•  SteelHead™ Deployment Guide
  •  Preface
    •  About This Guide
      • Audience
      • Types of SteelHeads
      • Document Conventions
    • Documentation and Release Notes
    • Contacting Riverbed
    • What Is New
  •  Optimization Techniques and Design Fundamentals
    •  How SteelHeads Optimize Data
      •  Data Streamlining
        • Scalable Data Referencing
        • Bidirectional Synchronized RiOS Data Store
        • Unified RiOS Data Store
      •  Transport Streamlining
        • Overview of Transport Streamlining
        • Connection Pooling
        • TCP Automatic Detection
        • SteelCentral Controller for SteelHead Mobile TCP Transport Modes
        • Tuning SteelHeads for High-Latency Links
        • TCP Algorithm Selection
        • WAN Buffers
      • Application Streamlining
      • Management Streamlining
    •  RiOS Data Store Synchronization
      • RiOS Data Store Synchronization Requirements
      • RiOS Data Store Error Alarms
    • Choosing the Right SteelHead Model
    • Deployment Modes for the SteelHead
    •  Auto-Discovery Protocol
      • Original Auto-Discovery Process
      • Configuring Enhanced Auto-Discovery
    •  Auto-Discovery and Firewall Considerations
      • Removal of the Riverbed TCP Option Probe
      • Stateful Firewall Device in a Multiple In-Path Environment
    • Multiple In-Path Discovery Behavior
    •  Controlling Optimization
      • In-Path Rules
      • Default In-Path Rules
      • Peering Rules
      • Kickoff and Automatic Kickoff Features
    •  Controlling Optimization Configuration Examples
      • Configuring High-Bandwidth, Low-Latency Environment
      • Configuring Pass-Through Transit Traffic
    •  Fixed-Target In-Path Rules
      • Configuring a Fixed-Target In-Path Rule for an In-Path Deployment
      • Fixed-Target In-Path Rule for an Out-of-Path Deployment
    • Best Practices for SteelHead Deployments
  •  Network Integration Tools
    •  Redundancy and Clustering
      • Physical In-Path Deployments
      • Virtual In-Path Deployments
      • Out-of-Path Deployments
    • Fail-to-Wire and Fail-to-Block
    • Overview of Link State Propagation
    •  Connection Forwarding
      • Configuring Connection Forwarding
      • Multiple-Interface Support Within Connection Forwarding
      • Failure Handling Within Connection Forwarding
      • Connection-Forwarding Neighbor Latency
    • Overview of Simplified Routing
  •  WAN Visibility Modes
    • Overview of WAN Visibility
    • Correct Addressing
    •  Transparent Addressing
      • Port Transparency
      •  Full Address Transparency
        • Overview of Full Address Transparency
        • Configuring VLANs and Full Address Transparency
      • Full Address Transparency with Forward Reset
    •  Implications of Transparent Addressing
      • Stateful Systems
      •  Network Design Issues
        • Network Asymmetry
        • Misrouting Optimized Traffic
        • Firewalls Located Between SteelHeads
      •  Integration into Networks Using NAT
        • NAT Deployment Using Enhanced Auto-Discovery and Full Transparency
        • NAT Deployment Using Fixed-Target Rules
        • NAT Deployment Using Correct and Port Transparency Addressing Modes
        • Client-Side Source NAT Using Enhanced Auto-Discovery and Full Transparency
        • Failed Client-Side Source NAT Deployment Using Enhanced Auto-Discovery and Correct Addressing
        • Dual NAT Deployment Using Enhanced Auto-Discovery and Full Transparency
        • Failed Dual NAT Deployment Using Enhanced Auto-Discovery and Correct Addressing
    •  The Out-of-Band Connection
      • Overview of OOB Connections and Addressing Modes
      • Configuring OOB Connection Destination Transparency
      • Configuring OOB Connection Full Transparency
    • Configuring WAN Visibility Modes
  •  Topology
    • Introduction to the Topology Concept
    • Defining a Network
    •  Defining a Site
      • Configuring the Local Site
      • Configuring the Default Site
  •  Application Definitions
    •  Applications
      • Defining an Application
      • Application Properties
    •  Application Flow Engine
      • Overview of Application Flow Engine
      • AFE and Microsoft Lync 2010 and 2013
    • Creating Host Labels
    • Creating Port Labels
  •  QoS Configuration and Integration
    • Overview of Riverbed QoS
    •  QoS Concepts
      • Overview of QoS Concepts
      • QoS Rules
      •  QoS Classes
        • Class Hierarchy
        • Per-Class Parameters
        • QoS Class Latency Priorities
        • QoS Queue Types
        • QoS Queue Depth
        • MX-TCP
      • QoS Profiles
    •  Configuring QoS
      • QoS Configuration Work Flow
      • Enabling QoS
    •  Inbound QoS
      • Introduction to Inbound QoS
      • Assigning an Inbound QoS Profile to a Site
    • LAN Bypass
    • QoS for IPv6
    • QoS in Virtual In-Path and Out-of-Path Deployments
    • QoS in Multiple SteelHead Deployments
    • QoS and Multiple WAN Interfaces
    •  Integrating SteelHeads into Existing QoS Architectures
      • WAN-Side Traffic Characteristics and QoS
      •  QoS Integration Techniques
        • QoS Policy Differentiating Voice Versus Nonvoice Traffic
        • SteelHead Honoring Premarked LAN-Side Traffic
        • SteelHead Remarking Traffic from the LAN Side
        • SteelHead Enforcing the QoS Policy
      •  QoS Marking
        • QoS Marking for SteelHead Control Traffic
        • QoS Marking Default Setting
        • QoS Marking Design Considerations
    • QoS Enforcement Best Practices
    • Upgrading to RiOS Version 9.0
    • Guidelines for the Maximum Number of QoS Classes, Sites, and Rules
  •  QoS Configuration Examples
    •  Configuring QoS Using Best Practices
      • Example QoS Scenario
      • Configuring QoS on the Data Center SteelHead
      • Configuring Applications
      • Creating QoS Profiles
      • Configuring Topology
      • Enabling QoS on the SteelHead
    • Configuring QoS Marking on SteelHeads
    • Configuring QoS and MX-TCP
  •  Path Selection
    • Overview of Path Selection
    •  Path Selection Implementation
      • Path Selection Work Flow
      • Example of a Path Selection Implementation
      • Identifying Traffic Flow Candidates
    • Configuring Path Selection
    •  Valid Path Selection Deployment Design Examples
      • Basic Multiple Route Path Deployment
      • Complex Parallel Path Deployment
      • Complex Single In-Path Interface Deployment
      • Serial Deployment
      •  Firewall Path Traversal Deployment
        • MTU and MSS Adjustment When Using Firewall Path Traversal
        • Firewall Path Traversal Deployment Example
    • Path Selection and Virtual In-Path Deployment
    • Design Validation
    • Design Considerations
  •  Physical In-Path Deployments
    • Overview of In-Path Deployment
    •  The Logical In-Path Interface
      • In-Path IP Address Selection
      • In-Path Default Gateway and Routing
    •  Failure Modes
      • Fail-to-Wire Mode
      • Fail-to-Block Mode
      • Configuring Failure Modes
    • Configuring Link State Propagation
    • EtherChannel
    •  Cabling and Duplex
      • Choosing the Correct Cables
      • Duplex Configuration
      • Troubleshooting Cable and Duplex Issues
    •  Physical In-Path Deployment Configuration Examples
      • Configuring a Basic Physical In-Path Deployment
      • Configuring a Physical In-Path with Dual Links Deployment
      • Configuring a Serial Cluster Deployment with Multiple Links
    •  In-Path Redundancy and Clustering Examples
      •  Primary and Backup Deployments
        • Configuring a Primary and Backup Deployment
        • Adjusting the Timers for Faster Primary and Backup Failover
      •  Serial Cluster Deployments
        • Serial Cluster Rules
        • Configuring a Basic Serial Cluster Deployment
        • Configuring Faster Peer Failure Detection
    • Configuring Simplified Routing
    •  Multiple WAN Router Deployments
      •  Configuring Multiple WAN Router Deployments Without Connection Forwarding
        • Configuring a Single SteelHead and Single Layer-2 Switch Deployment
        • Configuring a Single SteelHead and Dual Layer-2 Switches Deployment
        • Configuring a Single SteelHead and Single Layer-3 Switch Deployment
        • Configuring Single SteelHead and Dual Layer-3 Switches Deployment
      •  Configuring Multiple WAN Router Deployments with Connection Forwarding
        • Configuring Basic Connection Forwarding
        • Configuring Connection Forwarding with Allow-Failure and Fail-to-Block
        • Configuring a Dual SteelHead and Dual Layer-2 Switches Deployment
        • Configuring a Dual SteelHead and Dual Layer-3 Switches Deployment
        • Configuring a Dual SteelHead with Multiple In-Path Deployment
    •  802.1Q Trunk Deployments
      • Overview of VLAN Trunk
      • Configuring a SteelHead on an 802.1Q Trunk Link
      • Capturing Network Traces Using tcpdump
    •  Layer-2 WAN Deployments
      • Layer-2 WANs
      • Broadcast Layer-2 WANs
    •  VLAN Bridging Deployments
      • Overview of VLAN Bridging Deployment
      • VLAN Bridging Considerations
      •  VLAN Bridging Variations
        • Layer-2 VLAN Bridging
        • Layer-3 VLAN Bridging
        • Multiple VLAN Bridging with VLAN Mapping
  •  Virtual In-Path Deployments
    • Overview of Virtual In-Path Deployment
    • Configuring an In-Path, Load-Balanced, Layer-4 Switch Deployment
    • Configuring Flow Data Exports in Virtual In-Path Deployments
  •  WCCP Virtual In-Path Deployments
    • Overview of WCCP
    •  WCCP Fundamentals
      • Service Groups
      •  Assignment Methods
        • Hash Assignment
        • Mask Assignment
        • Choosing an Assignment Method
      •  Redirection and Return Methods
        • WCCP Return Router Determination
        • Best Practices for Determining a Redirection and Return Method
      • WCCP Clustering and Failover
      • Multiple In-Path WCCP
    • The Advantages and Disadvantages of WCCP
    •  Configuring WCCP
      • Basic Steps for Configuring WCCP
      • Configuring a Simple WCCP Deployment
      • Adding a SteelHead to an Existing WCCP Deployment
      •  Configuring a WCCP High Availability Deployment
        • Single SteelHead with Interface High Availability
        • Dual WCCP SteelHeads and Interfaces with High Availability
      • Configuring a Basic WCCP Router
    •  Configuring Additional WCCP Features
      • Specifying the Service Group Password
      • Configuring Multicast Groups
      • Configuring Group Lists to Limit Service Group Members
      •  Configuring Access Control Lists
        • Using Access Control Lists for Specific Traffic Redirection
        • Cisco Access Control List Command Parameters
        • Using Access Control Lists with WCCP
      •  Configuring Load Balancing in WCCP
        • Configuring Load Balancing Using the Hash Assignment Method
        • Configuring Load Balancing Using the Mask Assignment Method
        • Using the Weight Parameter
    • Flow Data in WCCP
    • Verifying and Troubleshooting WCCP Configurations
  •  Policy-Based Routing Virtual In-Path Deployments
    •  Overview of PBR
      • PBR Failover and Cisco Discovery Protocol
      • Alternate PBR Failover Mechanisms
    • Connecting the SteelHead in a PBR Deployment
    •  Configuring PBR
      • Overview of Configuring PBR
      • Configuring a SteelHead to Directly Connect to the Router
      • Configuring a SteelHead to Connect to a Layer-2 Switch
      • Configuring a SteelHead to Connect to a Layer-3 Switch
      • Configuring a SteelHead with Object Tracking
      • Configuring a SteelHead with Multiple PBR Interfaces
      • Configuring Multiple SteelHeads to Connect to Multiple Routers
      • Configuring PBR for Load-Balancing WAN Circuits
      • Configuring Local PBR for ICMP Redirection in a Mixed MTU Environment
    • Exporting Flow Data and Virtual In-Path Deployments
  •  IPv6
    •  Overview of IPv6
      •  RiOS RFC Compliance and Feature Compatibility
        • Features Not Supported with IPv6
      • IPv6 Addressing
      • Traffic Interception
    • In-Path Rules
    •  Deployment Options
      • Configuring an In-Path SteelHead IPv6 Deployment
      • Configuring a SteelHead Serial Cluster IPv6 Deployment
      • Configuring a Connection Forwarding and SteelHead IPv6 Deployment
      • Configuring a Virtual In-Path SteelHead IPv6 Deployment
      • Configuring a Fixed-Target Rule SteelHead IPv6 Deployment
    • Protocol Support
    • Verification and Troubleshooting
  •  Packet Mode Optimization
    • Overview of Packet Mode Optimization
    • Comparison with TCP Proxy Mode Optimization
    • Configuring Packet Mode Optimization
    • Design Considerations
    • Best Practices for Packet Mode Optimization
  •  Satellite Optimization
    •  Overview of Satellite Networks
      • Impact of Latency
      • Impact of Loss
      • Satellite Transport Options
    •  Overview of SCPS
      • SCPS Benefits
      • Common Uses for SCPS
      • SCPS and SteelHeads
    •  TCP Optimization for Satellite Environments
      • SCPS Discovery
      •  Transport Optimization for Satellite Environments
        • Bandwidth Estimation
        • Configuring Error Recovery
        • SCPS Per Connection
        • SCPS Error Tolerance
        • Rate Pacing
        • SCPS Single-Ended Rules
        • SCPS Compression
      • Configuring Automatic Detect TCP Optimization
      • Integrating the SteelHead with Existing Satellite Modem TCP Acceleration
    • Licensing SCPS on a SteelHead
    •  Configuring Satellite Optimization Features
      • Configuring Transport Optimization
      • Configuring Rate Pacing
      • Configuring Single-Ended Connection Rule Table Settings
      • Configuring Single-Ended Rules
    •  Verification and Troubleshooting
      •  Analyzing Connection Optimization Information
        • Using the SteelHead Management Console to Investigate Connection Details
        • Using the Riverbed command-line interface to Investigate Connection Details
      • Analyzing Packets for Discovery Probe Stripping
      • Understanding the Health of the Satellite Signal
      • Potential Under Performance Due to Short Bottleneck Buffer
      • Potential Performance Impact of Loss at the Start of Flow
      • Variance in SCPS Performance
  •  VPN Routing and Forwarding
    •  NSV with VRF Select
      • Virtual Routing and Forwarding
      • NSV with VRF Select
      • IOS Requirements
      • Prerequisites for NSV
      • Example NSV Network Deployment
      •  Configuring NSV
        • Basic Steps for Configuring NSV
        • Configuring the Data Center Router
        • Configuring the PBR Route Map
        • Decoupling VRF from the Subinterface to Implement NSV
        • Configuring Static Routes
        • Configuring the Branch Office Router
        • Configuring the Data Center SteelHead
        • Configuring the Branch Office SteelHead
    •  VRF-Aware WCCP
      •  VRF-Aware WCCP Design Examples
        • XYZ Data Services Design Study (Nexus 7000/NX-OS Example)
        • IJK Enterprise Design Study (ASR 1000/IOS-XE Example)
        • ABC Retail Design Study (ISR/IOS Example)
      • VRF-Aware WCCP Best Practices
  •  Out-of-Path Deployments
    • Overview of Out-of-Path Deployment
    • Limitations of Out-of-Path Deployments
    • Configuring Out-of-Path Deployments
  •  Data Protection Deployments
    • Overview of Data Protection
    •  Planning for a Data Protection Deployment
      •  LAN-Side Throughput and Data Reduction Requirements
        • Configuring a Nightly Full Database Backup
        • Configuring a Daily File Server Replication
        • Configuring a Very Large Nightly Incremental Backup
      • Predeployment Questionnaire
    •  Configuring SteelHeads for Data Protection
      • Adaptive Data Streamlining Feature Settings
      •  CPU Settings
        • Compression Level
        • Adaptive Compression
        • Multicore Balancing
      • Best Practices for Data Streamlining and Compression
      • MX-TCP Settings
      • SteelHead WAN Buffer Settings
      • Router WAN Buffer Settings
    •  Common Data Protection Deployments
      • Remote Office, Branch Office Backups
      • Network Attached Storage Replication
      • Storage Area Network Replication
    •  Designing for Scalability and High Availability
      • Overview of N+M Architecture
      •  Using MX-TCP in N+M Deployments
        • Interceptor and N+M Active and Backup Deployment
        • Interceptor and Pass-Through Connection Blocking Rules
    • Enhanced Visibility and Control for SnapMirror
    • Troubleshooting and Fine-Tuning
    • Third-Party Interoperability
  •  Storage Area Network Replication
    • Overview of SAN Replication
    •  Storage Optimization Modules
      •  FCIP Optimization Module
        • Configuring Base FCIP Module
        • Configuring FCIP Module Rules
      •  SRDF Optimization Module
        • Configuring the Base SRDF Module
        • Detecting Symmetrix VMAX Microcode
        • Configuring SRDF Module Rules
        • Configuring SRDF Selective Optimization
        • Viewing SRDF Reports
    • Best Practices for SAN Replication Using TCP/IP
    •  Best Practices for SAN Replication Using Cisco MDS FCIP
      • FCIP Profiles
      • FCIP Tunnels
      • Configuring a Cisco MDS FCIP Deployment
      • Best Practices for a RiOS v5.5.3 or Later with Cisco MDS FCIP Configuration
  •  Proxy File Services Deployments
    •  Overview of Proxy File Services
      • When to Use PFS
      • PFS Terms
    • Upgrading v2.x PFS Shares
    •  Domain and Local Workgroup Settings
      • Domain Mode
      • Local Workgroup Mode
    • PFS Share Operating Modes
    • Lock Files
    • Configuring PFS
  •  SteelHead and AppResponse Integration
    • Overview of SteelHead and AppResponse Integration
    •  AppResponse and SteelHead Deployment Scenarios
      • Data Center Deployment
      • Cloud Deployment
  •  Authentication, Security, Operations, and Monitoring
    • Overview of Secure Transport
    • Overview of Authentication
    • Authentication Features
    •  Configuring a RADIUS Server
      • Configuring a RADIUS Server with FreeRADIUS
      • Configuring RADIUS Authentication in the SteelHead
      • Configuring RADIUS CHAP Authentication
    •  Configuring a TACACS+ Server
      • Configuring TACACS+ with Cisco Secure Access Control Servers
      • Configuring TACACS+ Authentication in the SteelHead
    •  Securing SteelHeads
      • Overview of Securing SteelHeads
      • Best Practices for Securing Access to SteelHeads
      • Best Practices for Enabling SteelHead Security Features
      • Best Practices for Policy Controls
      • Best Practices for Security Monitoring
      • Configuring SSL Certificates for Web User Interface
    • REST API Access
    •  Capacity Planning
      •  Model Characteristics
        • TCP Connections
        • WAN Capacity Limits
        • RiOS Data Store Size
        • Disk Performance
      •  Admission Control
        • Connection Limits
        • Memory Limits
    • Overview of Exporting Flow Data
    • SNMP Monitoring
    • Configuring SNMP v3 Authentication and Privacy
  •  Troubleshooting SteelHead Deployment Problems
    •  Common Deployment Issues
      •  Duplex Mismatches
        • Solution: Manually Set Matching Speed and Duplex
        • Solution: Use an Intermediary Switch
      •  Inability to Access Files During a WAN Disruption
        • Solution: Use Proxy File Service
      •  Network Asymmetry
        • Solution: Use Connection Forwarding
        • Solution: Use Virtual In-Path Deployment
        • Solution: Deploy a Four-Port SteelHead
      • Unknown (or Unwanted) SteelHead Appears on the Current Connections List
      •  Outdated Antivirus Software
        • Solution: Upgrade Antivirus Software
      •  Packet Ricochets
        • Solution: Add In-Path Routes
        • Solution: Use Simplified Routing
      •  Router CPU Spikes After WCCP Configuration
        • Solution: Use Mask Assignment instead of Hash Assignment
        • Solution: Check Internetwork Operating System Compatibility
        • Solution: Use Inbound Redirection
        • Solution: Use Inbound Redirection with Fixed-Target Rules
        • Solution: Use Inbound Redirection with Fixed-Target Rules and Redirect List
        • Solution: Base Redirection on Ports Rather than ACLs
        • Solution: Use PBR
      •  Server Message Block Signed Sessions
        • Solution: Fully Optimize SMB-Signed Traffic
        • Solution: Enable Secure-CIFS
        • Solution: Disable SMB Signing with Active Directory
      •  Unavailable Opportunistic Locks
        • Solution: None Needed
      •  Underutilized Fat Pipes
        • Solution: Enable High-Speed TCP
    •  MTU Sizing
      • MTU Issues
      • Determining MTU Size in Deployments
      • Connection-Forwarding MTU Considerations
  •  SteelCentral Controller for SteelHead Mobile Deployments
    •  Overview of SteelCentral Controller for SteelHead Mobile Deployment
      • Basic Setup for Deploying Mobile Controller
      • Mobile Controller with VPN Deployments
      • Mobile Controller with Firewall Deployments
      • Branch Office and Remote Access Deployments
    •  Multiple Mobile Controller Deployments
      • Overview of Multiple Mobile Controller Deployments
      • Mobile Controller Concurrent User Limits
      • Configuring Multiple Mobile Controllers for Redundancy
      • Preparing to Join Mobile Controllers in a High-Availability Cluster
      • Sizing Considerations in a High-Availability Cluster
      •  Endpoint License Pooling
        • General Process for Pooled License Distribution
        • License Thresholds
        • Pooled License Counts During Cluster Member Failure
      • Communication Between HA Cluster Members
    • Ports Used with Mobile Controllers and SteelHead Mobiles
    • Interaction Between Mobile Controllers and SteelHead Mobile Clients
    •  Location Awareness
      • Overview of Location Awareness
      •  Branch Warming
        • Branch Warming and SteelHead Mobile Licenses
        • Branch Warming and Enhanced Auto-Discovery
    •  SSL with SteelCentral Controller for SteelHead Mobile
      • Traditional SSL Optimization
      • Advanced High-Security SSL Optimization
      • Configuring SteelCentral Controller for SteelHead Mobile and SSL
      • Supported TLS Versions with SteelHead Mobile
      • Multiple Mobile Controllers and SSL
    •  Mobile Controller Best Practices and Other Considerations
      • Deployment Scenarios
      • Management Best Practices
      • Migration Mobile Controller Hardware
      • Licensing Best Practices
      • Antivirus Software
      • Signed SMB Support
      • SSL Client Authentication Support
      • SMC and Federal Information Processing Standard (FIPS)
      • Optimization Before User Log In

SteelHead™ Deployment Guide

Mobile Controller Best Practices and Other Considerations