Configuring Network Integration Features

Figure: Parallel Deployment in Asymmetric Networks

Figure: Serial Deployment to Provide Failover Support

Figure: Quad Deployment to Provide Failover Support

Figure: Octal Deployment

Figure: SteelHead Interceptors Page (Standard Mode)

Figure: SteelHead Interceptors Page (VLAN Segregation Mode)

Control	Description
Optimize Connections When Connection- Forwarding SteelHead Interceptor is Not Connected	If this appliance is configured to communicate with another SteelHead Interceptor in parallel, select this option if you want to enable allow failure mode on this appliance. The allow failure feature causes the appliance to continue to optimize new connections if connection to the cluster SteelHead Interceptor is lost. By default, the allow failure option is disabled, which means that the appliance stops attempting to optimize new connections if connection to the cluster SteelHead Interceptor is lost. Note: To enable the allow failure feature, you must select the allow failure option on all SteelHead Interceptors on the parallel links, and you must select the allow failure option on all SteelHeads that point to these SteelHead Interceptors. Note: Use the allow failure feature when you can guarantee that the traffic will be rerouted across SteelHead Interceptors that are available to process traffic. To make this guarantee, enable the fail-to-block failure condition. For more information about this failure condition, see Configuring In-Path Interfaces.
Use Multiple Interfaces to Communicate with SteelHead Interceptors	If this appliance is to communicate with other SteelHead Interceptors on multiple interfaces, select this option to enable multiple interface support on this appliance. This option prevents loss of reachability between this SteelHead Interceptor and the other failover or cluster Interceptors that communicate with this appliance. Note: When you add this SteelHead Interceptor to the Interceptor-to-Interceptor communication list on other appliances in the set, Riverbed recommends that you specify the IP addresses of all enabled in-path interfaces on this appliance.
Communicate with SteelHead Interceptors Using This Interface (standard mode only)	If this appliance is not to communicate with other SteelHead Interceptors on multiple interfaces, you must select one enabled in-path interface for Interceptor-to-Interceptor communication. This requirement applies whether the appliance is deployed as a failover or cluster Interceptor, or if the appliance is deployed is a single SteelHead Interceptor that does not communicate with other SteelHead Interceptors. Select this option to enable the Interface drop-down list.
Interface (standard mode only)	Select from this drop-down list the enabled in-path interface that this appliance is to use for Interceptor-to-Interceptor communication. The inpath0_0 interface is selected by default, even if that logical interface is not enabled. For information about enabling an in-path interface on a SteelHead Interceptor, see Configuring In-Path Interfaces. Note: When you add this SteelHead Interceptor to the Interceptor communication list on the other SteelHead Interceptor or appliance with which it communicates, you enter the IP address of this interface in the Main Address field.

Control	Description
Add a New SteelHead Interceptor	Displays the controls for adding a local SteelHead Interceptor to the Interceptor communication list on the current configuration. If you are configuring a failover Interceptor, add the other failover Interceptor. If you are configuring a cluster Interceptor, add all of the other SteelHead Interceptors in that cluster.
Name	Specify a name for the local SteelHead Interceptor that you are adding.
Main Address	Specify the IP address of the local SteelHead Interceptor’s in-path interface that is configured to be used for Interceptor-to-Interceptor communication. Use the following format: X.X.X.X
Additional Addresses	If you are adding a SteelHead Interceptor on which multiple interface connection forwarding is enabled, specify additional network addresses for that SteelHead Interceptor. Note: Riverbed recommends that you specify the IP addresses of all enabled in-path interfaces on that appliance.
Use For Failover	If you are adding a SteelHead Interceptor that is in series with the appliance you are configuring, select this option if the SteelHead Interceptor you are adding is to be the failover appliance for the appliance you are configuring. For details, see Serial Deployments and Quad Deployments.
Add	Adds the settings to the running configuration.
Remove Selected SteelHead Interceptors	To remove a SteelHead Interceptor from the list, select the check box next to the name and click Remove Selected Interceptors. If you remove a SteelHead Interceptor from this list, make sure that you also remove this appliance from the other SteelHead Interceptors in the set.

Figure: SteelHeads Page (Standard Mode)

Figure: SteelHeads Page (VLAN Segregation Mode)

Control	Description
Use Multiple Interfaces to Communicate with Cluster SteelHeads	Select this option to enable multiple interface support (MIS). MIS prevents the loss of connectivity between a SteelHead Interceptor and cluster SteelHeads and enables SteelHeads to connect using multiple WAN interfaces. If you enable multiple interface support, the following constraints apply: • 5.0x SteelHeads must be running RiOS 5.0.7 or later. • 5.5.x SteelHeads must be running RiOS 5.5.2 or later. • Load-balancing rules apply only to the main IP address.
Communicate with Cluster SteelHeads Using This Interface	Select this option to enable selection of the interface to use for Interceptor-to-SteelHead communication.
Interface	Use this drop-down list to select a configured in-path interface to use for Interceptor-to-SteelHead communication. The drop-down list includes only those interfaces that have been enabled and have been configured with IP addresses. For more information, see Configuring In-Path Interfaces. When selecting an interface, note the following points: • Specify the same in-path interface for Interceptor-to-SteelHead communication. • Use the same interface for communication with all SteelHeads. • When you configure SteelHead-to-Interceptor communication in Configuring SteelHead-to-Interceptor Communication, make sure that you configure the SteelHead to communicate with this SteelHead Interceptor on this interface.

Control	Description
Add a New SteelHead	Displays the controls to add a new SteelHead: • Name - Specify a name by which the cluster SteelHead can be identified. • Main Address - Specify the IP address for the SteelHead inpath0_0 interface. Use the following format: X.X.X.X • Additional Addresses - Optionally, specify additional IP addresses for the new cluster SteelHead. In a deployment scenario with dual-attached SteelHeads, these addresses provide a secondary route for connections to reach the target SteelHead. Note: The additional addresses are ignored if the Use Multiple Interfaces to Communicate with Cluster SteelHeads option is not selected. Use the main IP address of the SteelHead when configuring load-balancing rules.
Remove Selected SteelHeads	To remove a SteelHead, select the check box next to the name and click Remove Selected SteelHead. Note: When you remove a SteelHead, new connections are not made until you add the SteelHead again and restart the service. If you remove the SteelHead configuration from SteelHead Interceptor A of an A-B pair, make sure to remove the SteelHead configuration from SteelHead Interceptor B.
Add	Click to add the new SteelHead configuration to the running configuration.

Figure: SteelHeads Page (Standard Mode)

Figure: SteelHeads Page (VLAN Segregation Mode)

Control	Description
Name	Specify a name by which the cluster SteelHead can be identified.
Additional Addresses	Optionally, modify the list additional IP addresses for the selected cluster SteelHead. These addresses are ignored if the Enable Multiple Interface Support check box is not selected. Note: Use the main IP address of the SteelHead when configuring load-balancing rules (or when configuring service rules if path selection is enabled).

Control	Description
Enable WCCPv2 Support	Enables WCCPv2 support on all groups added to the Service Group list.
Multicast TTL	Specify the TTL boundary for the WCCP protocol packets. The default value is 16.

Control	Description
Add a New Service Group	Displays the controls for adding a new service group.
Interface	Select a SteelHead Interceptor interface to participate in a WCCP service group. You must include an interface with the service group ID. More than one SteelHead Interceptor in-path interface can participate in the same service group. For WCCP configuration examples, see the Riverbed Deployment Guide. If multiple SteelHead Interceptors are used in the topology, they must be configured as part of the cluster.
Service Group ID	Enables WCCPv2 support on all groups added to the Service Group list. Specify a number from 0 to 255 to identify the service group on the router. A value of 0 specifies the standard HTTP service group. Riverbed recommends that you use WCCP service groups 61 and 62. Note: The service group ID is local to the site where WCCP is used. Note: The service group number is not sent across the WAN.
Protocol	Select one of the following traffic protocols: • TCP • UDP • ICMP The default traffic protocol is TCP.
Protocol	Select a traffic protocol from the drop-down list: TCP, UDP, or ICMP. The default value is TCP.
Password/Password Confirm	Optionally, assign a password to the SteelHead Interceptor interface. This password must be the same password that is on the router. WCCP requires that all routers in a service group have the same password. Passwords are limited to eight characters.
Priority	Specify the WCCP priority for traffic redirection. If a connection matches multiple service groups on a router, the router chooses the service group with the highest priority. The range is 0 to 255. The default value is 200. The priority value must be consistent across all SteelHead Interceptors within a particular service group.
Weight	Specify the percentage of connections that are redirected to a particular SteelHead Interceptor interface, which is useful for traffic load balancing and failover support. The number of TCP, UDP, or ICMP connections a SteelHead Interceptor supports determines its weight. The more connections that a SteelHead Interceptor model supports, the heavier the weight of that model. You can modify the weight for each in-path interface to manually tune the proportion of traffic a SteelHead Interceptor interface receives. A higher weight redirects more traffic to that SteelHead Interceptor interface. The ratio of traffic redirected to a SteelHead Interceptor interface is equal to its weight divided by the sum of the weights of all the SteelHead Interceptor interfaces in the same service group. For example, if there are two SteelHead Interceptors in a service group and one has a weight of 100 and the other has a weight of 200, the one with the weight 100 receives one-third of the traffic and the other receives two-thirds of the traffic. However, because it is generally undesirable for an Interceptor with two WCCP in-path interfaces to receive twice the proportion of traffic, for SteelHead Interceptors with multiple in-paths connected, each of the in-path weights is divided by the number of that Interceptor's interfaces participating in the service group. For example, if there are two SteelHead Interceptors in a service group, and one has a single interface with weight 100 and the other has two interfaces, each with weight 200, the total weight will still equal 300 (100 + 200/2 + 200/2). The one with the weight 100 receives one-third of the traffic and each of the other's in-path interfaces receives one-third of the traffic. The range is 0 to 65535. The default value is 1700. For details about WCCP in a failover configuration, see Failover Support in WCCP.
Encapsulation Scheme	Specifies the method for transmitting packets between a router or a switch and a SteelHead Interceptor interface. Select one of the following encapsulation schemes from the drop-down list: • Either - Use Layer 2 first; if Layer 2 is not supported, GRE is used. This is the default value. • GRE - Generic Routing Encapsulation. The GRE encapsulation method appends a GRE header to a packet before it is forwarded. This can cause fragmentation and imposes a capacity reduction on the router and switch, especially during the GRE packet de-encapsulation process. This capacity reduction can be too great for production deployments. • L2 - Layer-2 redirection. The Layer-2 method is generally preferred from a performance standpoint, because it requires fewer resources from the router or switch than the GRE does. The Layer-2 method modifies only the destination Ethernet address. However, not all combinations of Cisco hardware and IOS revisions support the Layer-2 method. Also, the Layer-2 method requires the absence of Layer-3 hops between the router or switch and the SteelHead Interceptor.
Assignment Scheme	Determines which Interceptor interface in a WCCP service group the router or switch selects to redirect traffic to for each connection. The assignment scheme also determines whether the Interceptor interface or the router processes the first traffic packet. The optimal assignment scheme achieves both load balancing and failover support. Select one of the following schemes from the drop-down list: • Either - Uses Hash assignment unless the router does not support it. When the router does not support Hash, it uses Mask. This is the default setting. • Mask - Redirects traffic operations to the SteelHead Interceptors, significantly reducing the load on the redirecting router. Mask assignment processes the first packet in the router hardware, using less CPU cycles and resulting in better performance. Mask assignment supports load balancing across multiple active SteelHead Interceptors. This scheme bases load balancing decisions (for example, which SteelHead Interceptor in a service group optimizes a given new connection) on bits pulled out, or masked, from the IP address and the TCP port packet header fields. It also supports load balancing across multiple active SteelHead Interceptor interfaces in the same service group. The default mask scheme uses an IP address mask of 0x1741, which is applicable in most situations. However, you can change the IP mask by clicking the service group ID and changing the service group settings and flags. • Hash - Redirects traffic based on a hashing scheme and the Weight value of the Interceptor interface, providing load balancing and failover support. This scheme uses the CPU to process the first packet of each connection, resulting in slightly lower performance. However, this method generally achieves better load distribution. Riverbed recommends Hash assignment for most SteelHead Interceptors if the router supports it. The Cisco switches that do not support Hash assignment are the 3750, 4000, and 4500-series, among others. Your hashing scheme can be a combination of the source IP address, destination IP address, source port, or destination port. For details and best practices for using assignment schemes, see the Riverbed Deployment Guide.
Source Mask	Specify the following: • IP Mask - Specify the service group source IP mask. The default value is 0x1741. • Port Mask - Specify the service group source port mask.
Destination Mask	Specify the following: • IP Mask - Specify the service group destination IP mask. • Port Mask - Specify the service group destination port mask.
Source Hash	Specify the following: • Source IP Hash - Specify that the router hash the source IP address to determine traffic to redirect. • Source Port Hash - Specify that the router hash the source port to determine traffic to redirect.
Destination Hash	Specify the following: • Destination IP Hash - Specify that the router hash the destination IP address to determine traffic to redirect. • Destination Port Hash - Specify that the router hash the destination port to determine traffic to redirect.
Ports Mode	Select one of the following modes from the drop-down list: • Ports Disabled - Select to disable the ports. • Use Source Ports - The router determines traffic to redirect based on source ports. • Use Destination Ports - The router determines traffic to redirect based on destination ports.
Ports	Specify a comma-separated list of up to seven ports that the router will redirect. Use this option only after selecting either the Use Source Ports or the Use Destination Ports mode.
Router IP Address(es)	Specify a multicast group IP address or a unicast router IP address. You can specify up to 32 routers.
Add	Adds the service group.
Remove Selected Groups	Select the check box next to the name and click Remove Selected Groups.

Figure: Port Labels Page

Control	Description
Add a New Port Label	Displays the controls to add a new port label.
Name	Specify the label name. The following rules apply: • Port labels are not case sensitive and can be any string consisting of letters, the underscore ( _ ), or the hyphen ( - ). Spaces are not allowed in port labels. • The fields in the various rule pages of the Management Console that take a physical port number also take a port label. • To avoid confusion, do not use a number for a port label. • Port labels that are used in in-path and other rules, such as QoS and peering rules, cannot be deleted. • Port label changes (that is, adding and removing ports inside a label) are applied immediately by the rules that use the changed port labels.
Ports	Specify a comma-separated list of ports.
Remove Selected	Select the check box next to the name and click Remove Selected.
Add	Adds the port label.

Figure: Port Labels Page

Figure: Xbridge Page