Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Handbook

    Home FortiADC 6.1.4 Handbook
    6.1.4
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.1.4
    7.1.3
    7.1.2
    7.1.1
    7.1.0
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.6
    6.1.5
    6.1.4
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.1
    6.0.0
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.3.6
    5.3.5
    5.3.4
    5.3.3
    5.3.2
    5.3.1
    5.3.0
    5.2.7

    Configuring WCCP

    Configuring WCCP

    Web Cache Communication Protocol (WCCP) is a Cisco-developed content-routing protocol that provides a mechanism to redirect traffic flows in real-time. The FortiADC supports Version 2 (WCCPv2).

    With WCCP, the FortiADC can forward client traffic to WCCP compatible devices, where additional actions will be performed (that are not native to the FortiADC), and then, after undergoing these processes, the traffic will be sent back to the FortiADC.

    To configure a WCCP object:

    1. Go to System > WCCP.
    2. Click Create New to display the configuration editor.
    3. Complete the configuration according to the table below.
    4. Click save.
    5. Go to Networking > Interface. Select an interface and open the dialogue.
    6. Under Mode Specifics, find the WCCP button, and click On. (Default is off).
    7. Click save.
    8. Go to Server Load Balance > Virtual Server.
    9. Select a virtual server. Go to Monitoring.
    10. Enable the WCCP button, click on.
    Only Layer 7 Virtual Servers are supported.

    WCCP configuration
    Settings Description

    Service ID

    Name of the service group. Range 0-255.

    Authentication
    • Disable—No password is required. Default.
    • Enable—Opens up a text box. Specify the password.

    Forward Method
    • GRE—Encapsulates the intercepted packet in an IP GRE header with a source IP address of the WCCP server and a destination IP address of the target WCCP client. This allows the WCCP server to be multiple Layer 3 hops away from the WCCP client.
    • L2—Rewrites the destination MAC address of the intercepted packet to equal the MAC address of the target WCCP client. L2 forwarding requires that the WCCP server is Layer 2 adjacent to the WCCP client.
    • any—Cache server determines the method.

    Return Method
      Defines how a cache server declines a redirected packet, and returns it to the FortiADC (see forward-method above for option descriptions).

    Assignment Method

    Defines which assignment method the FortiADC prefers:

    • HASH—A hash key based on any combination of the source and destination IP and port of the packet.
    • MASK—A mask value specified with a maximum of 7 bits and, like the hash key, can be configured to cover both the source and destination address space.
    • any—Cache server determines the method.

    Group Address

    .

    IP multicast address used by the cache routers. The default, 0.0.0.0, means the FortiADC will ignore multicast WCCP traffic. Otherwise, set the address between 244.0.0.0 to 239.255.255.255.

    Router ID

    IP address known to all cache engines, and identifies an interface on the FortiADC to the cache engines. If all cache engines connect to the same FortiADC interface, use the default address of 0.0.0.0. However, if the cache engines can connect to different FortiADC interfaces, you must set router-id to a specific IP address, which must then be added to the configuration of the cache engines that connect to that interface.

    Server List

    IP address and netmask for up to four cache servers.
    Previous
    Next

    Configuring WCCP

    Configuring WCCP

    Web Cache Communication Protocol (WCCP) is a Cisco-developed content-routing protocol that provides a mechanism to redirect traffic flows in real-time. The FortiADC supports Version 2 (WCCPv2).

    With WCCP, the FortiADC can forward client traffic to WCCP compatible devices, where additional actions will be performed (that are not native to the FortiADC), and then, after undergoing these processes, the traffic will be sent back to the FortiADC.

    To configure a WCCP object:

    1. Go to System > WCCP.
    2. Click Create New to display the configuration editor.
    3. Complete the configuration according to the table below.
    4. Click save.
    5. Go to Networking > Interface. Select an interface and open the dialogue.
    6. Under Mode Specifics, find the WCCP button, and click On. (Default is off).
    7. Click save.
    8. Go to Server Load Balance > Virtual Server.
    9. Select a virtual server. Go to Monitoring.
    10. Enable the WCCP button, click on.
    Only Layer 7 Virtual Servers are supported.

    WCCP configuration
    Settings Description

    Service ID

    Name of the service group. Range 0-255.

    Authentication
    • Disable—No password is required. Default.
    • Enable—Opens up a text box. Specify the password.

    Forward Method
    • GRE—Encapsulates the intercepted packet in an IP GRE header with a source IP address of the WCCP server and a destination IP address of the target WCCP client. This allows the WCCP server to be multiple Layer 3 hops away from the WCCP client.
    • L2—Rewrites the destination MAC address of the intercepted packet to equal the MAC address of the target WCCP client. L2 forwarding requires that the WCCP server is Layer 2 adjacent to the WCCP client.
    • any—Cache server determines the method.

    Return Method
      Defines how a cache server declines a redirected packet, and returns it to the FortiADC (see forward-method above for option descriptions).

    Assignment Method

    Defines which assignment method the FortiADC prefers:

    • HASH—A hash key based on any combination of the source and destination IP and port of the packet.
    • MASK—A mask value specified with a maximum of 7 bits and, like the hash key, can be configured to cover both the source and destination address space.
    • any—Cache server determines the method.

    Group Address

    .

    IP multicast address used by the cache routers. The default, 0.0.0.0, means the FortiADC will ignore multicast WCCP traffic. Otherwise, set the address between 244.0.0.0 to 239.255.255.255.

    Router ID

    IP address known to all cache engines, and identifies an interface on the FortiADC to the cache engines. If all cache engines connect to the same FortiADC interface, use the default address of 0.0.0.0. However, if the cache engines can connect to different FortiADC interfaces, you must set router-id to a specific IP address, which must then be added to the configuration of the cache engines that connect to that interface.

    Server List

    IP address and netmask for up to four cache servers.
    Previous
    Next