Version 4.5 June 2014 - Riverbed

SteelHead™ Interceptor Installation Guide

Version 4.5

June 2014

© 2016 Riverbed Technology, Inc. All rights reserved.

Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed or their respective owners.

Akamai® and the Akamai wave logo are registered trademarks of Akamai Technologies, Inc. SureRoute is a service mark of Akamai. Apple and Mac are registered trademarks of Apple, Incorporated in the United States and in other countries. Cisco is a registered trademark of Cisco Systems, Inc. and its affiliates in the United States and in other countries. EMC, Symmetrix, and SRDF are registered trademarks of EMC Corporation and its affiliates in the United States and in other countries. IBM, iSeries, and AS/400 are registered trademarks of IBM Corporation and its affiliates in the United States and in other countries. Juniper Networks and Junos are registered trademarks of Juniper Networks, Incorporated in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. Microsoft, Windows, Vista, Outlook, and Internet Explorer are trademarks or registered trademarks of Microsoft Corporation in the United States and in other countries. Oracle and JInitiator are trademarks or registered trademarks of Oracle Corporation in the United States and in other countries. UNIX is a registered trademark in the United States and in other countries, exclusively licensed through X/Open Company, Ltd. VMware, ESX, ESXi are trademarks or registered trademarks of VMware, Inc. in the United States and in other countries.

This product includes Windows Azure Linux Agent developed by the Microsoft Corporation (http://www.microsoft.com/). Copyright 2012 Microsoft Corporation.

This product includes software developed by the University of California, Berkeley (and its contributors), EMC, and Comtech AHA Corporation. This product is derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm.

The SteelHead Mobile Controller (virtual edition) includes VMware Tools. Portions Copyright © 1998-2013 VMware, Inc. All Rights Reserved.

NetApp Manageability Software Development Kit (NM SDK), including any third-party software available for review with such SDK which can be found at http://communities.netapp.com/docs/DOC-1152, and are included in a NOTICES file included within the downloaded files.

For a list of open source software (including libraries) used in the development of this software along with associated copyright and license agreements, see the Riverbed Support site at https//support.riverbed.com.

This documentation is furnished “AS IS” and is subject to change without notice and should not be construed as a commitment by Riverbed. This documentation may not be copied, modified or distributed without the express authorization of Riverbed and may be used only in connection with Riverbed products and services. Use, duplication, reproduction, release, modification, disclosure or transfer of this documentation is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military agencies. This documentation qualifies as “commercial computer software documentation” and any use by the government shall be governed solely by these terms. All other use is prohibited. Riverbed assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation.

Riverbed Technology 680 Folsom StreetSan Francisco, CA 94107

Fax: 415-247-8801Web: http://www.riverbed.com

Phone: 415-247-8800

Part Number712-00021-12

Contents

Preface.........................................................................................................................................................1

About This Guide ..........................................................................................................................................1Audience ..................................................................................................................................................1Document Conventions .........................................................................................................................2

Product Dependencies and Compatibility .................................................................................................2Hardware and Software Dependencies...............................................................................................3SteelHead Compatibility .......................................................................................................................3Ethernet Network Compatibility .........................................................................................................3SNMP-Based Management Compatibility..........................................................................................4Antivirus Compatibility ........................................................................................................................4

Additional Resources ....................................................................................................................................5Release Notes ..........................................................................................................................................5Riverbed Documentation and Support Knowledge Base.................................................................5

Safety Guidelines ...........................................................................................................................................5

Contacting Riverbed......................................................................................................................................6Internet .....................................................................................................................................................6Technical Support ...................................................................................................................................6Professional Services ..............................................................................................................................6Documentation........................................................................................................................................6

Chapter 1 - Overview of the Interceptor ...................................................................................................7

Overview of the Interceptor .........................................................................................................................7

New Features in Version 4.5 .........................................................................................................................9

Upgrading to Version 4.5 ..............................................................................................................................9

Interceptor Deployment Terminology ......................................................................................................11

Exploring Deployment Scenarios ..............................................................................................................12Deploying Single Interceptors ............................................................................................................12Deploying Serial Interceptors .............................................................................................................13Deploying Parallel Interceptors..........................................................................................................14Deploying Quad Interceptors .............................................................................................................15

SteelHead Interceptor Installation Guide iii

Contents

Chapter 2 - Installing the Interceptor Appliance....................................................................................17

Choosing a Deployment .............................................................................................................................17LAN-Side Versus WAN-Side SteelHead ...........................................................................................18Layer-2 Versus Layer-3 Connectivity.................................................................................................18Multiple SteelHead Link Support ......................................................................................................18Multiple SteelHead Support ...............................................................................................................18

Checking Your Inventory............................................................................................................................19

Preparing Your Site for Installation...........................................................................................................19Site Requirements .................................................................................................................................19

Preparing for Registration with the SteelCentral Controller for SteelHead........................................20Registering Interceptor with the SCC................................................................................................20

Completing the Configuration Checklist .................................................................................................22

Powering On the Appliance.......................................................................................................................22

Running the Configuration Wizard ..........................................................................................................22

Configuring In-Path SteelHeads................................................................................................................26Connecting In-Path SteelHeads to Your Network ...........................................................................26

Verifying Your Connections .......................................................................................................................29

Next Steps .....................................................................................................................................................29

Appendix A - Technical Specifications...................................................................................................31

Technical Specifications ..............................................................................................................................31

Interceptor Appliance Status Lights .........................................................................................................32

Interceptor Status Beeps..............................................................................................................................34

iv SteelHead Interceptor Installation Guide

Preface

Welcome to the SteelHead Interceptor Installation Guide. Read this preface for an overview of the information provided in this guide and the documentation conventions used throughout, hardware and software dependencies, additional reading, and contact information. This preface includes the following sections:

“About This Guide” on page 1

“Product Dependencies and Compatibility” on page 2

“Additional Resources” on page 5

“Safety Guidelines” on page 5

“Contacting Riverbed” on page 6

About This Guide

The SteelHead Interceptor Installation Guide provides an overview of Interceptor features, specifications, terminology, and deployment scenarios. This document also describes how to install and connect an Interceptor to your network.

For more details about Interceptor deployment scenarios, see the SteelHead Interceptor Deployment Guide.

This guide includes information relevant to the following products:

SteelHead Interceptor

Riverbed Optimization System (RiOS)

Riverbed SteelHead (SteelHead)

Riverbed SteelHead CX (SteelHead CX)

Riverbed SteelHead EX (SteelHead EX)

Audience

This guide is written for storage and network administrators familiar with administering and managing WANs using common network protocols such as TCP, CIFS, HTTP, FTP, and NFS.

You must also be familiar with administering and managing a network of deployed SteelHeads as described in the SteelHead Installation and Configuration Guide.

SteelHead Interceptor Installation Guide 1

Preface Product Dependencies and Compatibility

Document Conventions

This guide uses the following standard set of typographical conventions.

Product Dependencies and Compatibility

This section provides information about product dependencies and compatibility. It includes the following information:

“Hardware and Software Dependencies” on page 3

“SteelHead Compatibility” on page 3

“Ethernet Network Compatibility” on page 3

“SNMP-Based Management Compatibility” on page 4

“Antivirus Compatibility” on page 4

Convention Meaning

italics Within text, new terms and emphasized words appear in italic typeface.

boldface Within text, CLI commands, CLI parameters, and REST API properties appear in bold typeface.

Courier Code examples appear in Courier font:

amnesiac > enable amnesiac # configure terminal

< > Values that you specify appear in angle brackets: interface <ip-address>

[ ] Optional keywords or variables appear in brackets: ntp peer <ip-address> [version <number>]

{ } Elements that are part of a required choice appear in braces: {<interface-name> | ascii <string> | hex <string>}

| The pipe symbol separates alternative, mutually exclusive elements of a choice. The pipe symbol is used in conjunction with braces or brackets; the braces or brackets group the choices and identify them as required or optional: {delete <filename> | upload <filename>}

2 SteelHead Interceptor Installation Guide

Product Dependencies and Compatibility Preface

Hardware and Software Dependencies

The following table summarizes the hardware and software requirements for the Interceptor.

SteelHead Compatibility

The Interceptor is compatible with SteelHead version 2.1.x and later.

The Interceptor with VLAN segregation enabled is fully compatible with SteelHead version 8.0.1 and supports up to 24 total interfaces in SteelHead versions 6.5.6 and later.

Ethernet Network Compatibility

The Interceptor supports the following Ethernet networking standards:

Ethernet Logical Link Control (LLC) (IEEE 802.2 - 1998)

Fast Ethernet 100 Base-TX (IEEE 802.3 - 2008)

Gigabit Ethernet over Copper 1000 Base-T and Fiber 1000 Base-SX (LC connector) and Fiber 1000 Base-LX (IEEE 802.3 - 2008)

10 Gigabit Ethernet over Fiber 10GBase-LR Single Mode and 10GBase-SR Multimode (IEEE 802.3 - 2008)

The Interceptor ports support the following connection types and speeds:

Primary - 10/100/1000 Base-T, autonegotiating

Auxiliary - 10/100/1000 Base-T, autonegotiating

LAN - 10/100/1000 Base-TX or 1000 Base-SX or 1000 Base-LX or 10GBase-LR or 10GBase-SR, depending on configuration

WAN - 10/100/1000 Base-TX or 1000 Base-SX or 1000 Base-LX or 10GBase-LR or 10GBase-SR, depending on configuration

The Interceptor supports VLAN tagging (IEEE 802.1Q - 2005). It does not support the Cisco Inter-Switch Link (ISL) protocol.

All copper interfaces are autosensing for speed and duplex (IEEE 802.3 - 2008).

Riverbed CLI Hardware Requirements Software and Operating System Requirements

One of the following:

• An ASCII terminal or emulator that can connect to the serial console (9600 baud, 8 bits, no parity, 1 stop bit, and no flow control)

• A computer with a Secure Shell (SSH) client that is connected by an IP network to the appliance primary interface

Secure Shell (SSH). Free SSH clients include PuTTY for Windows computers, OpenSSH for many UNIX and UNIX-like operating systems, and Cygwin.

Riverbed Component Hardware and Software Requirements

Interceptor Management Console

Any computer that supports a Web browser with a color image display. The Management Console has been tested with Mozilla Firefox v10.0 and Microsoft Internet Explorer v7.0 and v8.0.

JavaScript and cookies must be enabled in your Web browser.


Preface Product Dependencies and Compatibility

The Interceptor autonegotiates speed and duplex mode for all data rates and supports full duplex mode and flow control (IEEE 802.3 – 2008).

The Interceptor with a Gigabit Ethernet card supports jumbo frames on in-path and primary ports.

SNMP-Based Management Compatibility

The Interceptor supports a proprietary Riverbed MIB accessible through SNMP. SNMPv1 (RFCs 1155, 1157, 1212, and 1215), SNMPv2c (RFCs 1901, 2578, 2579, 2580, 3416, 3417, and 3418), and SNMPv3 are supported, although some MIB items might only be accessible through SNMPv2 and SNMPv3.

SNMP support enables the SteelHead to be integrated into network management systems such as Hewlett-Packard OpenView Network Node Manager, BMC Patrol, and other SNMP-based network management tools.

Antivirus Compatibility

Because it does not process TCP sessions, the Interceptor has no compatibility issues with antivirus software.

The SteelHead has been tested with the following antivirus software with no impact on performance:

Network Associates (McAfee) VirusScan v7.0.0 Enterprise on the server

Network Associates (McAfee) VirusScan v7.1.0 Enterprise on the server

Network Associates (McAfee) VirusScan v7.1.0 Enterprise on the client

Symantec (Norton) AntiVirus Corporate Edition v8.1 on the server

The SteelHead has been tested with the following antivirus software with moderate impact on performance:

F-Secure Anti-Virus v5.43 on the client

F-Secure Anti-Virus v5.5 on the server

Network Associates (McAfee) NetShield v4.5 on the server

Network Associates VirusScan v4.5 for multiple platforms on the client

Symantec (Norton) AntiVirus Corporate Edition v8.1 on the client


Additional Resources Preface

Additional Resources

This section describes resources that supplement the information in this guide. It includes the following information:

“Release Notes” on page 5

“Riverbed Documentation and Support Knowledge Base” on page 5

Release Notes

The online software release notes supplement the information in this guide. The release notes are available in the Software section of the Riverbed Support site at https://support.riverbed.com. The following table describes the release notes.

Examine the online release notes before you begin the installation and configuration process. They contain important information about this release of the SteelHead.

Riverbed Documentation and Support Knowledge Base

For a complete list and the most current version of Riverbed documentation, go to the Riverbed Support site at https://support.riverbed.com.

The Riverbed Knowledge Base is a database of known issues, how-to documents, system requirements, and common error messages. You can browse titles or search for keywords and strings. To access the Riverbed Knowledge Base, log in to the Riverbed Support site at https://support.riverbed.com.

Safety Guidelines

Follow the safety precautions outlined in the Safety and Compliance Guide when installing and setting up your equipment.

Important: Failure to follow these safety guidelines can result in injury or damage to the equipment. Mishandling of the equipment voids all warranties. Read and follow safety guidelines and installation instructions carefully.

Many countries require the safety information to be presented in their national languages. If this requirement applies to your country, consult the Safety and Compliance Guide. The guide contains the safety information in your national language. Before you install, operate, or service Riverbed products, you must be familiar with the safety information associated with them. Refer to the Safety and Compliance Guide if you do not clearly understand the safety information provided in the product documentation.

Online File Format Purpose

<product>_<version_number> <build_number>.pdf

Describes the product release and identifies fixed problems, known problems, and work-arounds. This file also provides documentation information not covered in the guides or that has been modified since publication.


https://support.riverbed.com



Preface Contacting Riverbed

Contacting Riverbed

This section describes how to contact departments within Riverbed.

Internet

You can learn about Riverbed products at http://www.riverbed.com.

Technical Support

If you have problems installing, using, or replacing Riverbed products, contact Riverbed Support or your channel partner who provides support. To contact Riverbed Support, open a trouble ticket by calling 1-888-RVBD-TAC (1-888-782-3822) in the United States and Canada or +1 415-247-7381 outside the United States. You can also go to https://support.riverbed.com.

Professional Services

Riverbed has a staff of professionals who can help you with installation, provisioning, network redesign, project management, custom designs, consolidation project design, and custom coded solutions. To contact Riverbed Professional Services, email [email protected] or go to http://www.riverbed.com/services-training/Services-Training.html.

Documentation

The Riverbed Technical Publications team continually strives to improve the quality and usability of Riverbed documentation. Riverbed appreciates any suggestions you might have about its online documentation or printed materials. Send documentation comments to [email protected].


mailto:[email protected]

mailto:[email protected]

http://www.riverbed.com

http://www.riverbed.com/services-training/#Consulting_Services

http://www.riverbed.com/services-training/#Consulting_Services


CHAPTER 1 Overview of the Interceptor

This chapter introduces the Interceptor. It includes the following sections:

“Overview of the Interceptor” on page 7

“New Features in Version 4.5” on page 9

“Upgrading to Version 4.5” on page 9

“Interceptor Deployment Terminology” on page 11

“Exploring Deployment Scenarios” on page 12

Overview of the Interceptor

The Interceptor

enables you to scale your deployments of SteelHeads at large central sites. Deployed in-path, Interceptors provide virtual in-path clustering and load balancing for SteelHeads that are physically deployed out-of-path.

is typically deployed in a data center or hub network where any in-path devices need to be high-performing and highly available.

directs incoming traffic to its clustered SteelHeads according to in-path and load-balancing rules.

is an in-path clustering solution you can use to distribute optimized traffic to a local group of SteelHeads. The Interceptor does not perform optimization itself. Therefore, you can use it in demanding network environments with extremely high throughput requirements.

works in conjunction with the SteelHead and offers several benefits over other clustering techniques, such as WCCP or Layer-4 switching, including native support for asymmetrically routed traffic flows.

Note: For details on in-path and load-balancing rules, see the SteelHead Interceptor User’s Guide.


Overview of the Interceptor Overview of the Interceptor

The Interceptor includes the following features:

Feature Description

Connection Tracing Connection traces enable you to determine the SteelHeads to which the Interceptor has forwarded specific connections.

Connection traces also enable you to debug failing or unoptimized connections.

Note: For details about setting connection tracing, see the SteelHead Interceptor User’s Guide.

EtherChannel Deployment The Interceptor can operate within an EtherChannel deployment. In an EtherChannel deployment, all the links in the channel must pass through the same Interceptor. Two configurations are supported: up to four channels with two links per channel group, or up to two channels with four links per channel group.

Failover You can configure a pair of Interceptors for failover. In the event that one Interceptor goes down or requires maintenance, the second Interceptor configured for failover ensures uninterrupted service.

Note: For details about setting failover, see the SteelHead Interceptor User’s Guide.

In-Path Rules When the Interceptor intercepts a SYN request to a server, the in-path rules you configure determine the subnets and ports for traffic to be optimized. You can specify in-path rules to pass through, discard, or deny traffic, or to forward and optimize it.

In the case of a data center, the Interceptor intercepts SYN requests when a data center server establishes a connection with a client that resides outside of the data center.

In the connection-processing decision tree, in-path rules are processed before load-balancing rules. Only traffic selected for forwarding proceeds to load-balancing rules processing.

Note: For details about setting in-path rules, see the SteelHead Interceptor User’s Guide.

Intelligent Forwarding The Interceptor routing algorithm has been improved to handle cases that result in looping. This improvement minimizes any need to create static in-path routes.

Link State Detection and Link State Propagation

The Interceptor monitors the link state of devices in its path, including routers, switches, interfaces, and in-path interfaces. When the link state changes (for example, the link goes down or it resumes), the Interceptor propagates the change to the dynamic routing table.

Link-state propagation ensures accurate and timely triggers for failover or redundancy scenarios.

Load-Balancing Rules For connections selected by an in-path redirect rule, the Interceptor distributes the connection to the most appropriate SteelHead based on rules you configure, intelligence from monitoring cluster SteelHeads, and the RiOS connection distribution algorithm.

The Interceptor combines two approaches to load balancing:

• Peer affinity - The Interceptor sends the connection to the local SteelHead with the most affinity, that is, the local SteelHead that has received the greatest number of connections from the remote SteelHead.

• Round-robin distribution - Instead of checking the SteelHeads in order of most to least peer affinity, the SteelHeads are checked for availability in round-robin order starting with the one after the SteelHead that received the last connection from that rule.

Note: For details about setting load-balancing rules, see the SteelHead Interceptor User’s Guide.


New Features in Version 4.5 Overview of the Interceptor

New Features in Version 4.5

The following features are available in the Interceptor v4.5:

Support for IPv6 management- Interceptor v4.5 supports IPv6 management. IPv6 is the latest version of the Internet Protocol (IP), the communications protocol that provides an identification and location system for computers on networks and routes traffic across the Internet.

FIPS - Interceptor v4.5 supports FIPS (Federal Information Processing Standard) that is a publicly announced set of validation standards developed by the United States National Institute of Standards and Technology (NIST) for use by government agencies and by government contractors.

Upgrading to Version 4.5

Important upgrade considerations:

Peer Affinity Peer affinity refers to an established connection relationship between remote and cluster SteelHeads.

Affinity-based load balancing matches traffic from a remote SteelHead to a specific cluster SteelHead based on a previous connection between them.

Note: If no local SteelHead is currently handling the remote SteelHead, then the Interceptor directs the traffic to the SteelHead with the lowest connection count. If the SteelHead with the best peer affinity is unavailable, the Interceptor attempts to use the SteelHead with the next best affinity.

Interceptor Monitoring Cluster Interceptors include both failover pairs deployed in a serial configuration and Interceptors deployed in a parallel configuration to handle asymmetric routes.

Asymmetric routing can cause the response from the server to be routed along a different physical network path from the original request, and a different Interceptor can be on each of these paths. When you deploy Interceptors in parallel, the first Interceptor that receives a packet delays forwarding it. It requests that the other Interceptors forward packets for the connection to it. When the other Interceptors have confirmed that they have received and accepted this request, the first Interceptor begins to forward the connection.

SteelHead Monitoring Cluster SteelHeads are the pool of SteelHeads for which the Interceptor monitors capacity and balances load.

To assist in deployment tuning and troubleshooting, the Interceptor can monitor SteelHeads for connectivity, health, and load balancing.

Port Labels Port labels enable you to apply rules to a range of ports. The Interceptor provides port labels for secure and interactive ports. You can create additional labels as needed.

Reporting The SteelHead report includes a current connections count and the admission control connections limit for each SteelHead load balanced by the Interceptor.

VLAN Tagging The Interceptor supports VLAN-tagged connections in VLAN trunked links. The Interceptor supports VLAN 802.1q.

Note: The Interceptor does not support the Cisco Inter-Switch Link (ISL) protocol.

Feature Description


Overview of the Interceptor Upgrading to Version 4.5

You cannot upgrade directly from v4.0 to v4.5. You need to upgrade from v4.0 to v4.0.1 before you can upgrade to v4.5.

Interceptor v4.5 is not supported on Interceptor 9200 appliances.

To upgrade Interceptor software

1. Download the software image from Riverbed Support to a location such as your desktop.

2. Log in to the Interceptor using the Administrator account (admin).

3. Choose Configure > Maintenance > Software Upgrade to display the Software Upgrade page.

Figure 1-1. Software Upgrade Page

4. Under Install Upgrade, select one of the following options:

– From URL - Type the URL that points to the software image that you want to upgrade to.

Installing directly from https://support.riverbed.com is not supported.

– From Riverbed Support Site - Select this option to upgrade from the support site. But before you can do that, check the Support page to ensure that Riverbed Support credentials have been set.

– From Local File - Browse to your file system and select the software image.

– Schedule Upgrade for Later - Type the date and time using the following format: YYYY/MM/DD HH:MM:SS.

– Click Install to upgrade your Interceptor software.


Interceptor Deployment Terminology Overview of the Interceptor

5. Choose Configure > Maintenance > Reboot/Shutdown to display the Reboot/Shutdown page.

Figure 1-2. Reboot/Shutdown Page

6. Click Reboot to restart the Interceptor.

To view software version history

Under Software Version History, view the history.

Interceptor Deployment Terminology

This section describes the Interceptor deployment terminology.

The feature configurations vary depending on the deployment scenario, as described in the following table.

Feature Description

Fail-to-block When fail-to-block is enabled, a failed Interceptor blocks any network traffic on its path, as opposed to passing it through.

In a parallel configuration, fail-to-block should be enabled to force all traffic through a cluster Interceptor, thereby enabling optimization to continue.

This feature is configured in the Configure > Networking > In-Path Interfaces page. For details, see the SteelHead Interceptor User’s Guide.

Fail-to-wire When fail-to-wire is enabled, a failed Interceptor passes through network traffic.

In a serial or quad configuration, fail-to-wire should be enabled to pass all traffic through to the cluster or failover Interceptor, thereby enabling optimization to continue.

This feature is configured in the Configure > Networking > In-Path Interfaces page. For details, see the SteelHead Interceptor User’s Guide.

Allow failure Allow failure is a feature that, when contact between two designated Interceptors is lost, ensures that the remaining Interceptor continues forwarding connections to ensure that optimization continues.

In a parallel configuration, the feature might be enabled if no asymmetric routing is expected in the network. In a serial configuration, however, this feature cannot be enabled.

This feature is configured in the Interceptors page. For details, see the SteelHead Interceptor User’s Guide.


Overview of the Interceptor Exploring Deployment Scenarios

Exploring Deployment Scenarios

You can deploy the Interceptor using different deployment scenarios.

Typical Interceptor deployments have multiple Interceptors and SteelHeads, and usually all appliances have more than one enabled and configured in-path interface. For more details, see the SteelHead Interceptor Deployment Guide.

You can configure the Interceptor to be either a serially connected failover Interceptor acting as a backup for the same network paths or Interceptor cluster that covers different network paths or is used in a virtual in-path cluster.

The Interceptor relationships and failure reaction features are typically combined in several ways for actual Interceptor deployments. You can deploy Interceptor clusters in the following ways:

“Deploying Single Interceptors” on page 12

“Deploying Serial Interceptors” on page 13

“Deploying Parallel Interceptors” on page 14

“Deploying Quad Interceptors” on page 15

For more details, see the SteelHead Interceptor Deployment Guide.

Deploying Single Interceptors

Figure 1-3 shows a basic single Interceptor deployment.

Failover Failover enables you to specify a failover counterpart. When failover is configured, a failover Interceptor takes over for a failed Interceptor.

In a serial configuration, you configure the serial Interceptors for mutual failover.For details, see the SteelHead Interceptor User’s Guide.

Cluster Interceptor When the connection-forwarding feature is enabled, Interceptors notify each other when they intercept specific packets.

For example, during a connection setup phase, when Interceptor A receives a SYN packet, it notifies Interceptor B, so that when Interceptor B sees the SYN/ACK, it forwards it to Interceptor A. (During the data phase, both Interceptors pass subsequent connections directly to the appropriate SteelHeads.)

The connection-forwarding feature is applicable to serial configurations.

Feature Description


Exploring Deployment Scenarios Overview of the Interceptor

Caution: To enable full transparency, do not position any router that might generate ICMP “fragmentation needed” or “forward” messages between the Interceptor and SteelHeads. Such messages, if not routed through the Interceptor, are not received by the SteelHeads, resulting in a possible connection failure.

Figure 1-3. Basic Single Interceptor Deployment

This configuration includes the following elements:

Interceptor - This scenario features one Interceptor.

Cluster SteelHeads - This scenario features two SteelHeads.

Deploying Serial Interceptors

Figure 1-4 shows a fail-to-wire dual-connected SteelHead deployment.

Figure 1-4. Serial Interceptors, Fail-to-Wire Dual-Connected SteelHeads


Fail-to-wire - If either Interceptor fails, traffic passes through to the other Interceptor.



Failure Handling

In Figure 1-4, each in-line Interceptor is configured for mutual failover to ensure high availability. If either Interceptor fails, the other appliance directs all network traffic.

Deploying Parallel Interceptors

Figure 1-5 shows parallel Interceptor deployment.

Figure 1-5. Parallel Interceptors, Fail-to-Block with Dual-Connected SteelHeads


Fail-to-block - This feature is enabled. If either Interceptor fails or it blocks traffic, the network automatically reroutes traffic through the remaining Interceptor.

Connection-forwarding counterpart - This feature is enabled when the Interceptors can notify each other about intercepted connections.

Allow failure - This feature is optional. If contact is lost between the cluster Interceptors, the remaining Interceptor continues directing all connections, ensuring that optimization continues.

Failure Handling

In the Figure 1-5, if an Interceptor fails, fail-to-block causes connections to route through the other Interceptor, thereby allowing optimization to continue. However, delays might result from traffic reconvergence.


Exploring Deployment Scenarios Overview of the Interceptor

Deploying Quad Interceptors

Figure 1-6 shows a quad Interceptor deployment.

Figure 1-6. Quad Interceptors with Dual-Connected SteelHeads


Failover appliance - Each in-line Interceptor is configured to provide failover support for the other.

Fail-to-wire - If either in-line Interceptor fails, traffic passes through to the other Interceptor.

Clusters - This feature is enabled where clustered Interceptors can notify each other about intercepted connections.

Failure Scenarios

In the Figure 1-6, each parallel network uses two in-line Interceptors. Each in-line Interceptor is configured as fail-to-wire, so if one fails, network traffic passes through to its in-line counterpart, which is configured for failover.

This scenario is distinct from the parallel network configuration shown in “Deploying Parallel Interceptors” on page 14 because the in-line redundancy eliminates the need for fail-to-block and allows failure configurations.




CHAPTER 2 Installing the Interceptor Appliance

This chapter describes how to install and configure the SteelHead Interceptor. This chapter includes the following sections:

“Choosing a Deployment” on page 17

“Checking Your Inventory” on page 19

“Preparing Your Site for Installation” on page 19

“Preparing for Registration with the SteelCentral Controller for SteelHead” on page 20

“Completing the Configuration Checklist” on page 22

“Powering On the Appliance” on page 22

“Running the Configuration Wizard” on page 22

“Configuring In-Path SteelHeads” on page 26

“Verifying Your Connections” on page 29

“Next Steps” on page 29

Important: Read and follow the safety guidelines described in the Safety and Compliance Guide. Failure to follow these safety guidelines can result in damage to the equipment.

Choosing a Deployment

You can use multiple Interceptors to ensure that optimization occurs even when there are multiple, physically separated paths to the WAN, or to ensure that optimization continues during a planned or unplanned Interceptor outage. Use multiple SteelHeads to ensure redundancy or to specify that certain applications, subnets, and hosts are optimized by different SteelHeads.

For more details about deployment scenarios, see the SteelHead Interceptor Deployment Guide.

This section describes the following deployment scenarios:

“LAN-Side Versus WAN-Side SteelHead” on page 18

“Layer-2 Versus Layer-3 Connectivity” on page 18

“Multiple SteelHead Link Support” on page 18


Installing the Interceptor Appliance Choosing a Deployment

“Multiple SteelHead Support” on page 18

LAN-Side Versus WAN-Side SteelHead

You connect SteelHeads to the local network on either the LAN or WAN side of the Interceptor. For most deployments, LAN-side SteelHead placement minimizes the amount of traffic that traverses the Interceptor. You cannot cable the SteelHead directly to the Interceptor.


Layer-2 Versus Layer-3 Connectivity

The SteelHead and Interceptor in-path IP addresses can be on the same or different subnets. The actions taken to redirect traffic are the same during autodiscovery and optimization. Unlike when you use WCCP to redirect traffic to a SteelHead, there is no resource use or MTU concerns from having the SteelHead and Interceptor in-path IP addresses on different subnets.


Multiple SteelHead Link Support

A SteelHead can have multiple in-path interfaces configured so that Interceptors can use multiple IP addresses to reach the same SteelHead. The Interceptor only redirects traffic to one interface on the SteelHead at any time.


Multiple SteelHead Support

The SteelHeads in a cluster have each clustered Interceptor configured as a connection-forwarding neighbor, using the SteelHead communication commands. Each clustered SteelHead typically has each Interceptor inpath0_0 IP address configured as the clustered SteelHead main-ip, and other Interceptor in-path interfaces configured as additional IP addresses. Do not configure one clustered SteelHead expecting it to be aware of another clustered SteelHead.

You can use the RiOS data store synchronization between any local pair of SteelHeads, including SteelHead pairs in an Interceptor cluster. You typically perform data synchronization when the load-balance configuration on the Interceptors causes similar traffic to be sent to the pair of SteelHeads.



Checking Your Inventory Installing the Interceptor Appliance

Checking Your Inventory

Your shipping carton contains the following items:

The SteelHead Interceptor

One CAT-5E straight-through cable

One RS-232 serial extension cable

One power cable

One mounting kit

Documentation kit

If any items are damaged or missing, notify Riverbed Support at https://support.riverbed.com for replacement or repair.

Preparing Your Site for Installation

The Interceptor is shipped completely assembled, with all the equipment parts in place and securely fastened.

Site Requirements

Before you install the Interceptor, make sure that your site meets the following requirements:

A standard electronic environment where the ambient temperature does not exceed 35º C (95º F) and the relative humidity does not exceed 95% (noncondensing).

An Ethernet connection available within the standard Ethernet limit.

Space on a two-post or four-post, 19-inch, Telco-type mounting rack. The Interceptor requires 3U of rack space. For details about installing the Interceptor to a rack, see the Rack Installation Guide or the printed instructions that were shipped with the Interceptor.

A clean power source dedicated to computer devices and other electronic devices.

You need a standard Phillips-head screwdriver to secure the Interceptor to the rack.


Installing the Interceptor Appliance Preparing for Registration with the SteelCentral Controller for SteelHead

Preparing for Registration with the SteelCentral Controller for SteelHead

If you have SteelCentral Controller for SteelHead (SCC) installed in your network to centrally manage and monitor SteelHeads, you can use a subset of SCC features to centrally manage and monitor Interceptors. From the SCC, you can define Interceptor groups and policies that you use to perform administrative tasks on managed Interceptors.

Use the SCC to perform the following administrative tasks on managed Interceptors:

Configuration of event notification

Collection of logs

Configuration of backup and restore functions

SCC features not supported on the Interceptor include the following:

Automatic configuration of new Interceptors

Sending of configuration settings to Interceptors in remote offices

Initiating centralized configuration and reporting on Interceptors

For information about SCC features, see the SteelCentral Controller for SteelHead User’s Guide.

Registering Interceptor with the SCC

Before you can centrally manage and monitor an Interceptor from an SCC, the appliance must be registered with the SCC. Registration of an appliance provides the SCC with the information necessary to establish a management connection to the appliance. You can register new appliances with the SCC before you deploy them. You can also allow new appliances to automatically register with the SCC running on the default-named host.

Manual Registration on the SCC

Before you can deploy the Interceptor you have to register the new Interceptor with the SCC. Use the Appliances page of the SCC to manually register the appliance. You specify the serial number, IP address, and administrative username and password for the Interceptor. After you deploy the appliance, the SCC uses the appliance registration information to establish a management connection to the appliance.

Automatic Registration on the Interceptor

In a new Interceptor, default settings in the configuration specify that the appliance is to automatically register itself with the SCC reachable by the hostname riverbedcontroller. The Interceptor initiates a short-lived connection to add its IP address to an appliance registration entry on the SCC.

Note: The Interceptor default configuration setting that specifies the SCC hostname cannot be modified through the Configuration Wizard or through the Management Console.

Automatic Registration of New Appliances on Deployment

If your network runs the SCC software on a host that is reachable by the name riverbedcontroller, new Interceptors automatically register with the SCC as soon as you connect the appliances to your network.


Preparing for Registration with the SteelCentral Controller for SteelHead Installing the Interceptor Appliance

If your network runs the SCC software on a host that is reachable by the name <hostname>, new Interceptors automatically register with the SCC as soon as you connect the appliances to your network provided that both the name <hostname> and the default hostname riverbedcontroller are resolvable to the same SCC IP address.

Automatic Registration of New Appliances After You Modify Their Configurations

If your network runs the SCC software on a host that is reachable by the name <hostname> but you are unable to make the hostname riverbedcontroller resolvable to the SCC IP address, the Interceptors will not automatically register as soon as you connect the appliances to your network. However, you can modify newly deployed Interceptors so that they automatically register with the SCC software on a host that is reachable by the name <hostname>. The following steps summarize the sequence of events for each new Interceptor.

To automatically register a new appliance after you modify the configurations

1. You connect the new Interceptor to your network.

2. At the serial console connection to the Interceptor, complete the configuration wizard process. For details, see “Completing the Configuration Checklist” on page 22.

3. At the serial console connection, enter CLI commands to modify the appliance configuration, replacing the default SCC hostname riverbedcontroller with the name <hostname>. For details, see “Completing the Configuration Checklist” on page 22.


Installing the Interceptor Appliance Completing the Configuration Checklist

Completing the Configuration Checklist

Before you begin, consult the Rack Installation Guide for detailed information about how to install your model to a rack.

The following checklist displays the parameters you specify to complete the initial configuration of the SteelHead. Be prepared to provide values for these parameters.

Powering On the Appliance

This section describes how to connect and power on the Interceptor.

To power on the appliance

1. If your appliance has a master power switch, make sure it is in the off position (on the rear panel).

2. Plug the alternating current (AC) power cord provided in your shipment into the Interceptor.

3. Plug the AC power cord into an uninterrupted AC outlet.

4. If your appliance has a master power switch, press the master power switch (ON).

5. Press the system power switch on the front of the Interceptor.

6. Check the status lights on the Interceptor. For details, see “Technical Specifications” on page 31.

Running the Configuration Wizard

To access the configuration wizard and the Interceptor CLI, you establish a serial connection using a terminal emulator program.

Parameter Your Value

Interceptor appliance Hostname

IP address

Netmask

Default gateway

Domain Name System (DNS) IP address

Domain Name

SSC appliance with which the Interceptor is to automatically register. Default hostname is riverbedcmc.

(If applicable) Hostname

(For DNS) IP address

(For DNS) Alias, if used


Running the Configuration Wizard Installing the Interceptor Appliance

To run the configuration wizard

1. Plug the serial cable provided in your shipment into the Console port on the Interceptor.

Depending on your appliance, the Console port is either a DB9F port or an RJ45 port. (For port details for your appliance, see the Appendix A, “Technical Specifications.”)

The appropriate console cable ships with your appliance.

Figure 2-1. Connecting the Interceptor Appliance

2. Start your terminal emulation program, such as Tera Term Pro or HyperTerminal. The terminal device must have the following settings:

Baud rate: 9600 bps

Data bits: 8

Parity: none

Stop bits: 1

No flow control

3. Log in as an administrator.

For example:

login as: adminSent username "admin"password: password

The configuration wizard automatically starts after you have entered the login and default password. After you have established a connection, you configure the Interceptor using the configuration wizard.

4. To start the configuration wizard, enter yes at the system prompt.

Configuration wizard.Do you want to use the wizard for initial configuration? yes

Press Enter to enter the default value; press ? for help; press Ctrl-B to go back to the previous step.


Installing the Interceptor Appliance Running the Configuration Wizard

5. Complete the configuration wizard steps as described in this table.

The system confirms your settings.

You have entered the following information:1. Hostname: minna2. Use DHCP: no3. Primary IP address: 10.0.0.744. Netmask: 255.255.0.05. Default gateway: 10.0.0.16. Primary DNS server: 10.0.0.27. Domain name: example.com8. Admin password: (unchanged)To change an answer, enter the step number to return to.

Otherwise hit <enter> to save changes and exit.Choice:

The Interceptor configuration wizard automatically saves your initial configuration settings.

6. To log out of the system, enter the following command at the system prompt:

> exit

Wizard Prompt Description Example

Step 1: Hostname?

Enter the hostname for the Interceptor. Step 1: Hostname? minna

Step 2: Use DHCP?

You are given the option to enable DHCP to automatically assign an IP address to the primary interface for the Interceptor.

Riverbed recommends that you do not set DHCP.

The default value is no.

Step 2: Use DHCP? no

Step 3: Primary IP address?

Enter the IP address for the Interceptor. Step 3: Primary IP address? 10.0.0.74

Step 4: Netmask? Enter the netmask for the network on which the Interceptor is to reside.

Step 4: Netmask? 255.255.0.0

Step 5: Default gateway? 10.0.0.1

Enter the default gateway for the network on which the Interceptor is to reside.

Step 5: Default gateway? 10.0.0.1

Step 6: Primary DNS server?

Enter the primary DNS server for the network on which the Interceptor is to reside.

Step 6: Primary DNS server? 10.0.0.2

Step 7: Domain name?

Enter the domain name for the network on which the Interceptor is to reside.

If you set a domain name, you do not need to specify the domain names when you set up remote SteelHeads to be load balanced by the Interceptor.

Note: When you configure DNS server settings, map interceptor to the IP address for the Interceptor.

Step 7: Domain name? example.com

Step 8: Admin password?

Riverbed strongly recommends that you change the default password at this time. The password must be minimum of six characters.

The default administrator password is password.

Step 8: Admin password? xxxyyy


Running the Configuration Wizard Installing the Interceptor Appliance

7. (Optional) To configure the Interceptor to automatically register with an SCC other than riverbedcontroller, enter the following commands at the user mode system prompt of the administrative CLI:

enable configure terminal show cmc cmc hostname <hostname> cmc enable show cmc write memory exit exit

The following example shows how to enter CLI commands at the Interceptor named amnesiac to change the auto-registration SCC hostname from riverbedcontroller to rvbd_cmc_host9:

amnesiac > enable amnesiac # configure terminal

amnesiac (config) # show cmc CMC auto-registration enabled: yes CMC auto-registration hostname: riverbedcmc Managed by CMC: no CMC hostname: Auto configuration status: Inactive Last message sent to cmc: n/a

amnesiac (config) # cmc hostname rvbd_cmc_host9 amnesiac (config) # cmc enable

amnesiac (config) # show cmc CMC auto-registration enabled: yes CMC auto-registration hostname: rvbd_cmc_host9 Managed by CMC: no CMC hostname: Auto configuration status: Inactive Last message sent to cmc: n/a

amnesiac (config) # write memory

amnesiac (config) # exit amnesiac # exit amnesiac > _

For detailed information about the CLI commands, see the Riverbed Command-Line Interface Reference Manual.


Installing the Interceptor Appliance Configuring In-Path SteelHeads

Configuring In-Path SteelHeads

The Interceptor manages connections to LAN-side SteelHeads.

Connecting In-Path SteelHeads to Your Network

You can connect an in-path SteelHead to your network.

To connect an in-path SteelHead to your network

1. Plug one end of the straight-through cable into the LAN in-path interface of the Interceptor (lan0_0, for example).

Plug the other end of the cable to the LAN switch (this can be any port on your LAN switch that acts as a host).

2. Plug one end of the cross-over cable into the WAN in-path interface of the Interceptor (wan0_0, for example).

Plug the other end of the cable to the WAN router.

Figure 2-2 represents the basic cable connections between network devices.

Figure 2-2. Basic Deployment: Cable Connections Between Network Device


Configuring In-Path SteelHeads Installing the Interceptor Appliance

Figure 2-3 represents the basic cable connections between network devices when you deploy an Interceptor with bypass cards.

Figure 2-3. Basic Deployment: Cable Connections Between Network Device When You Use Bypass Cards

For specifications on supported bypass cards, see the Network Interface Card Installation Guide.

Figure 2-4 represents the cable connections between network devices deployed to support failover. Use a cross-over cable to connect the Interceptors to each other.

Figure 2-4. Serial Deployment to Provide Failover Support


Installing the Interceptor Appliance Configuring In-Path SteelHeads

Figure 2-5 represents the cable connections between network devices deployed to support networks with asymmetric routes.

Figure 2-5. Parallel Deployment in Asymmetric Networks

Figure 2-6 represents a serial and parallel deployment to provide failover and handle asymmetric routes.

Figure 2-6. Parallel Deployment in Asymmetric Networks


Verifying Your Connections Installing the Interceptor Appliance

Verifying Your Connections

This section describes how to verify that you have properly connected the Interceptor.

To verify your connections

1. Check the status lights to verify that the Interceptor is connected properly.

2. From a remote LAN-side SteelHead, connect to the CLI.

ssh [email protected]

—or—

ssh admin@ipaddress

3. Enter the following ping commands to verify the connections:

ping -I <primary-IP-address> <primary-default-gateway>ping -I <inpath-IP-address> <address-on-LAN-side> ping -I <inpath-IP-address> <address-on-WAN-side>

Next Steps

After you have installed and initially configured the Interceptor, refer to the SteelHead Interceptor User’s Guide to complete the next steps.

Step Reference

1. Open the Interceptor Management Console and become familiar with its navigation and administrative features.

Chapter 1

2. Configure in-path rules to pass through or deny traffic you do not want to optimize. Chapter 2

3. Add to the configuration the cluster of neighbor SteelHeads you want to load balance. Chapter 2

4. Configure peering with other Interceptors, if applicable. Chapter 2

5. Configure load-balancing rules. Chapter 2

6. Verify connections among your network devices by viewing Interceptor Management Console reports.

Chapter 3

7. Review and, if you choose, modify the Interceptor default host and networking settings. Chapter 4


Installing the Interceptor Appliance Next Steps


APPENDIX A Technical Specifications

This chapter summarizes the Interceptor technical specifications, status lights, and status beeps. This chapter includes the following sections:

“Technical Specifications” on page 31

“Interceptor Appliance Status Lights” on page 32

“Interceptor Status Beeps” on page 34

For information about network cards for Interceptor appliances, see the Network Interface Card Installation Guide.

Technical Specifications

The following table summarizes the technical specifications for the Interceptor appliance.

Specification Interceptor 9350

Form Factor 3U

Dimensions (height x width x depth) 5.2 x 17 x 25.72 in

131.9 x 431.6 x 653.4 mm

Gross Weight 51 lbs / 23.2 kg

AC Voltage 100 - 240 V, 50-60 Hz, 4.9 Amp

Power Redundancy Double

Power-Watts 320W

Power-Amps@110v (load)(watts/110v) 3.2

Heat-BTUs (per hour max) 1091

RAID Yes

Front Swappable Disks 3

CPU 2 x AMD Opteron 2346HE 1.8 GHz Quad Core

RAM 8 GB ECC (4 x 2 GB)

Interceptor Appliance Installation Guide 31

Technical Specifications Interceptor Appliance Status Lights

Interceptor Appliance Status Lights

This section illustrates the status lights and interface names for the Interceptor 9350 appliance.

Extra PCI Slots 4 PCI-E

Onboard Bypass Ports (Copper) 4

4.1.x WAN Link Support 8 Gbps

5.x WAN Link Support 8 Gbps

Connections 1,000,000

License Upgrade No

Specification Interceptor 9350

32 Interceptor Appliance Installation Guide

Interceptor Appliance Status Lights Technical Specifications

The following figures illustrate the status lights and interface names for the Interceptor 9350 appliance.

Figure A-1. Front Panel Interceptor 9350 Appliance

Figure A-2. Disk Drive Numbers Interceptor 9350

Interceptor Appliance Installation Guide 33

Technical Specifications Interceptor Status Beeps

Figure A-3. Back Panel Interceptor 9350 Appliance

The following table describes the four onboard bypass port LEDs for the Interceptor 9350.

Interceptor Status Beeps

In the event of fan failure or power supply failure, the Interceptor appliance emits three beep sounds.

LED Condition

Bypass/Block (Disconnect) Solid Orange in bypass or block (disconnect) mode

Right LED GB = Orange

100 MB = Green

10 MB = No Light

Left LED Solid Green on link, blinking Green for activity

34 Interceptor Appliance Installation Guide

Date post:	06-Feb-2022
Category:	Documents
Upload:	others
View:	5 times
Download:	0 times

Version 4.5 June 2014 - Riverbed

Documents