Config transparent Proxy with LDAP authen with L4 switch?

Unanswered Question
Jun 12th, 2007

How to config policy based routing on L4 switch if wsa run in transparent mode with LDAP authentication?

Async OS: 5.1.0-420

Thank you,

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
jowolfer Tue, 06/12/2007 - 14:43


As long as the packets are properly getting to the WSA, it just needs to be setup for transparent mode + LDAP authentication turned on.

For specifics on how to set up a specific L4 switch, you will most likely need to research instructions for the specific switch you are using, since they are all different.

If you tell me what switch you are using, I may be able to provide some guidance for where to look.

ezekiel_ironport Tue, 10/09/2007 - 12:18

Dear All,

Please correct me if I am wrong. In order to do L4TM, I must need either:

1) Network TAP connected to T1/T2.
2) L4 switch connected to P1.
3) WCCP v2 connected to P1.


jowolfer Tue, 10/09/2007 - 16:20


I wanted to add some clarification to your comments:

1) Network TAP connected to T1/T2.

This will work good. You will need to tap one direction of traffic to the T1 port and the other direction in to the T2 interface.

2) L4 switch connected to P1.

This will NOT work. Further explaination below. What you can do is use a switch that supports port spanning / port mirroring. You'll need to send a COPY of all traffic going to gateway to the T1 interface.

The L4TM will need to be in 'duplex' mode - Configurable in the GUI.

3) WCCP v2 connected to P1.

WCCP cannot be used at all with the L4TM, because WCCP doesn't 'copy' the traffic, it redirects it.

L4TM information

The L4TM can be thought of as a completely seperate appliance that operates primarily via the t1 / t2 interfaces.

The L4TM is a sniffer application, meaning that you cannot redirect traffic to it (such as L4 switching PBR or WCCP), but you can send a copy of traffic to it (port mirroring or physical tap).

If you are blocking with the L4TM, the WSA will use M1/P1 to send the TCP RST packets. This is the ONLY use for the M1/P1 interfaces that the L4TM will use.

The P1 interface is intended to be used for Web proxy traffic and the L4TM does not listen on this interface.


This Discussion