Cisco ACNS Software Caching Configuration Guide, Release 4.2 - Chapter 7: Reverse Proxy Caching [Cisco Application and Content Networking System (ACNS) Software]

Table Of Contents

Reverse Proxy Caching

Reverse Proxy Caching Overview

Configuring Reverse Proxy Service Based on WCCP

Configuring the Content Engine for Reverse Proxy Service

Configuring the Router for Reverse Proxy Service with Output Redirection

Configuring the Router for Reverse Proxy Service with Input Redirection

Configuration Examples—Reverse Proxy with Output Redirection

Configuring Reverse Proxy Service Based on a Layer 4 Switch

Configuring the Content Engine for Reverse Proxy Service

Configuring the CSS Switch for Reverse Proxy Caching

CSS Switch Example Configuration Output for Reverse Proxy Caching

Reverse Proxy Caching

This chapter explains reverse proxy caching and shows configuration examples relevant to the Content Engine. This chapter contains the following sections:

•Reverse Proxy Caching Overview

•Configuring Reverse Proxy Service Based on WCCP

•Configuring Reverse Proxy Service Based on a Layer 4 Switch

Reverse Proxy Caching Overview

In a regular proxy cache configuration, the proxy server acts as a proxy for the client. In the reverse proxy configuration, the reverse proxy server acts as a proxy for the server. Also, a reverse proxy cache stores specific content, whereas proxy and transparent caches store frequently requested content. Reverse proxy caches serve two primary functions:

•Replication of content to geographically dispersed areas

•Replication of content for load balancing

In a reverse proxy cache configuration, the proxy server is configured with an Internet-routable IP address. Clients are directed to the proxy server based on DNS resolution of a domain name. To a client, the reverse proxy server appears like a web server.

To ensure fast response times, maximized service availability, and the ability to withstand an excessive number of URL hits or an excess of bandwidth requested, Cisco Content Engines with Cache software can be deployed in front of a website server farm to offload traffic from busy firewalls and servers, helping to optimize the entire website infrastructure. This type of deployment is called web server acceleration, or reverse proxying. A Content Engine deployed in this manner is simply called a reverse proxy cache because the Content Engine is operating at the opposite end of the transaction, in front of the origin server.

ACNS 4.2 software allows reverse proxy caching by allowing traffic redirection or interception to be performed by two types of devices: a WCCP-enabled router, and a Layer 4 switch such as the Content Services Switch 11000.

Configuring Reverse Proxy Service Based on WCCP

In the deployment scenario shown in Figure 7-1, the Content Engine interoperates with a router running WCCP Version 2 to bring reverse proxy service within the web server environment. In this deployment, the router interface connected to the Internet has an IP address of 192.168.1.1. All HTTP requests destined for the web server are routed to the router interface of 172.16.21.1. Upon receiving the HTTP request at this interface, the router transparently intercepts and redirects the request to the Content Engine with an IP address of 172.16.20.23. Thus, the Content Engine is logically in front of the web server offloading web server HTTP traffic. The Content Engine sends a request to the web server only when it does not find the requested content in the cache.

To configure reverse proxy caching using traffic redirection through a WWCP-enabled router see the following sections:

•Configuring the Content Engine for Reverse Proxy Service

•Configuring the Router for Reverse Proxy Service with Output Redirection

•Configuring the Router for Reverse Proxy Service with Input Redirection

Note A redirect list on the router or a static bypass list on the Content Engine can be used to allow flows to bypass interception. These lists use criteria based on source and destination IP addresses.

Figure 7-1 Reverse Proxy Service with WCCP-Enabled Router

Configuring the Content Engine for Reverse Proxy Service

To configure reverse proxy on the Content Engine, perform the following steps starting from global configuration mode:
Command

Purpose
Step 1
contentengine(config)# wccp version 2
Ensures that the Content Engine is running WCCP Version 2.
Step 2
contentengine(config)# wccp router-list 1 
172.16.20.1
Configures a router list.
Step 3
contentengine(config)# wccp reverse-proxy 
router-list-num 1
Instructs the router to run the reverse proxy service.
Configuring the Router for Reverse Proxy Service with Output Redirection

To configure reverse proxy service on the router with output redirection facing the original servers, perform the following steps starting in global configuration mode:
Command

Purpose
Step 1
router(config)# ip wccp 99
Instructs the router to run the reverse proxy service. The reverse proxy service is indicated by a value of 99.
Step 2
router(config)# interface Ethernet 0/1
Specifies which router interface to configure. In this scenario, Ethernet 0/1 is the router interface to the web server.
Step 3
router(config-if)# ip wccp 99 redirect out
Instructs the router to redirect TCP port 80 traffic bound for the specified interface to Content Engines that accept reverse proxy service. In this scenario there is only one router.
Step 4
router(config)# exit
Exits global configuration mode.
Configuring the Router for Reverse Proxy Service with Input Redirection
Command

Purpose
Step 1
router(config)# ip wccp 99
Instructs the router to run the reverse proxy service. The reverse proxy service is indicated by a value of 99.
Step 2
router(config)# interface s0/0
Specifies which router interface to configure. In this scenario, s0/0 is the router interface to the Internet.
Step 3
router(config-if)# ip wccp 99 redirect in
Instructs the router to redirect TCP port 80 traffic received on the specified interface to Content Engines that accept reverse proxy service.
Step 4
router(config-if)# exit
Exits interface configuration mode.
Note Input redirection is supported in Cisco IOS Release 12.1(3)T or 12.0(11)S and later versions of the same, or in Cisco IOS Release 12.2.

Configuration Examples—Reverse Proxy with Output Redirection

This section shows configurations of the Content Engine and the router for the deployment scenario in Figure 7-1. The reverse proxy related commands are in bold:

Content Engine
 !
 hostname ContentEngine
 !
 interface ethernet 0
  ip address 172.16.20.23 255.255.255.224
  ip broadcast-address 10.0.0.255
 exit
 !
 interface ethernet 1
 exit
 !
 ip default-gateway 172.16.20.1
 ip name-server 172.16.20.238
 ip domain-name cisco.com
 ip route 0.0.0.0 0.0.0.0 172.16.20.1
 !
 wccp router-list 1 172.16.20.1
 wccp 99 reverse-proxy router-list-num 1
 wccp version 2
 !
 end 
WCCP-Enabled Router
Current configuration:
 !
 version 12.1
 service timestamps debug uptime
 service timestamps log uptime
 no service password-encryption
 !
 hostname 2611-5
 !
 enable secret 5 $1$9VQ.$BTPbq8xlE2dsKwKPDDmpL/
 !
 !
 ip subnet-zero
 ip wccp 99
 !
 !
 interface Ethernet0/0
  no ip address 
  no ip redirects
  !
 interface Serial0/0
  ip address 192.168.1.1 255.255.255.224
  !
 interface Ethernet0/1
  ip address 172.16.21.1 255.255.255.224
  ip wccp 99 redirect out
!
 interface Ethernet1/0
  ip address 172.16.20.1 255.255.255.224
  !
 interface Ethernet1/1
  no ip address
  shutdown
  full-duplex
 !
 interface Ethernet1/2
  no ip address
  shutdown
 !
. . .
 ip classless
 !
 !
 line con 0
  transport input none
 line aux 0
 line vty 0 4
  login
 !
end
Configuring Reverse Proxy Service Based on a Layer 4 Switch

In the deployment scenario shown in Figure 7-2, the Content Engines interoperate with a router running WCCP Version 2 and a Content Services 11000 Series Switch (hereafter referred to as the CSS switch) to bring reverse proxy service within the web server environment. In this deployment, the user sends the request to the CSS switch virtual IP address. All HTTP requests destined for the web server are routed to the CSS switch interface. Upon receiving the request at this interface, the CSS switch transparently intercepts and redirects the request to the Content Engine. Thus, the Content Engine is logically in front of the web server offloading web server HTTP traffic. The Content Engine sends a request to the web server only when it does not find the requested content in the cache.

Note The sample solution shown here works only with particular web servers and in particular configurations. See Figure 7-2 for a network diagram that illustrates the topology used when you configure these devices.

Figure 7-2 Reverse Proxy Caching Network Diagram

Configuring the Content Engine for Reverse Proxy Service

To configure reverse proxy on the Content Engine, perform the following steps starting from global configuration mode:
Command

Purpose
Step 5
contentengine(config)# no bypass load enable
Ensures that the Content Engine serves requests if possible.
Step 6
contentengine(config)# http l4-switch enable
Ensures that the Content Engine accepts traffic redirection using the Layer 4 switch.
Configuring the CSS Switch for Reverse Proxy Caching

Use the following task CLI commands to help you configure services or Content Engines for the CSS switch in reverse proxy mode. Your CSS switch must be in configuration mode in order to initiate configuration changes.

Note Use the same task flow to configure web servers as services and map all necessary IP addresses used in the reverse proxy configuration. The use of this task flow depends on your network configuration. See the "CSS Switch Example Configuration Output for Reverse Proxy Caching" section for a list of all configurable services and parameters needed. Refer to the Cisco Content Services Advanced Configuration Guide for more information regarding caching with the CSS switch.
Command

Purpose
Step 1
CS150(config)# owner cisco
Instructs the CSS switch to create an owner.
Step 2
CS150(config-owner[cisco])# content RPCRule
Create content <RPCRule>, [y/n]:y
Creates a reverse proxy rule for the current owner.
Step 3
CS150(config-owner-content[RPCRule])# add service ce1
Adds services to the reverse proxy rule. In this case Content Engine 1 is added as a service to the reverse proxy rule.
Step 4
CS150(config-owner-content[RPCRule])# add service ce2
Adds services to the reverse proxy rule. In this case Content Engine 2 is added as a service to the reverse proxy rule.
Step 5
CS150(config-owner-content[cisco-RPCRule])# vip 
address 172.16.0.0
Assigns a virtual IP address to the CSS switch.
Step 6
CS150(config-owner-content[cisco-RPCRule])# protocol 
tcp
Specifies TCP as the service protocol.
Step 7
CS150(config-owner-content[cisco-RPCRule])# port 80
Specifies that requests for traffic should come through on port 80.
Step 8
CS150(config-owner-content[cisco-RPCRule])# url "/*" 
eql Cacheable
Defines what content is cacheable.
Step 9
CS150(config-owner-content[cisco-RPCRule])# exit
Exits CSS switch configuration mode.
CSS Switch Example Configuration Output for Reverse Proxy Caching

The following example shows a partial configuration of the CSS switch.
!************************** SERVICE **************************
service webserver1 
  ip address <first_webserver_ip_address>
  protocol tcp 
  port 80 
  active 
service webserver2 
  ip address <second_webserver_ip_address> 
  protocol tcp 
  port 80 
  active 
service cache1 
  protocol tcp 
  ip address <first_cache_ip_address> 
  port 80 
  type transparent-cache 
  no cache-bypass 
  active 
service cache2 
  protocol tcp 
  ip address <second_cache_ip_address>
  port 80 
  type transparent-cache 
  no cache-bypass 
  active 
!**************************** EQL ****************************
eql cacheable 
  description "This EQL contains extensions of cacheable content" 
  extension pdf "Acrobat" 
  extension fdf "Acrobat Forms Document" 
  extension au "Sound audio/basic" 
  extension bmp "Bitmap Image" 
  extension z "Compressed data application/x-compress" 
  extension gif "GIF Image image/gif" 
  extension html "Hypertext Markup Language text/html" 
  extension htm 
  extension js "Java script application/x-javascript" 
  extension mocha 
  extension jpeg "JPEG image image/jpeg" 
  extension jpg 
  extension jpe 
  extension jfif 
  extension pjpeg 
  extension pjp 
  extension mp2 "MPEG Audio audio/x-mpeg" 
  extension mpa 
  extension abs 
  extension mpeg "MPEG Video video/mpeg" 
  extension mpg 
  extension mpe 
  extension mpv 
  extension vbs 
  extension m1v 
  extension pcx "PCX Image" 
  extension txt "Plain text text/plain" 
  extension text 
  extension mov "QuickTime video/quicktime" 
  extension tiff "TIFF Image image/tiff" 
  extension tar "Unix Tape Archive application/x-tar" 
  extension avi "Video for Windows video/x-msvideo" 
  extension wav "Wave File audio/x-wav" 
  extension gz "application/x-gzip" 
  extension zip "ZIP file application/x-zip-compressed" 
!*************************** OWNER ***************************
owner www.site.com 
  content reverse_proxy_rule 		! this rule is used to map in caches for static
    vip address <published_vip>	! content.  Since this rule is more specific
    protocol tcp 				! than "web_server_rule" (url match uses an
    port 80 				! eql), this rule will be evaluated first.  Only
    url "/*" eql cacheable 		! 'cacheable' traffic will be matched and sent 
    add service cache1 			! to the Caches.
    add service cache2 
    active 
  content web_server_rule 		! this rule is used to map in the web-servers
    vip address <published_vip>	! for non-cacheable content.
    protocol tcp 
    port 80 
    url "/*" 
    add service webserver1 
    add service webserver2 
    active 
content cache_request_rule 		! this rule is used for caches requesting
    vip address <cache_miss_vip> 	! content from the web-servers.  This rule 
    protocol tcp 				! should include the web servers only
    port 80 
    add service webserver1 
    add service webserver2 
    active