Juniper Networks WX Series Large Deployment with WCCP Off ... · appLiCation note - Juniper...

APPLICATION NOTE

Copyright © 2009, Juniper Networks, Inc.

Juniper networks wX series Large DepLoyment with wCCp off-path integration on CisCo

Integrating Multiple Juniper Networks WX Series Application Acceleration Platforms into a Cisco Infrastructure

ii Copyright © 2009, Juniper Networks, Inc.

appLiCation note - Juniper networks wX series Large Deployment with wCCp off-path integration on Cisco

Table of Contentsintroduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Design Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

important technical points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Juniper Networks WXC Series Application Acceleration Platforms High Availability . . . . . . . . . . . . . . . . . . . . . . . . 2

Different Load-Balancing Modes for WCCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

WCCP Different Communication Modes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

WCCP Unicast or Multicast Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

important Cisco Configuration sections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

IOS Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

WCCP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

important wXC series Configuration sections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

WXOS Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Data Center WXC Series Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Branches WXC Series Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

appendix: full Cisco Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

about Juniper networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Copyright © 2009, Juniper Networks, Inc. 1


IntroductionIn large deployments, one of the Juniper Networks® WX Series Application Acceleration Platforms (or Juniper Networks WX Stack) at the data center may not scale enough to support the throughput or all the locations.

In that case, the traffic has to be distributed to multiple WX Series (or WX Stacks). There are multiple options to achieve this distribution, such as WCCP or PBR on routers.

This document focuses on WCCP.

ScopeThe goal of this application note is to provide you an understanding on:

WCCP protocol and its different options•

How to configure WCCP on Cisco•

How to deploy Juniper Networks WX Series with WCCP off-path•

Design ConsiderationsWCCP is a Cisco protocol also available on other network vendors, such as the Juniper Networks WX Series.

Cisco enhanced its WCCP support. We recommend the minimum Cisco IOS release 12.2.33.

Juniper Networks WX Series also enhanced its WCCP support. We recommend minimum 5.4.4 for WCCP Hash mode and 5.7 for WCCP Mask mode.

LabThe lab is composed of:

One Data Center•

1 Cisco 6500 router -

1 Server -

2 Juniper WX Series off-path (4 for high availability, HA) -

Two Branches•

1 Client (in each) -

1 of the WX Series In-Line (in each) -

WXC500

WXC-DC1A9.0.0.10/24WXC-DC1B9.0.0.11/24GW=9.0.0.9

Server8.0.0.100/24GW=8.0.0.9

Client-Branch120.0.0.100/24GW=20.0.0.1

WXC-Branch120.0.0.10/24GW=20.0.0.1

Cisco65008.0.0.9(GE1/12)/9.0.0.9(GE1/11)/10.0.0.9(GE1/10)

GW=10.0.0.1

WXC500

WXC250

BRANCH2

DATA CENTER

BRANCH1

WXC250

WXC-DC1A9.0.0.12/24WXC-DC1B9.0.0.13/24GW=9.0.0.9

WCCP redirects traffic to the right WXC Series

No WCCP needed on that interface

WXC-DC1x are used for Branch1WXC-DC2x are used for Branch2

Client-Branch230.0.0.100/24GW=30.0.0.1

Monowall10.0.0.1/20.0.0.1/30.0.0.1GW=10.0.0.9

WXC-Branch230.0.0.10/24GW=30.0.0.1

2 Copyright © 2009, Juniper Networks, Inc.


Traffic flow:

Client-Branch1 to Server•

The Client-Branch1 sends traffic to the Server. -

The traffic is intercepted by the WXC-Branch1. -

The WXC-Branch1 sends that flow in its optimized tunnel to the WXC-DC1A. -

The WXC-DC1A sends the traffic to the Server. -

Server to Client-Branch1•

The Server sends traffic to the Client-Branch1. -

The Cisco 6500 redirects the traffic to the WXC-DC1A via WCCP. -

The WXC-DC1A sends that flow in its optimized tunnel to the WXC-Branch1. -

The WXC-Branch1 sends the traffic to the Client-Branch1. -

Important Technical PointsJuniper Networks WXC Series Application Acceleration Platforms High AvailabilityAt least two Juniper Networks WXC Series (WCCP Clients) per WCCP service have to be installed to provide HA.

The WXC Series can be in active/active mode (load-balanced) or used in active/passive mode.

In active/active mode:•

The WXC Series have the same priority configured and WCCP load-balances flows to both. In case of a WXC Series failure, the WCCP protocol automatically detects it (after 15 seconds) and removes it from the list.

Note: WXC Series platforms have to be configured in a Cluster mode.

Branch-WXCs have a tunnel established to both WXC Series and load-balance traffic to both. In case of a WXC Series failure, the branch-WXC automatically detects it (after 1 minute and 15 seconds by default) and uses only the other WXC tunnel.

In active/passive mode:•

The WXC Series have different priorities configured and the Cisco router redirects the traffic to the first WCCP Client (WXC) connected. In case of active WCCP Client (WXC) failure, the WCCP protocol automatically detects it (after 15 seconds) and redirects the traffic to the WCCP Client (WXC) available with the highest priority.

Note: WXC Series platforms don’t have to be configured in a Cluster mode.

Branch-WXCs have a tunnel established on both WXC Series platforms but the active WXC Series is configured as preferred decompressor. In case of a WXC Series failure, the branch-WXC automatically detects it (after 1 minute and 15 seconds by default) and uses the other WXC Series tunnel.

Different Load-Balancing Modes for WCCPWCCP can share the traffic to multiple WCCP Clients (WXC). Up to four WXC Series platforms can be load-balanced in the same WCCP service.

Two load-balancing modes are supported—Hash mode and Mask mode:

WCCP Hash mode•

This is the only WX Series mode supported up to WX Series Operating System release 5.6.

For each flow redirected by WCCP in Hash mode, the Cisco router does a hash on the source + destination IP@ and selects the WCCP Client based on the hash result. So the same flow will always be redirected to the same WXC Series platform.

WCCP Mask mode•

This mode is supported on the WX Series from the WXOS release 5.7.

For each flow redirected by WCCP in Mask mode, Cisco does a hash on the source or the destination IP@ (by default destination) and selects the WCCP Client based on the hash result. So the all the flows for the same server IP@ will always be redirected to the same WXC Series platform.



Depending on the Cisco model, both or only one WCCP mode is supported:

Cisco 7200/7300/7400/7500/1800/2800/3800: WCCP Hash mode only•

Cisco 6500/7600: WCCP Hash and Mask mode•

Cisco 4500/4948: WCCP Mask mode only•

Cisco 3750: WCCP Mask mode only•

WCCP Different Communication ModesWCCP can communicate to WCCP Clients via two modes: L2 and GRE. The mode is negotiated between the WCCP Server (Cisco) and WCCP Clients (WXC Series). The WXC Series does support both, but the Cisco routers may support only one.

L2 mode•

This mode is the most efficient, as it doesn’t require encapsulation.

This is the mode used if supported by the Cisco WCCP Server and if there is no router between the WXC Series and the Cisco WCCP Server.

GRE mode•

This mode encapsulates traffic in a GRE tunnel.

This is the mode used if the Cisco WCCP Server does not support L2 or if there is router between the WXC Series and the Cisco WCCP Server.

Note: To avoid fragmentation due to the encapsulation, we recommend reducing the MSS to 1432 on the WXC Series.

Depending on the Cisco model, both or only one mode is supported:

Cisco 7200/7300/7400/7500/1800/2800/3800: GRE mode only•

Cisco 6500/7600: GRE and L2 mode supported•

Cisco 4500/4948: L2 mode only and no redirect lists (all traffic is redirected on the interface)•

Cisco 3750: L2 mode only and redirect lists with permit only•

Note: The redirect list allows the Cisco administrator to specify what traffic will be redirected via WCCP to the WCCP Clients. When the redirect list is not available, all traffic received on an interface will be redirected to WCCP Clients.

WXC3400

LAN WAN

WXC3400

WCCP L2communication

WXC3400

LAN WAN

WXC3400

WCCP GREcommunication



WCCP Unicast or Multicast CommunicationWCCP supports unicast or multicast.

Multicast has to be used if multiple WCCP Servers (Cisco) will use the same WCCP Clients (WXC Series). Cisco servers and the WXC Series support both modes. But some specific configuration has to be done for multicast mode on the Cisco server.

Unicast•

Unicast can be used when one single WCCP Server (Cisco) uses one or multiple WCCP Clients (WXC Series)

GRE mode•

Multicast must be used when multiple WCCP Servers (Cisco) use one or multiple WCCP Clients (WXC Series)

Important Cisco Configuration Sections Note: The configuration is based on a Cisco 6500. On other hardware the commands may differ slightly.

IOS VersionRequires at least 12.2.33•

WCCP ConfigurationThe WCCP multicast specific configuration is in italics.

Define a loopback ip@ if none already exists•

interface Loopback100

ip address 1.1.1.1 255.255.255.255

Note: Use “show ip interface brief” to see the Cisco’s IP@ list.

aCL for redirection (what to redirect to the wXC series)•

!Branch1 subnet = 20.0.0.0/24

access-list 101 permit ip any 20.0.0.0 0.0.0.255

!Branch2 subnet = 30.0.0.0/24


WXC3400

LAN WAN

WXC3400

WCCP Unicastcommunication

WXC3400

WXC3400

LAN

LAN

WANWCCP Multicastcommunication



Note: To see what ACL matches, “show access-lists.”

wCCp service•

! Service for Branch1 (in this case a multicast IP@ is used – even if unicast could be used too)

ip wccp 60 group-address 239.1.1.100 redirect-list 101


! Service for Branch2 (in this case a multicast IP@ is used – even if unicast could be used too)



Note: Use “show ip wccp <service-id>” to see the WCCP statistics. Attention when the redirect-list is used in the configuration, the wccp statistics doesn’t display the packets stats.

multicast specific configuration•

!enable ip multicast routing

ip multicast-routing

!igmp snooping is not supported by WXC

no ip igmp snooping

wCCp listen applied on the “wXC” interface (to detect wCCp Clients redirect - wXC series)•

! WXC supports the dense mode only

interface GigabitEthernet1/11

ip address 9.0.0.9 255.255.255.0

ip wccp 60 group-listen




ip pim sparse-dense-mode

Note: Use “show ip wccp <service-id> view” to see the status of the WCCP Clients (WXC Series).

Note: Use “show ip wccp <service-id> detail” to see what communication mode is used (L2 or GRE).

wCCp redirection applied on the “Local” interface (to redirect the traffic to the wXC series)•


ip address 8.0.0.9 255.255.255.0

ip wccp 60 redirect in






Important WXC Series Configuration Sections WXOS Version

Requires at least 5.4.4 for WCCP Hash mode and 5.7 for WCCP Mask mode•

Data Center WXC Series ConfigurationConfigure wCCp off-path packet interception •Under “Device Setup – Advanced – Packet Interception,” select WCCP and define:

The Address -

The priority [optional] -

The WCCP mode -

The Service ID -

On WXC-DC1A/1B:

And save and reboot.

Note: For active/active load balancing, define the same WCCP priority for both WXC-DC1A/1B. For active/passive load balancing, define a higher priority on WXC-DC1A.

Note: In command-line interface (CLI) “show packet-interception” to see the WCCP status.



On WXC-DC2A/2B:

And save and reboot.

Note: For active/active load balancing, define the same WCCP priority for both WXC-DC2A/2B. For active/passive load balancing, define a higher priority on WXC-DC2A.

Note: In CLI, “show packet-interception” to see the WCCP status.

for high availability environment, configure clusters •In CLI: “configure acceleration cluster add <WXC-IP@>” + “commit”.

. On WXC-DC1A: “configure acceleration cluster add 9.0.0.11” + “commit”

. On WXC-DC1B: “configure acceleration cluster add 9.0.0.10” + “commit”

. On WXC-DC2A: “configure acceleration cluster add 9.0.0.13” + “commit”

. On WXC-DC2B: “configure acceleration cluster add 9.0.0.12” + “commit”

Note: To see cluster status, in CLI “show acceleration cluster status.”



Branches WXC Series Configurationfor high availability environment, configure preferred Decompressors •Under “Compression – Advanced – Preferred Decompressors,” add WXC-DCxA:

Note• : The IP@ for Branch2 would be 9.0.0.12.



Appendix: Full Cisco Configuration

cat-1#show configuration

Using 5812 out of 1964024 bytes

!

upgrade fpd auto

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

service counters max age 5

!

hostname cat-1

!

boot-start-marker

boot system disk0:s72033-adventerprisek9_wan-mz.122-33.SXH3a.bin

boot-end-marker

!

enable password juniper

!

no aaa new-model

call-home

alert-group configuration

alert-group diagnostic

alert-group environment

alert-group inventory

alert-group syslog

profile “CiscoTAC-1”

no active

no destination transport-method http

destination transport-method email

destination address email [email protected]

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

subscribe-to-alert-group diagnostic severity minor

subscribe-to-alert-group environment severity minor

subscribe-to-alert-group syslog severity major pattern “.*”

subscribe-to-alert-group configuration periodic monthly 19 16:13

subscribe-to-alert-group inventory periodic monthly 19 15:58

ip subnet-zero







!

!

!

ip multicast-routing

no ip igmp snooping

ipv6 mfib hardware-switching replication-mode ingress

!

no mls acl tcam share-global

mls netflow interface

no mls flow ip

no mls flow ipv6

mls cef error action freeze

!

!

!

!

!

!

!

!

!

!

redundancy

keepalive-enable

mode sso

main-cpu

auto-sync running-config

spanning-tree mode pvst

diagnostic cns publish cisco.cns.device.diag_results

diagnostic cns subscribe cisco.cns.device.diag_commands

fabric timer 15

!

vlan internal allocation policy ascending

vlan access-log ratelimit 2000

!

!

!



!

!

interface Loopback100

ip address 1.1.1.1 255.255.255.255

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown



!


ip address 10.0.0.9 255.255.255.0

!


ip address 9.0.0.9 255.255.255.0





ip pim sparse-dense-mode

!


ip address 8.0.0.9 255.255.255.0





!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


ip address 8.0.0.9 255.255.255.0

shutdown

!




no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!




no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!




no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!




Corporate and sales headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA Phone: 888.JUNIPER (888.586.4737) or 408.745.2000 Fax: 408.745.2100

apaC headquartersJuniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King’s Road Taikoo Shing, Hong Kong Phone: 852.2332.3636 Fax: 852.2574.7803

emea headquartersJuniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: 35.31.8903.600 Fax: 35.31.8903.601

Copyright 2009 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. “Engineered for the network ahead” and JUNOSe are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

3500144-001-EN Feb 2009 Printed on recycled paper.

17

To purchase Juniper Networks solutions, pleasecontact your Juniper Networks representative

at 1-866-298-6428 or authorized reseller.

no ip address

shutdown

!


no ip address

shutdown

!


no ip address

shutdown

!

interface Vlan1

no ip address

shutdown

!

ip classless

ip route 0.0.0.0 0.0.0.0 10.0.0.1

!

!

no ip http server

no ip http secure-server

!



!

!

!

!

control-plane

!

!

dial-peer cor custom

!

!

!

!

line con 0

line vty 0 4

password juniper

login


Corporate and sales headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA Phone: 888.JUNIPER (888.586.4737) or 408.745.2000 Fax: 408.745.2100

apaC headquartersJuniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King’s Road Taikoo Shing, Hong Kong Phone: 852.2332.3636 Fax: 852.2574.7803

emea headquartersJuniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: 35.31.8903.600 Fax: 35.31.8903.601

Copyright 2009 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. “Engineered for the network ahead” and JUNOSe are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

3500144-001-EN Feb 2009 Printed on recycled paper.

17

To purchase Juniper Networks solutions, pleasecontact your Juniper Networks representative

at 1-866-298-6428 or authorized reseller.

transport input lat pad mop udptn telnet rlogin ssh nasi acercon

line vty 5 15

login

transport input lat pad mop udptn telnet rlogin ssh nasi acercon

!

!

end

Summary Our Off-Path integration capabilities allow Juniper to provide very high scalability and support very large deployments.

This Solution Implementation Guide details how to implement WCCP Off-Path integration with Cisco.

About Juniper NetworksJuniper Networks, Inc. is the leader in high-performance networking. Juniper offers a high-performance network infrastructure that creates a responsive and trusted environment for accelerating the deployment of services and applications over a single network. This fuels high-performance businesses. Additional information can be found at www .juniper .net.

Date post:	15-Jan-2020
Category:	Documents
Upload:	others
View:	15 times
Download:	0 times

Juniper Networks WX Series Large Deployment with WCCP Off ... · appLiCation note - Juniper...

Documents