• SteelHead™ Deployment Guide
•  Preface
  •  About This Guide
    • Audience
    • Types of SteelHeads
    • Document Conventions
  • Documentation and Release Notes
  • Contacting Riverbed
  • What Is New
•  Optimization Techniques and Design Fundamentals
  •  How SteelHeads Optimize Data
    •  Data Streamlining
      • Scalable Data Referencing
      • Bidirectional Synchronized RiOS Data Store
      • Unified RiOS Data Store
    •  Transport Streamlining
      • Overview of Transport Streamlining
      • Connection Pooling
      • TCP Automatic Detection
      • SteelCentral Controller for SteelHead Mobile TCP Transport Modes
      • Tuning SteelHeads for High-Latency Links
      • TCP Algorithm Selection
      • WAN Buffers
    • Application Streamlining
    • Management Streamlining
  •  RiOS Data Store Synchronization
    • RiOS Data Store Synchronization Requirements
    • RiOS Data Store Error Alarms
  • Choosing the Right SteelHead Model
  •  Deployment Modes for the SteelHead
  •  Autodiscovery Protocol
    • Original Autodiscovery Process
    • Configuring Enhanced Autodiscovery
  •  Autodiscovery and Firewall Considerations
    • Removal of the Riverbed TCP Option Probe
    • Stateful Firewall Device in a Multiple In-Path Environment
  • Multiple In-Path Discovery Behavior
  •  Controlling Optimization
    • In-Path Rules
    • Default In-Path Rules
    • Peering Rules
    • Kickoff and Automatic Kickoff Features
  •  Controlling Optimization Configuration Examples
    • Configuring High-Bandwidth, Low-Latency Environment
    • Configuring Pass-Through Transit Traffic
  •  Fixed-Target In-Path Rules
    • Configuring a Fixed-Target In-Path Rule for an In-Path Deployment
    • Fixed-Target In-Path Rule for an Out-of-Path Deployment
  • Best Practices for SteelHead Deployments
•  Network Integration Tools
  •  Redundancy and Clustering
    • Physical In-Path Deployments
    • Virtual In-Path Deployments
    • Out-of-Path Deployments
  • Fail-to-Wire and Fail-to-Block
  • Overview of Link State Propagation
  •  Connection Forwarding
    • Configuring Connection Forwarding
    • Multiple-Interface Support Within Connection Forwarding
    • Failure Handling Within Connection Forwarding
    • Connection-Forwarding Neighbor Latency
  • Overview of Simplified Routing
•  WAN Visibility Modes
  • Overview of WAN Visibility
  • Correct Addressing
  •  Transparent Addressing
    • Port Transparency
    •  Full Address Transparency
      • Overview of Full Address Transparency
      • Configuring VLANs and Full Address Transparency
    • Full Address Transparency with Forward Reset
  •  Implications of Transparent Addressing
    • Stateful Systems
    •  Network Design Issues
      • Network Asymmetry
      • Misrouting Optimized Traffic
      • Firewalls Located Between SteelHeads
    •  Integration into Networks Using NAT
      • NAT Deployment Using Enhanced Autodiscovery and Full Transparency
      • NAT Deployment Using Fixed-Target Rules
      • NAT Deployment Using Correct and Port Transparency Addressing Modes
      • Client-Side Source NAT Using Enhanced Autodiscovery and Full Transparency
      • Failed Client-Side Source NAT Deployment Using Enhanced Autodiscovery and Correct Addressing
      • Dual NAT Deployment Using Enhanced Autodiscovery and Full Transparency
      • Failed Dual NAT Deployment Using Enhanced Autodiscovery and Correct Addressing
  •  Out-of-Band Connection
    • Overview of OOB Connections and Addressing Modes
    • Configuring OOB Connection Destination Transparency
    • Configuring OOB Connection Full Transparency
  • Configuring WAN Visibility Modes
•  Topology
  • Introduction to the Topology Concept
  • Defining a Network
  •  Defining a Site
    • Configuring the Local Site
    • Configuring the Default Site
•  Application Definitions
  •  Applications
    • Defining an Application
    • Application Properties
  •  Application Flow Engine
    • Overview of Application Flow Engine
    • AFE and Microsoft Lync 2010 and 2013
  • Creating Host Labels
  • Creating Port Labels
  • Creating Domain Labels
•  QoS Configuration and Integration
  • Overview of Riverbed QoS
  •  QoS Concepts
    • Overview of QoS Concepts
    • QoS Rules
    •  QoS Classes
      • Class Hierarchy
      • Per-Class Parameters
      • QoS Class Latency Priorities
      • QoS Queue Types
      • QoS Queue Depth
      • MX-TCP
    • QoS Profiles
  •  Configuring QoS
    • QoS Configuration Workflow
    • Enabling QoS
  •  Inbound QoS
    • Introduction to Inbound QoS
    • Assigning an Inbound QoS Profile to a Site
  • LAN Bypass
  • QoS for IPv6
  • QoS in Virtual In-Path and Out-of-Path Deployments
  • QoS in Multiple SteelHead Deployments
  • QoS and Multiple WAN Interfaces
  •  Integrating SteelHeads into Existing QoS Architectures
    • WAN-Side Traffic Characteristics and QoS
    •  QoS Integration Techniques
      • QoS Policy Differentiating Voice Versus Nonvoice Traffic
      • SteelHead Honoring Premarked LAN-Side Traffic
      • SteelHead Remarking Traffic from the LAN Side
      • SteelHead Enforcing the QoS Policy
    •  QoS Marking
      • QoS Marking for SteelHead Control Traffic
      • QoS Marking Default Setting
      • QoS Marking Design Considerations
  • QoS Enforcement Best Practices
  • Upgrading to RiOS Version 9.0
  • Guidelines for the Maximum Number of QoS Classes, Sites, and Rules
•  QoS Configuration Examples
  •  Configuring QoS Using Best Practices
    • Example QoS Scenario
    • Configuring QoS on the Data Center SteelHead
    • Configuring Applications
    • Creating QoS Profiles
    • Configuring Topology
    • Enabling QoS on the SteelHead
  • Configuring QoS Marking on SteelHeads
  • Configuring QoS and MX-TCP
•  Path Selection
  • Overview of Path Selection
  •  Path Selection Implementation
    • Path Selection Workflow
    • Example of a Path Selection Implementation
    • Identifying Traffic Flow Candidates
  • Configuring Path Selection
  •  Valid Path Selection Deployment Design Examples
    • Basic Multiple Route Path Deployment
    • Complex Parallel Path Deployment
    • Complex Single In-Path Interface Deployment
    • Serial Deployment
    •  Firewall Path Traversal Deployment
      • MTU and MSS Adjustment When Using Firewall Path Traversal
      • Firewall Path Traversal Deployment Example
  • Path Selection and Virtual In-Path Deployment
  • Design Validation
  • Design Considerations
•  Physical In-Path Deployments
  • Overview of In-Path Deployment
  •  Logical In-Path Interface
    • In-Path IP Address Selection
    • In-Path Default Gateway and Routing
  •  Failure Modes
    • Fail-to-Wire Mode
    • Fail-to-Block Mode
    • Configuring Failure Modes
  • Configuring Link State Propagation
  • EtherChannel
  •  Cabling and Duplex
    • Choosing the Correct Cables
    • Duplex Configuration
    • Troubleshooting Cable and Duplex Issues
  •  Physical In-Path Deployment Configuration Examples
    • Configuring a Basic Physical In-Path Deployment
    • Configuring a Physical In-Path with Dual Links Deployment
    • Configuring a Serial Cluster Deployment with Multiple Links
  •  In-Path Redundancy and Clustering Examples
    •  Primary and Backup Deployments
      • Configuring a Primary and Backup Deployment
      • Adjusting the Timers for Faster Primary and Backup Failover
    •  Serial Cluster Deployments
      • Serial Cluster Rules
      • Configuring a Basic Serial Cluster Deployment
      • Configuring Faster Peer Failure Detection
  • Configuring Simplified Routing
  •  Multiple WAN Router Deployments
    •  Configuring Multiple WAN Router Deployments Without Connection Forwarding
      • Configuring a Single SteelHead and Single Layer-2 Switch Deployment
      • Configuring a Single SteelHead and Dual Layer-2 Switches Deployment
      • Configuring a Single SteelHead and Single Layer-3 Switch Deployment
      • Configuring Single SteelHead and Dual Layer-3 Switches Deployment
    •  Configuring Multiple WAN Router Deployments with Connection Forwarding
      • Configuring Basic Connection Forwarding
      • Configuring Connection Forwarding with Allow-Failure and Fail-to-Block
      • Configuring a Dual SteelHead and Dual Layer-2 Switches Deployment
      • Configuring a Dual SteelHead and Dual Layer-3 Switches Deployment
      • Configuring a Dual SteelHead with Multiple In-Path Deployment
  •  802.1Q Trunk Deployments
    • Overview of VLAN Trunk
    • Configuring a SteelHead on an 802.1Q Trunk Link
    • Capturing Network Traces Using tcpdump
  •  Layer-2 WAN Deployments
    • Layer-2 WANs
    • Broadcast Layer-2 WANs
  •  VLAN Bridging Deployments
    • Overview of VLAN Bridging Deployment
    • VLAN Bridging Considerations
    •  VLAN Bridging Variations
      • Layer-2 VLAN Bridging
      • Layer-3 VLAN Bridging
      • Multiple VLAN Bridging with VLAN Mapping
•  Virtual In-Path Deployments
  • Overview of Virtual In-Path Deployment
  • Configuring an In-Path, Load-Balanced, Layer-4 Switch Deployment
  • Configuring Flow Data Exports in Virtual In-Path Deployments
•  WCCP Virtual In-Path Deployments
  • Overview of WCCP
  •  WCCP Fundamentals
    • Service Groups
    •  Assignment Methods
      • Hash Assignment
      • Mask Assignment
      • Choosing an Assignment Method
    •  Redirection and Return Methods
      • WCCP Return Router Determination
      • Best Practices for Determining a Redirection and Return Method
    • WCCP Clustering and Failover
    • Multiple In-Path WCCP
  • Advantages and Disadvantages of WCCP
  •  Configuring WCCP
    • Basic Steps for Configuring WCCP
    • Configuring a Simple WCCP Deployment
    • Adding a SteelHead to an Existing WCCP Deployment
    •  Configuring a WCCP High Availability Deployment
      • Single SteelHead with Interface High Availability
      • Dual WCCP SteelHeads and Interfaces with High Availability
    • Configuring a Basic WCCP Router
  •  Configuring Additional WCCP Features
    • Specifying the Service Group Password
    • Configuring Multicast Groups
    • Configuring Group Lists to Limit Service Group Members
    •  Configuring Access Control Lists
      • Using Access Control Lists for Specific Traffic Redirection
      • Cisco Access Control List Command Parameters
      • Using Access Control Lists with WCCP
    •  Configuring Load Balancing in WCCP
      • Configuring Load Balancing Using the Hash Assignment Method
      • Configuring Load Balancing Using the Mask Assignment Method
      • Using the Weight Parameter
  • Flow Data in WCCP
  • Verifying and Troubleshooting WCCP Configurations
•  Policy-Based Routing Virtual In-Path Deployments
  •  Overview of PBR
    • PBR Failover and Cisco Discovery Protocol
    • Alternate PBR Failover Mechanisms
  • Connecting the SteelHead in a PBR Deployment
  •  Configuring PBR
    • Overview of Configuring PBR
    • Configuring a SteelHead to Directly Connect to the Router
    • Configuring a SteelHead to Connect to a Layer-2 Switch
    • Configuring a SteelHead to Connect to a Layer-3 Switch
    • Configuring a SteelHead with Object Tracking
    • Configuring a SteelHead with Multiple PBR Interfaces
    • Configuring Multiple SteelHeads to Connect to Multiple Routers
    • Configuring PBR for Load Balancing WAN Circuits
    • Configuring Local PBR for ICMP Redirection in a Mixed MTU Environment
  • Exporting Flow Data and Virtual In-Path Deployments
•  IPv6
  •  Overview of IPv6
    •  RiOS RFC Compliance and Feature Compatibility
      • Features Not Supported with IPv6
    • IPv6 Addressing
    • Traffic Interception
  • In-Path Rules
  •  Deployment Options
    • Configuring an In-Path SteelHead IPv6 Deployment
    • Configuring a SteelHead Serial Cluster IPv6 Deployment
    • Configuring a Connection Forwarding and SteelHead IPv6 Deployment
    • Configuring a Virtual In-Path SteelHead IPv6 Deployment
    • Configuring a Fixed-Target Rule SteelHead IPv6 Deployment
  • Protocol Support
  • Verification and Troubleshooting
•  Packet Mode Optimization
  • Overview of Packet Mode Optimization
  • Comparison with TCP Proxy Mode Optimization
  • Configuring Packet Mode Optimization
  • Design Considerations
  • Best Practices for Packet Mode Optimization
•  Satellite Optimization
  •  Overview of Satellite Networks
    • Impact of Latency
    • Impact of Loss
    • Satellite Transport Options
  •  Overview of SCPS
    • SCPS Benefits
    • Common Uses for SCPS
    • SCPS and SteelHeads
  •  TCP Optimization for Satellite Environments
    • SCPS Discovery
    •  Transport Optimization for Satellite Environments
      • Bandwidth Estimation
      • Configuring Error Recovery
      • SCPS Per Connection
      • SCPS Error Tolerance
      • Rate Pacing
      • SCPS Single-Ended Rules
      • SCPS Compression
    • Configuring Automatic Detect TCP Optimization
    • Integrating the SteelHead with Existing Satellite Modem TCP Acceleration
  • Licensing SCPS on a SteelHead
  •  Configuring Satellite Optimization Features
    • Configuring Transport Optimization
    • Configuring Rate Pacing
    • Configuring Single-Ended Connection Rule Table Settings
    • Configuring Single-Ended Rules
  •  Verification and Troubleshooting
    •  Analyzing Connection Optimization Information
      • Using the SteelHead Management Console to Investigate Connection Details
      • Using the Riverbed command-line interface to Investigate Connection Details
    • Analyzing Packets for Discovery Probe Stripping
    • Understanding the Health of the Satellite Signal
    • Potential Under Performance Due to Short Bottleneck Buffer
    • Potential Performance Impact of Loss at the Start of Flow
    • Variance in SCPS Performance
•  VPN Routing and Forwarding
  •  NSV with VRF Select
    • Virtual Routing and Forwarding
    • NSV with VRF Select
    • IOS Requirements
    • Prerequisites for NSV
    • Example NSV Network Deployment
    •  Configuring NSV
      • Basic Steps for Configuring NSV
      • Configuring the Data Center Router
      • Configuring the PBR Route Map
      • Decoupling VRF from the Subinterface to Implement NSV
      • Configuring Static Routes
      • Configuring the Branch Office Router
      • Configuring the Data Center SteelHead
      • Configuring the Branch Office SteelHead
  •  VRF-Aware WCCP
    •  VRF-Aware WCCP Design Examples
      • XYZ Data Services Design Study (Nexus 7000/NX-OS Example)
      • IJK Enterprise Design Study (ASR 1000/IOS-XE Example)
      • ABC Retail Design Study (ISR/IOS Example)
    • VRF-Aware WCCP Best Practices
•  Out-of-Path Deployments
  • Overview of Out-of-Path Deployment
  • Limitations of Out-of-Path Deployments
  • Configuring Out-of-Path Deployments
•  Data Protection Deployments
  • Overview of Data Protection
  •  Planning for a Data Protection Deployment
    •  LAN-Side Throughput and Data Reduction Requirements
      • Configuring a Nightly Full Database Backup
      • Configuring a Daily File Server Replication
      • Configuring a Very Large Nightly Incremental Backup
    • Predeployment Questionnaire
  •  Configuring SteelHeads for Data Protection
    • Adaptive Data Streamlining Feature Settings
    •  CPU Settings
      • Compression Level
      • Adaptive Compression
      • Multicore Balancing
    • Best Practices for Data Streamlining and Compression
    • MX-TCP Settings
    • SteelHead WAN Buffer Settings
    • Router WAN Buffer Settings
  •  Common Data Protection Deployments
    • Remote Office, Branch Office Backups
    • Network Attached Storage Replication
    • Storage Area Network Replication
  •  Designing for Scalability and High Availability
    • Overview of N+M Architecture
    •  Using MX-TCP in N+M Deployments
      • Interceptor and N+M Active and Backup Deployment
      • Interceptor and Pass-Through Connection Blocking Rules
  • Enhanced Visibility and Control for SnapMirror
  • Troubleshooting and Fine-Tuning
  • Third-Party Interoperability
•  Storage Area Network Replication
  • Overview of SAN Replication
  •  Storage Optimization Modules
    •  FCIP Optimization Module
      • Configuring Base FCIP Module
      • Configuring FCIP Module Rules
    •  SRDF Optimization Module
      • Configuring the Base SRDF Module
      • Detecting Symmetrix VMAX Microcode
      • Configuring SRDF Module Rules
      • Configuring SRDF Selective Optimization
      • Viewing SRDF Reports
  • Best Practices for SAN Replication Using TCP/IP
  •  Best Practices for SAN Replication Using Cisco MDS FCIP
    • FCIP Profiles
    • FCIP Tunnels
    • Configuring a Cisco MDS FCIP Deployment
    • Best Practices for a RiOS 5.5.3 or Later with Cisco MDS FCIP Configuration
•  SteelHead and AppResponse Integration
  • Overview of SteelHead and AppResponse Integration
  •  AppResponse and SteelHead Deployment Scenarios
    • Data Center Deployment
    • Cloud Deployment
•  Authentication, Security, Operations, and Monitoring
  • Overview of Secure Transport
  • Overview of Authentication
  • Authentication Features
  •  Configuring a RADIUS Server
    • Configuring a RADIUS Server with FreeRADIUS
    • Configuring RADIUS Authentication in the SteelHead
    • Configuring RADIUS CHAP Authentication
  •  Configuring a TACACS+ Server
    • Configuring TACACS+ with Cisco Secure Access Control Servers
    • Configuring TACACS+ Authentication in the SteelHead
  •  Securing SteelHeads
    • Overview of Securing SteelHeads
    • Best Practices for Securing Access to SteelHeads
    • Best Practices for Enabling SteelHead Security Features
    • Best Practices for Policy Controls
    • Best Practices for Security Monitoring
    • Configuring SSL Certificates for Web User Interface
  • REST API Access
  •  Capacity Planning
    •  Model Characteristics
      • TCP Connections
      • WAN Capacity Limits
      • RiOS Data Store Size
      • Disk Performance
    •  Admission Control
      • Connection Limits
      • Memory Limits
  • Overview of Exporting Flow Data
  • SNMP Monitoring
  • Configuring SNMPv3 Authentication and Privacy
•  Troubleshooting SteelHead Deployment Problems
  •  Common Deployment Issues
    •  Duplex Mismatches
      • Solution: Manually Set Matching Speed and Duplex
      • Solution: Use an Intermediary Switch
    •  Network Asymmetry
      • Solution: Use Connection Forwarding
      • Solution: Use Virtual In-Path Deployment
      • Solution: Deploy a Four-Port SteelHead
    • Unknown (or Unwanted) SteelHead Appears on the Current Connections List
    •  Outdated Antivirus Software
      • Solution: Upgrade Antivirus Software
    •  Packet Ricochets
      • Solution: Add In-Path Routes
      • Solution: Use Simplified Routing
    •  Router CPU Spikes After WCCP Configuration
      • Solution: Use Mask Assignment instead of Hash Assignment
      • Solution: Check Internetwork Operating System Compatibility
      • Solution: Use Inbound Redirection
      • Solution: Use Inbound Redirection with Fixed-Target Rules
      • Solution: Use Inbound Redirection with Fixed-Target Rules and Redirect List
      • Solution: Base Redirection on Ports Rather than ACLs
      • Solution: Use PBR
    •  Server Message Block Signed Sessions
      • Solution: Fully Optimize SMB-Signed Traffic
      • Solution: Enable Secure-CIFS
      • Solution: Disable SMB Signing with Active Directory
    •  Unavailable Opportunistic Locks
      • Solution: None Needed
    •  Underutilized Fat Pipes
      • Solution: Enable High-Speed TCP
  •  MTU Sizing
    • MTU Issues
    • Determining MTU Size in Deployments
    • Connection-Forwarding MTU Considerations
•  SteelCentral Controller for SteelHead Mobile Deployments
  •  Overview of SteelCentral Controller for SteelHead Mobile Deployment
    • Basic Setup for Deploying Mobile Controller
    • Mobile Controller with VPN Deployments
    • Mobile Controller with Firewall Deployments
    • Branch Office and Remote Access Deployments
  •  Multiple Mobile Controller Deployments
    • Overview of Multiple Mobile Controller Deployments
    • Mobile Controller Concurrent User Limits
    • Configuring Multiple Mobile Controllers for Redundancy
    • Preparing to Join Mobile Controllers in a High-Availability Cluster
    • Sizing Considerations in a High-Availability Cluster
    •  Endpoint License Pooling
      • General Process for Pooled License Distribution
      • License Thresholds
      • Pooled License Counts During Cluster Member Failure
    • Communication Between HA Cluster Members
  • Ports Used with Mobile Controllers and SteelHead Mobiles
  • Interaction Between Mobile Controllers and SteelHead Mobile Clients
  •  Location Awareness
    • Overview of Location Awareness
    •  Branch Warming
      • Branch Warming and SteelHead Mobile Licenses
      • Branch Warming and Enhanced Autodiscovery
  •  SSL with SteelCentral Controller for SteelHead Mobile
    • Traditional SSL Optimization
    • Advanced High-Security SSL Optimization
    • Configuring SteelCentral Controller for SteelHead Mobile and SSL
    • Using SteelHead Mobile with SSL Proxy Devices
    • Supported TLS Versions with SteelHead Mobile
    • Multiple Mobile Controllers and SSL
  •  Mobile Controller Best Practices and Other Considerations
    • Deployment Scenarios
    • Management Best Practices
    • Migration Mobile Controller Hardware
    • Licensing Best Practices
    • Antivirus Software
    • Signed SMB Support
    • SSL Client Authentication Support
    • SMC and Federal Information Processing Standard (FIPS)
    • Optimization Before User Log In

SteelHead™ Deployment Guide

SteelCentral Controller for SteelHead Mobile Deployments