Configuring in-path interfaces

You can configure in-path interfaces under Manage > Topology: Appliances. Select the name of the appliance you want to edit to expand the page and display the Appliance tabs, and select the Appliance Pages tab to display the Appliance Configuration Pages list.

Under Appliance Configuration Pages, click In-Path Interfaces to display the Editing Appliance Configuration: <hostname>, In-Path Interfaces page.

This configuration option is available under In-Path Settings to enable link state propagation:

Shortens the recovery time of a link failure in physical in-path deployments. Link state propagation (LSP) communicates link status between the devices connected to the SteelHead. When you enable this LSP, RiOS monitors the link state of each SteelHead LAN-WAN pair.

If either physical port loses link status, the corresponding interface disconnects, blocking the link. This control allows a link failure to quickly propagate through a chain of devices. If the link recovers, the SteelHead restores the corresponding interface automatically.

LSP is enabled by default.

• SteelHead (Virtual Edition) appliances running RiOS 8.0.3 or later with ESXi 6.5 using a Riverbed NIC card support LSP.

These SteelHead (Virtual Edition) appliance configurations don’t support LSP:

Select the interface that you want to edit to expand the page.

To edit the interface, select the enable interface check box. These configuration options are available:

Specifies to use IPv4.

Specifies an IP address. This IP address is the in-path main interface.

In the In-Path Interfaces page, you can clear either the IPv4 Address field or the IPv6 Address field, but not both. You must use the CLI to clear both addresses. Use the no interface <interface-name> ip address command and the no interface <interface-name> ipv6 address <ipv6-address> command to clear both. For details, see the Riverbed Command-Line Interface Reference Manual.

Specifies the subnet mask.

Specifies the IP address for the in-path gateway. If you have a router (or a Layer-3 switch) on the LAN side of your network, specify this device as the in-path gateway.

If there is a routed network on the LAN-side of the in-path appliance, the router that’s the default gateway for the appliance must not have the ACL configured to drop packets from the remote hosts as its source. The in-path appliance uses IP masquerading to appear as the remote server.

Assigns an IPv6 address. IPv6 addresses are disabled by default. You can only assign one IPv6 address per in-path interface.

The primary and in-path interfaces can share the same subnet. The primary and auxiliary interfaces can’t share the same network subnet.

Specifies a global or site-local IPv6 address. This IP address is the in-path main interface. You can’t use a DHCP server to assign an IPv6 address automatically.

In the In-Path Interfaces page, you can clear either the IPv4 Address field or the IPv6 Address field, but not both. You must use the CLI to clear both addresses. Use the no interface <interface-name> ip address and the no interface <interface-name> ipv6 address <ipv6-address> to clear both. For details, see the Riverbed Command-Line Interface Reference Manual.

Specifies the prefix. The prefix length is 0 to 128 bits, separated from the address by a forward slash (/). In this example, 60 is the prefix: 2001:38dc:52::e9a4:c5:6282/60

Specifies the IPv6 address for the in-path gateway. You can use a link local address. If you have a router (or a Layer-3 switch) on the LAN side of your network, specify this device as the in-path gateway.

If your network routers or switches don’t automatically negotiate the speed and duplex, be sure to set them on the device manually.

The speed and duplex must match (LAN and WAN) in an in-path configuration. To avoid a speed and duplex mismatch, configure your LAN external pair to match the WAN external pair.

Speed and duplex mismatches can easily occur in a network. For example, if one end of the link is set at half duplex or full duplex and the other end of the link is configured to autonegotiate (auto), the link defaults to half duplex, regardless of the duplex setting on the nonautonegotiated end. This duplex mismatch passes traffic, but it causes interface errors and results in degraded optimization.

These guidelines can help you avoid speed and duplex mismatches when configuring the SteelHead:

• Routers are often configured with fixed speed and duplex settings. Check your router configuration and set it to match the SteelHead WAN and LAN settings. Make sure that your switch has the correct setting.

• After you finish configuring the SteelHead, check for speed and duplex error messages (cyclic redundancy check (CRC) or frame errors) in the System Log page of the Management Console.

• If there is a serious problem with the SteelHead and it goes into bypass mode (that’s, it automatically continues to pass traffic through your network), a speed and duplex mismatch might occur when you reboot the SteelHead. To avoid a speed and duplex mismatch, configure your LAN external pair to match the WAN external pair.

Specifies the MTU value. The MTU is the largest physical packet size, measured in bytes, that a network can send. Applies to optimized traffic only. The default value is 1500.

Specifies the VLAN tag that the appliance uses to communicate with other SteelHeads in your network. The VLAN Tag ID might be the same value or a different value than the VLAN tag used on the client. A zero (0) value specifies nontagged (or native VLAN) and is the correct setting if there are no VLANs present. As an example, if the in-path interface is 192.168.1.1 in VLAN 200, you would specify tag 200.

When the SteelHead communicates with a client or a server, it uses the same VLAN tag as the client or the server. If the SteelHead can’t determine which VLAN the client or server is in, it doesn’t use the VLAN tag (assuming that there is no router between the SteelHead and the client or server).

You must also define in-path rules to apply to your VLANs.

These configuration options are available under Management Interface <hostname>:

Enables a secondary MIP interface that you can reach through the physical in-path LAN and WAN interfaces. Configuring a secondary MIP interface allows management of SteelHeads from a private network while maintaining a logical separation of network traffic. If LSP or fail-to-block is enabled, a message reminds you to disable the feature before enabling the MIP interface.

Specifies the IP address for the MIP interface.

Specifies the subnet mask.

Enables IPv6 support on this interface.

Specifies the IPv6 address.

Specifies the prefix. The prefix length is 0 to 128 bits, separated from the address by a forward slash (/). In this example, 60 is the prefix: 2001:38dc:52::e9a4:c5:6282/60

Specifies a numeric VLAN Tag ID. When you specify the VLAN Tag ID for the MIP interface, all packets originating from the SteelHead from the MIP interface are tagged with that identification number. The VLAN Tag ID might be the same value or a different value than the in-path interface VLAN tag ID. The MIP interface could be untagged and the in-path interface could be tagged and vice versa. A zero (0) value specifies nontagged (or native VLAN) and is the correct setting if there are no VLANs present. For example, if the MIP interface is 192.168.1.1 in VLAN 200, you would specify tag 200.