WCCPv2 with WAAS and Cat3750

Several points to note when you configure Cisco Catalyst 3750 to use WCCPv2 for network interception and redirection to WAE:

1. IOS Version 12.2(37)SE or newer
2. Ingress redirection only, egress redirection is not supported, redirect exclude commands not supported, redirect list is supported
3. Layer 2 redirect is REQUIRED. GRE redirection is not supported
4. Mask assignment must be configured. Hash assignment is not supported.

WAE(config)# wccp router-list 1 1.2.3.4
WAE(config)# wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign
WAE(config)# wccp version 2

WAAS GRE egress return

Starting from WAAS 4.0.13, it allows 2 different egress method. When IP forwarding egress method is used the return traffic packets are forwarded to the WAE default gateway.

WAE(config)# egress-method ip-forwarding intercept-method wccp

The limitation of IP forwarding is WAE should reside on a separate subnet to avoid infinite forwarding loop.

The other egress method is GRE return. The return traffic packets are returned back to the intercepting router using the GRE tunnel that is created as a result of WCCP negotiation. With GRE return egress, WAE can be deployed on the same subnet as users and subinterfaces or tertiary interfaces are not required.

WAE(config)# egress-method negotiated-return intercept-method wccp

To view egress method on WAE
WAE# sh egress-methods

PBR - set ip next-hop verify-availability

Normally set ip next-hop will forward packets when the route-map is matched regardless if the next hop is alive or not. Adding the verify-availability keyword, the router will check the next hop availability via CDP before forwarding the packets, and when next-hop is dead, the packets will be routed through the normal routing table.

set ip next-hop verify-availability
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtpbrtrk.html#wp1057830

DHCP Server on Linux

My environment: RH FC8, x86_64

Before get started, make sure you have the dhcp package installed:

dhcp-3.0.6-12.fc8

The main configuration file is in /etc/dhcpd.conf, here is mine:

ddns-update-style interim;
ignore client-updates;

subnet 192.168.2.0 netmask 255.255.255.0 {

option routers 192.168.2.254;
option subnet-mask 255.255.255.0;

option domain-name "pandaeatsbamboo.com";
option domain-name-servers 192.168.2.60;

next-server 192.168.2.50; #My CUCM address

range dynamic-bootp 192.168.2.101 192.168.2.200; #The dhcp pool range
default-lease-time 21600;
max-lease-time 43200;

host test-server {
hardware ethernet 12:34:56:78:AB:CD;
fixed-address 12.34.56.78; # Fixed allocation based on MAC address
}


}

Restart your DHCP daemon:
/etc/init.d/dhcpd restart

Check the leases by viewing the lease file at /var/lib/dhcpd/dhcpd.leases, here is the sample file:

lease 192.168.2.197 {
starts 2 2008/03/11 08:00:21;
ends 2 2008/03/11 14:00:21;
tstp 2 2008/03/11 14:00:21;
binding state free;
hardware ethernet 00:19:d2:d0:10:01;
uid "\001\000\031\322\320\020\001";
}
lease 192.168.2.196 {
starts 2 2008/03/11 12:34:28;
ends 2 2008/03/11 18:34:28;
binding state active;
next binding state free;
hardware ethernet 00:02:78:90:e6:c5;
uid "\001\000\002x\220\346\305";
}

Cisco ASR 1000 launch in Second Life

Cisco has launched its new router ASR 1000 in both real world and virtual world.

Teleport yourselves to the Bandwidth Stage in Second Life now:
http://slurl.com/secondlife/Cisco%20Systems%204/47/33/21/

Configuring PLAR on CUCM

In some cases, you might want to allow the phone automatically dial a pre-configured number when the user goes off-hook. PLAR is the way to go.

1. Create a partition.


2. Create a CSS and assign the partition you've just created to it.


3. Create a translation oattern and assign the CSS and partition you've created in step 1 and 2 to it. Under "Called Party Transformation Mask", enter the number that you want the phone to dial when it goes off-hook.

4. Finally, you need to select the CSS that you configured in Step 2 for the PLAR phone's CSS.

New Self-diagnostic command on WAAS 4.0.15

The new 4.0.15 release added support for a self-diagnostic command, which is a good place to start troubleshooting:

WAE-TEST# test self-diagnostic ?

all Run all self-diagnostic tests

basic Basic device configuration

connectivity Basic device connectivity

inline Inline groups and ports

interfaces Physical interfaces

system Device operation

tfo TFO/DRE configuration

wafs WAFS connectivity

wccp WCCP configuration and operation

WAE-TEST#

Capture Traffic on Cisco WAE

To capture packets on WAE for troubleshooting and analysis, you can use the build in tethereal to do this.

To capture all traffic and save to a file:
tethereal -w capture.cap

Ctrl-C to stop the packet capture, and the file is viewable with the "dir" command:

dir *.cap

You can copy the file to some other places for offline viewing then.

Cisco WAAS Cheatsheet

I've prepare a cheatsheet after playing WAAS for months, share with you guys here:

Router with separate interface for WAE connection
access-list 100 permit tcp any any
access-list 100 deny ip any any

ip wccp 61 redirect-list 100
ip wccp 62 redirect-list 100

ip cef

int fa0/0
desc "To LAN"
ip wccp 61 redirect in
duplex full
speed 100

int fa0/1
desc "To WAE"
duplex full
speed 100

int s0
desc "To WAN"
ip wccp 62 redirect in

Router with dot1q sub-interfaces for LAN and WAE
ip wccp 61
ip wccp 62

ip cef

int fa0/0
desc -- dot1q trunk to both client LAN and WAE lan --
duplex full
speed 100

int fa0/0.1
desc -- To LAN --
ip wccp 61 redirect in
ip wccp 62 redirect out

int fa0/0.2
desc -- To WAE appliance --
ip wccp redirect exclude in

int s0
desc -- To WAN - Nothing needs to be done here --

Router - Verify
- sh proc cpu
- sh ip wccp

WAE - Config
no cms enable
no central address
central address 155.161.40.245
cms enable
ntp server 155.161.85.129
ntp server 155.161.85.193
ip name-server 155.161.93.238
no wccp router-list 1 172.23.100.1 172.23.100.2
wccp router-list 1 x.x.x.x y.y.y.y

WAE - verify
sh cms info
sh wccp routers


Useful command
WAE
- sh wccp gre
- sh wccp routers
- sh wccp services
- clear cache dre
- sh stat dre
- sh stat dre con
- sh stat dre con server-p 80
- sh stat tfo
- sh stat bypass
- sh alarms
- sh cms info
- sh disks
- sh proc cpu
- sh tfo status
- sh tfo con sum
- sh tfo con server-p 80
- sh tfo auto-discovery
- sh wccp file-engine
- tcpdump
- tethereal
- cms deregister force
- sh clock detail
- sh ntp status
- sh disk failed-sectors
- sh disk tech-support
- sh proc system count 10 delay 5
- sh cifs auto-discovery status
- sh policy-engine application dynamic
- sh cifs auto-discovery host-db
- sh cifs auto-discovery last
- sh cifs sessions count
- sh cifs sessions list

Router
- sh ip wccp
- sh ip wccp 61 det
- sh ip wccp int

Setting up TFTP server in Linux

My environment: RedHat Linux, Fedora Core 8, x86_64

Pretty simple, make sure that you've got the following packages in place:

tftp-server-0.42-5
tftp-0.42-5
xinetd-2.3.14-14.fc8

Go to /etc/xinetd.d, you'll find a file called tftp there. Change the "disable" flag from "yes" to "no".

disable = no

Copy the files you need to the tftp root directory /tftpboot.

Restart the xinetd process:
/etc/init.d/xinetd restart

Done!!