About connection forwarding features

Settings for connection forwarding for a network with multiple paths from the server are under Networking > Network Integration: Connection Forwarding.

The AWS Cloud Accelerator doesn’t support connection forwarding; however, the Cloud Accelerator supports it.

You enable connection forwarding only in asymmetric networks; that is, networks in which a client request traverses a different network path than the server response. The default port for connection forwarding is 7850.

For virtual in-path deployments with multiple SteelHeads, including WCCP clusters and connection forwarding, you must always allow in-path neighbor failure. Allowing in-path neighbor failure is necessary because certain events, such as network failures, and router or SteelHead cluster changes, can cause routers to change the destination SteelHead for TCP connection packets. When this happens, SteelHeads must be able to redirect traffic to each other to ensure that optimization continues.

To optimize connections in asymmetric networks, packets traveling in both directions must pass through the same client-side and server-side SteelHead. If you have one path from the client to the server and a different path from the server to the client, you must enable in-path connection forwarding and configure the SteelHeads to communicate with each other. These SteelHeads are called neighbors and exchange connection information to redirect packets to each other.

When you define a neighbor, specify the SteelHead in-path IP address, not the primary IP address.

In RiOS 9.6 and later, you can use IPv6 addresses when you configure SteelHead neighbors. Specify either all-IPv4 addresses or all-IPv6 addresses; mixed IPv4 and IPv6 addresses aren’t allowed.

You can use connection forwarding in mixed IPv4 and IPv6 networks. The protocol and neighbors you specify for connection forwarding (either IPv4 or IPv6) determine the control channel to use, but IPv4 and IPv6 traffic to those neighbors is sent unchanged.

When RiOS determines an IPv6 incompatibility between connection-forwarding neighbors, it triggers an alarm indicating that a peer SteelHead is incompatible. For details, see About alarm settings and Viewing the Alarm Status report.

You must enable connection forwarding in a WCCP cluster. With connection forwarding enabled, the WCCP load-balancing algorithm considers the total number of in-path interfaces of all neighbors in the service group when balancing the load across the interfaces. If you don’t enable connection forwarding, the SteelHead with the lowest IP address assigns all traffic flows to itself. For details, see the SteelHead Deployment Guide.

While WCCP doesn’t support IPv6, you can use connection forwarding in a WCCP cluster with a mixed IPv4 and IPv6 network, as long as all SteelHeads in the cluster are running RiOS 8.5 or later.

You can place neighbors in the same physical site or in different sites, but the latency between them must be short because the packets traveling between them aren’t optimized.

If there are more than two possible paths, additional SteelHeads must be installed on each path and configured as neighbors. Neighbors are notified in parallel so that the delay introduced at the connection setup is equal to the time it takes to get an acknowledgment from the furthest neighbor.

Connection-forwarding neighbors must use the same WAN visibility mode. For details, see About in-path rule settings.