Client-Branch1. -- The Cisco 6500 redirects the traffic to the WXC-DC1A via WCCP. -- The WXC-DC1A sends that flow in its optimized tunnel to the WXC-Branch1. -- The WXC-Branch1 sends the traffic to the Client-Branch1. Juniper Networks WXC Series Application Acceleration Platforms High Availability At least two Juniper Networks WXC Series (WCCP Clients) per WCCP service have to be installed to provide HA. The WXC Series can be in active/active mode (load-balanced) or used in active/passive mode. In active/active mode: The WXC Series have the same priority configured and WCCP load-balances flows to both. In case of a WXC Series failure, the WCCP protocol automatically detects it (after 15 seconds) and removes it from the list. Note: WXC Series platforms have to be configured in a Cluster mode. Branch-WXCs have a tunnel established to both WXC Series and load-balance traffic to both. In case of a WXC Series failure, the branch-wxc automatically detects it (after 1 minute and 15 seconds by default) and uses only the other WXC tunnel. In active/passive mode: The WXC Series have different priorities configured and the Cisco router redirects the traffic to the first WCCP Client (WXC) connected. In case of active WCCP Client (WXC) failure, the WCCP protocol automatically detects it (after 15 seconds) and redirects the traffic to the WCCP Client (WXC) available with the highest priority. Note: WXC Series platforms don t have to be configured in a Cluster mode. Branch-WXCs have a tunnel established on both WXC Series platforms but the active WXC Series is configured as preferred decompressor. In case of a WXC Series failure, the branch-wxc automatically detects it (after 1 minute and 15 seconds by default) and uses the other WXC Series tunnel. Different Load-Balancing Modes for WCCP WCCP can share the traffic to multiple WCCP Clients (WXC). Up to four WXC Series platforms can be load-balanced in the same WCCP service. Two load-balancing modes are supported Hash mode and Mask mode: WCCP Hash mode This is the only WX Series mode supported up to WX Series Operating System release 5.6. For each flow redirected by WCCP in Hash mode, the Cisco router does a hash on the source + destination IP@ and selects the WCCP Client based on the hash result. So the same flow will always be redirected to the same WXC Series platform. WCCP Mask mode This mode is supported on the WX Series from the WXOS release 5.7. For each flow redirected by WCCP in Mask mode, Cisco does a hash on the source or the destination IP@ (by default destination) and selects the WCCP Client based on the hash result. So the all the flows for the same server IP@ will always be redirected to the same WXC Series platform. 2 Copyright 2009, Juniper Networks, Inc.
Depending on the Cisco model, both or only one WCCP mode is supported: Cisco 7200/7300/7400/7500/1800/2800/3800: WCCP Hash mode only Cisco 6500/7600: WCCP Hash and Mask mode Cisco 4500/4948: WCCP Mask mode only Cisco 3750: WCCP Mask mode only WCCP Different Communication Modes WCCP can communicate to WCCP Clients via two modes: L2 and GRE. The mode is negotiated between the WCCP Server (Cisco) and WCCP Clients (WXC Series). The WXC Series does support both, but the Cisco routers may support only one. L2 mode This mode is the most efficient, as it doesn t require encapsulation. This is the mode used if supported by the Cisco WCCP Server and if there is no router between the WXC Series and the Cisco WCCP Server. WXC3400 WXC3400 WCCP L2 communication LAN WAN GRE mode This mode encapsulates traffic in a GRE tunnel. This is the mode used if the Cisco WCCP Server does not support L2 or if there is router between the WXC Series and the Cisco WCCP Server. Note: To avoid fragmentation due to the encapsulation, we recommend reducing the MSS to 1432 on the WXC Series. WXC3400 WXC3400 WCCP GRE communication LAN WAN Depending on the Cisco model, both or only one mode is supported: Cisco 7200/7300/7400/7500/1800/2800/3800: GRE mode only Cisco 6500/7600: GRE and L2 mode supported Cisco 4500/4948: L2 mode only and no redirect lists (all traffic is redirected on the interface) Cisco 3750: L2 mode only and redirect lists with permit only Note: The redirect list allows the Cisco administrator to specify what traffic will be redirected via WCCP to the WCCP Clients. When the redirect list is not available, all traffic received on an interface will be redirected to WCCP Clients. Copyright 2009, Juniper Networks, Inc. 3
WCCP Unicast or Multicast Communication WCCP supports unicast or multicast. Multicast has to be used if multiple WCCP Servers (Cisco) will use the same WCCP Clients (WXC Series). Cisco servers and the WXC Series support both modes. But some specific configuration has to be done for multicast mode on the Cisco server. Unicast Unicast can be used when one single WCCP Server (Cisco) uses one or multiple WCCP Clients (WXC Series) WXC3400 WXC3400 WCCP Unicast communication LAN WAN GRE mode Multicast must be used when multiple WCCP Servers (Cisco) use one or multiple WCCP Clients (WXC Series) LAN WXC3400 WCCP Multicast communication WAN WXC3400 Important Cisco Configuration Sections Note: The configuration is based on a Cisco 6500. On other hardware the commands may differ slightly. IOS Version Requires at least 12.2.33 WCCP Configuration LAN The WCCP multicast specific configuration is in italics. Define a loopback IP@ if none already exists interface Loopback100 ip address 1.1.1.1 255.255.255.255 Note: Use show ip interface brief to see the Cisco s IP@ list. ACL for redirection (what to redirect to the WXC Series) Branch1 subnet = 20.0.0.0/24 access-list 101 permit ip any 20.0.0.0 0.0.0.255 Branch2 subnet = 30.0.0.0/24 access-list 102 permit ip any 30.0.0.0 0.0.0.255 4 Copyright 2009, Juniper Networks, Inc.
Note: To see what ACL matches, show access-lists. WCCP Service Service for Branch1 (in this case a multicast IP@ is used even if unicast could be used too) ip wccp 60 group-address 239.1.1.100 redirect-list 101 ip wccp 70 group-address 239.1.1.100 redirect-list 101 Service for Branch2 (in this case a multicast IP@ is used even if unicast could be used too) ip wccp 61 group-address 239.1.1.200 redirect-list 102 ip wccp 71 group-address 239.1.1.200 redirect-list 102 Note: Use show ip wccp <service-id> to see the WCCP statistics. Attention when the redirect-list is used in the configuration, the wccp statistics doesn t display the packets stats. Multicast specific configuration enable ip multicast routing ip multicast-routing igmp snooping is not supported by WXC no ip igmp snooping WCCP listen applied on the WXC interface (to detect WCCP Clients redirect - WXC Series) WXC supports the dense mode only interface GigabitEthernet1/11 ip address 9.0.0.9 255.255.255.0 ip wccp 60 group-listen ip wccp 70 group-listen ip wccp 61 group-listen ip wccp 71 group-listen ip pim sparse-dense-mode Note: Use show ip wccp <service-id> view to see the status of the WCCP Clients (WXC Series). Note: Use show ip wccp <service-id> detail to see what communication mode is used (L2 or GRE). WCCP redirection applied on the Local interface (to redirect the traffic to the WXC Series) interface GigabitEthernet1/12 ip address 8.0.0.9 255.255.255.0 ip wccp 60 redirect in ip wccp 70 redirect in ip wccp 61 redirect in ip wccp 71 redirect in Copyright 2009, Juniper Networks, Inc. 5
Important WXC Series Configuration Sections WXOS Version Requires at least 5.4.4 for WCCP Hash mode and 5.7 for WCCP Mask mode Data Center WXC Series Configuration Configure WCCP off-path packet interception Under Device Setup Advanced Packet Interception, select WCCP and define: -- The Address -- The priority [optional] -- The WCCP mode -- The Service ID On WXC-DC1A/1B: And save and reboot. Note: For active/active load balancing, define the same WCCP priority for both WXC-DC1A/1B. For active/passive load balancing, define a higher priority on WXC-DC1A. Note: In command-line interface (CLI) show packet-interception to see the WCCP status. 6 Copyright 2009, Juniper Networks, Inc.
On WXC-DC2A/2B: And save and reboot. Note: For active/active load balancing, define the same WCCP priority for both WXC-DC2A/2B. For active/passive load balancing, define a higher priority on WXC-DC2A. Note: In CLI, show packet-interception to see the WCCP status. For high availability environment, configure clusters In CLI: configure acceleration cluster add <WXC-IP@> + commit.. On WXC-DC1A: configure acceleration cluster add 9.0.0.11 + commit. On WXC-DC1B: configure acceleration cluster add 9.0.0.10 + commit. On WXC-DC2A: configure acceleration cluster add 9.0.0.13 + commit. On WXC-DC2B: configure acceleration cluster add 9.0.0.12 + commit Note: To see cluster status, in CLI show acceleration cluster status. Copyright 2009, Juniper Networks, Inc. 7
Branches WXC Series Configuration For High Availability environment, configure Preferred Decompressors Under Compression Advanced Preferred Decompressors, add WXC-DCxA: Note: The IP@ for Branch2 would be 9.0.0.12. 8 Copyright 2009, Juniper Networks, Inc.
Appendix: Full Cisco Configuration cat-1#show configuration Using 5812 out of 1964024 bytes upgrade fpd auto version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption service counters max age 5 hostname cat-1 boot-start-marker boot system disk0:s72033-adventerprisek9_wan-mz.122-33.sxh3a.bin boot-end-marker enable password juniper no aaa new-model call-home alert-group configuration alert-group diagnostic alert-group environment alert-group inventory alert-group syslog profile CiscoTAC-1 no active no destination transport-method http destination transport-method email destination address email callhome@cisco.com destination address http https://tools.cisco.com/its/service/oddce/services/ddceservice subscribe-to-alert-group diagnostic severity minor subscribe-to-alert-group environment severity minor subscribe-to-alert-group syslog severity major pattern.* subscribe-to-alert-group configuration periodic monthly 19 16:13 subscribe-to-alert-group inventory periodic monthly 19 15:58 ip subnet-zero ip wccp 60 group-address 239.1.1.100 redirect-list 101 Copyright 2009, Juniper Networks, Inc. 9
ip wccp 61 group-address 239.1.1.200 redirect-list 102 ip wccp 70 group-address 239.1.1.100 redirect-list 101 ip wccp 71 group-address 239.1.1.200 redirect-list 102 ip multicast-routing no ip igmp snooping ipv6 mfib hardware-switching replication-mode ingress no mls acl tcam share-global mls netflow interface no mls flow ip no mls flow ipv6 mls cef error action freeze redundancy keepalive-enable mode sso main-cpu auto-sync running-config spanning-tree mode pvst diagnostic cns publish cisco.cns.device.diag_results diagnostic cns subscribe cisco.cns.device.diag_commands fabric timer 15 vlan internal allocation policy ascending vlan access-log ratelimit 2000 10 Copyright 2009, Juniper Networks, Inc.
interface Loopback100 ip address 1.1.1.1 255.255.255.255 interface GigabitEthernet1/1 interface GigabitEthernet1/2 interface GigabitEthernet1/3 interface GigabitEthernet1/4 interface GigabitEthernet1/5 interface GigabitEthernet1/6 interface GigabitEthernet1/7 interface GigabitEthernet1/8 interface GigabitEthernet1/9 Copyright 2009, Juniper Networks, Inc. 11
interface GigabitEthernet1/10 ip address 10.0.0.9 255.255.255.0 interface GigabitEthernet1/11 ip address 9.0.0.9 255.255.255.0 ip wccp 60 group-listen ip wccp 61 group-listen ip wccp 70 group-listen ip wccp 71 group-listen ip pim sparse-dense-mode interface GigabitEthernet1/12 ip address 8.0.0.9 255.255.255.0 ip wccp 60 redirect in ip wccp 61 redirect in ip wccp 70 redirect in ip wccp 71 redirect in interface GigabitEthernet1/13 interface GigabitEthernet1/14 interface GigabitEthernet1/15 interface GigabitEthernet1/16 interface GigabitEthernet1/17 ip address 8.0.0.9 255.255.255.0 interface GigabitEthernet1/18 12 Copyright 2009, Juniper Networks, Inc.
interface GigabitEthernet1/19 interface GigabitEthernet1/20 interface GigabitEthernet1/21 interface GigabitEthernet1/22 interface GigabitEthernet1/23 interface GigabitEthernet1/24 interface GigabitEthernet1/25 interface GigabitEthernet1/26 interface GigabitEthernet1/27 interface GigabitEthernet1/28 Copyright 2009, Juniper Networks, Inc. 13
interface GigabitEthernet1/29 interface GigabitEthernet1/30 interface GigabitEthernet1/31 interface GigabitEthernet1/32 interface GigabitEthernet1/33 interface GigabitEthernet1/34 interface GigabitEthernet1/35 interface GigabitEthernet1/36 interface GigabitEthernet1/37 interface GigabitEthernet1/38 14 Copyright 2009, Juniper Networks, Inc.
interface GigabitEthernet1/39 interface GigabitEthernet1/40 interface GigabitEthernet1/41 interface GigabitEthernet1/42 interface GigabitEthernet1/43 interface GigabitEthernet1/44 interface GigabitEthernet1/45 interface GigabitEthernet1/46 interface GigabitEthernet1/47 interface GigabitEthernet1/48 Copyright 2009, Juniper Networks, Inc. 15
interface GigabitEthernet6/1 interface GigabitEthernet6/2 interface Vlan1 ip classless ip route 0.0.0.0 0.0.0.0 10.0.0.1 no ip http server no ip http secure-server access-list 101 permit ip any 20.0.0.0 0.0.0.255 access-list 102 permit ip any 30.0.0.0 0.0.0.255 control-plane dial-peer cor custom line con 0 line vty 0 4 password juniper login 16 Copyright 2009, Juniper Networks, Inc.
transport input lat pad mop udptn telnet rlogin ssh nasi acercon line vty 5 15 login transport input lat pad mop udptn telnet rlogin ssh nasi acercon end Summary Our Off-Path integration capabilities allow Juniper to provide very high scalability and support very large deployments. This Solution Implementation Guide details how to implement WCCP Off-Path integration with Cisco. About Juniper Networks Juniper Networks, Inc. is the leader in high-performance networking. Juniper offers a high-performance network infrastructure that creates a responsive and trusted environment for accelerating the deployment of services and applications over a single network. This fuels high-performance businesses. Additional information can be found at www.juniper.net. Corporate And Sales Headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA Phone: 888.JUNIPER (888.586.4737) or 408.745.2000 Fax: 408.745.2100 APAC Headquarters Juniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King s Road Taikoo Shing, Hong Kong Phone: 852.2332.3636 Fax: 852.2574.7803 To purchase Juniper Networks solutions, please contact your Juniper Networks representative at 1-866-298-6428 or authorized reseller. EMEA Headquarters Juniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: 35.31.8903.600 Fax: 35.31.8903.601 Copyright 2009 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. Engineered for the network ahead and JUNOSe are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 3500144-001-EN Feb 2009 Printed on recycled paper. 17