Wow, has it been that long + basic WCCP

Its been over a year since I wrote the last blog update.  Where has the time gone.
 
Since then, life has been a little crazy.  A new job for starters.  I've learnt and experienced too much to list here - maybe one day, I'll get around to it.  But for now, I thought I'd drop a quick WCCP config in here to reference later.
 
The scenario is that guest wifi is being rolled out.  The guests are tunnelled into the DMZ and once there, they can access the internet.  The customer would like some relatively simple transparent proxy or filtering capability and so WCCP was common across both the layer 3 switch and proxy appliance.
 
I've cut and paste most of this from my own documentation, so apologies if its not 'blog friendly'.
 
__________________________________________________________________________________________________

What is all this about?

 

WCCP stands for Web Cache Communication Protocol.  It is a Cisco developed content-routing protocol that provides the mechanism to redirect traffic in real-time.  In RDaSH’s network environment, this is used to redirect Guest WiFi traffic to a proxy server – without the need to manually configure a proxy server in each device (practically impossible with Guest WiFi access).  The technology can work one of two ways; either redirecting using a GRE tunnel, or rewriting the MAC to that of the local engine (called Layer 2 redirect).

 

There are two versions of WCCP (v1 and v2 surprisingly).  Version 1 only supports HTTP (TCP port 80) traffic flows, whereas v2 supports up to 255 different service groups (such as HTTPs).  Version 2 should be used where possible.

 

Configuring a Cisco 3750x Layer 3 switch

 

Ip wccp version 2

Ip wccp web-cache password guest redirect-list 45 group-list 44

Ip wccp 70 password guest redirect-list 45 group-list 44

Ip wccp web-cache password guest

 

Here we are turning on WCCP and setting the version.  We then tell the device which ‘services’ to run with WCCP.  Normal port 80 traffic is called ‘web-cache’ so we define that.  We then define an additional service called ‘70’ which is actually an https-cache service.  We set the password to use with the WCCP service – this is defined on the proxy/filter as well, so they both have some relatively simple security.  The final parts are ‘redirect-list’ which references an ACL in order to match traffic we want re-directed. This is typically the client range.  The ‘group-list’ also references a different ACL, which is matching defined cache engines – or in our case, specifying the proxy/filter.

 

Int vlan666

Ip wccp web-cache redirect in

Ip wccp 70 redirect in

 

At this point we need to define the interface on which WCCP should begin to ‘redirect’ traffic that we’ve asked to be sent to a proxy.  Remembering that ‘inbound’ traffic is the direction specified, as in order to leave VLAN 666, traffic will be coming into its L3 interface before heading out to the internet.  We also define both services to redirect, that we configured earlier.

 

access-list 44 permit 192.168.144.4 0.0.0.0

access-list 44 remark **Sophos appliance for guest WCCP**

 

access-list 45 permit 192.168.145.0 0.0.0.127

access-list 45 remark **DHCP Guest WiFi range for WCCP**

 

The ACL’s as specified earlier contain the client range to redirect and the address of the appliance/cache engine.

 

Pitfalls

 

Unsuprisingly this solution did not work out of the box on the 3750x and hopefully these pointers may assist you.  I’m not laying the blame totally at Cisco’s door however, there was some Sophos research required as well.

 

SDM prefer

By default the 3750x uses ‘desktop default’ template.  In short, the Switch Database Management Template (SDM) doesn’t allocate resources under this default template to do any form of WCCP (it’s actually PBR via the TCAM which is responsible for WCCP).  Thus you need to change the template using ‘SDM prefer routing’.  This requires a switch reboot.

 

IP routing

Obviously make sure IP routing is enabled!

 

Re-direction method

The 3750x only supports L2 and not GRE – so make sure your appliance is set to L2.

 

Things in different subnets

I’d read that you need to have clients, cache servers etc in different subnets for WCCP re-direction to work – but this seems unfounded, at least when using L2 as the redirect and return method.  Maybe this is only evident when using GRE, which the 3750x doesn’t support, so I couldn’t test it anyway.

 

Fast Timers (Headache – take note)

In other words, keepalives – time interval.  The Sophos web appliance didn’t like this feature which I’m informed is standard on cisco firmware later than 2012 or WCCP v2 rev1.  There was no indication that this was to blame on the switch and no indication on the appliance either.

What you will see, is that traffic isn’t redirected.  Instead when issuing ‘show ip wccp’ Total packets Unassigned will increment.  Cisco documentation just states that this means the ‘cache engine’ can’t be contacted for whatever reason.  Not much to go on.

To fix the problem, you must issue the command (it’s a hidden command, so using ? won’t help) ‘no ip wccp variable-timers’.  As if by magic, it all works fine after that!  Maybe a Sophos related problem…. But there you go.

 

Further information

 

When viewing debugs on WCCP you will see a lot of packets sent with HIA and ISY I the description.  If you research these, you’ll see this is the fundamental way in which WCCP communications is established.  HIA = here I am & ISY = I see you.

Should the need arise to create/filter different WCCP service identifiers then use the table below.  YOU MUST also ensure that the filter/proxy/appliance is capable of reading these identifiers as well,  otherwise redirection will not

work.