Using WCCP on a corporate network

[mlambe]

I am wanting to know if it is possible to use WCCP within my corporate network. I have some Bluecoat Port 80 devices on each site, and one in a DMZ. I also have a 6509s with MSFCs on each site. Would it be easier to use WCCP or just the advanced forwarding options offered within the Bluecoat configuration. Anyone with experience of this? Any replies much appreciated in advance.

[Gilles Dufour]

If I undertand correctly the documentation of the blue coat device, the advanced forwarding option is a way to redirect traffic between blue-coat devices.

So, you still need to redirect the traffic from a router to the initial blue-coat box and WCCP is the only way to do it transparently with a router.

Regards,

Gilles.

[mlambe]

Thanks for this Gilles. Can you clarify this for me please. I have an Internet connection, a firewall, then a Bluecoat port 80 in the DMZ, then a separate Bluecoat in each building doing advanced forwarding to the DMZ Bluecoat. I have several MSFC 6509 and various other routers in between. Can I use WCCP in this scenario? If so can you suggest the best way to implement it. I don't want you to do all the work :) but I would very much appreciate a kick start in the right direction. Best Regards.

[Gilles Dufour]

for the bluecoat devices in each building, how do you intercept the traffic ?

Are you using them as proxy ?

With what you described, I would suggest to use wccp on the router in each building. Each router will intercept the web traffic and redirect it to its local BlueCoat.

The local BlueCoat can then contact the central Bluecoat device using the advanced forwarding option just like you're doing now.

You can upload a topology diagram and more information in ftp://ftp-sj.cisco.com/incoming. Then, post a message with the filename and I'll be able to retrieve it.

From there I can better assist you with the wccp implementation.

Regards,

Gilles.

[mlambe]

Gilles. I have uploaded the file as Bluecoat_Network_mlambe.vsd.

Not sure if you need to know these bits, but the external Bluecoat will proxy Internet DNS resolution, while internal DNS servers will do the company servers. I am looking at using W2K AD to allow site specific PAC files to be sent to each user, so they use the local bluecoat machine for proxying. Anything else that I have missed?

Many thanks for spending time with me on this. It is very much appreciated.

[mlambe]

Forgot to answer another of your questions. Yes I am using each site specific bluecoat box as the site proxy. Then advanced forwarding (ICP) is pointing the traffic towards the correct site (for internal web servers), or towards the DMZ internal bluecoat for Internet resolution. regards, mark

[Gilles Dufour · Accepted solution]

ok - I could not read the vsd file - it appears to be corrupted.

Anyway, I think I know what your network looks like more or less and what I suggested previously is still valid.

So, if you have a router to connect each building to the central site, I would use wccp on each of them to intercept the traffic transparently and forward to the bluecoat cache.

The cache will continue to work with the central cache as it is doing it currently.

If you don't have 1 router for 1 cache, but 1 router for many cache, you can still use wccp. The router will spread the traffic over the different cache it can see.

Gilles.