Caching HTTP sessions on port 80 and HTTPS sessions on port 443

This example configuration is the same as that described in Caching HTTP sessions on port 80 and HTTPS sessions on port 443 except that WCCP now also cached HTTPS traffic on port 443. To cache HTTP and HTTPS traffic the WCCP service group must have a service ID in the range 51 to 255 and you must specify port 80 and 443 and protocol 6 in the service group configuration of the WCCP client.

Also the security policy on the WCCP_srv that accepts sessions from the internal network to be cached must accept HTTP and HTTPS sessions.

FortiGate WCCP server and client configuration

Configuring the WCCP server (WCCP_srv)

Use the following steps to configure WCCP_srv as the WCCP server for the example network. The example steps only describe the WCCP-related configuration.

To configure WCCP_srv as a WCCP server

1. Add a port2 to port1 security policy that accepts HTTP traffic on port 80 and HTTPS traffic on port 443 and is configured for WCCP:

   config firewall policy

   edit 0

   set srtintf port2

   set dstintf port1

   set srcaddr all

   set dstaddr all

   set action accept

   set schedule always

   set service HTTP HTTPS

   set wccp enable

   set nat enable

   end

2. Add another port2 to port1 security policy to allow all other traffic to connect to the Internet.

   config firewall policy

   edit 0

   set srtintf port2

   set dstintf port1

   set srcaddr all

   set dstaddr all

   set action accept

   set schedule always

   set service ALL

   set nat enable

   end

3. Move this policy below the WCCP policy in the port2 to port1 policy list.

4. Enable WCCP on the port5 interface.

   config system interface

   edit port5

   set wccp enable

   end

5. Add a WCCP service group with service ID 90 (can be any number between 51 and 255).

   config system wccp

   edit 90

   set router-id 10.51.101.100

   set server-list 10.51.101.0 255.255.255.0

   end

6. Add a firewall address and security policy to allow the WCCP_client to connect to the internet.

   config firewall address

   edit WCCP_client_addr

   set subnet 10.51.101.10

   end

   config firewall policy

   edit 0

   set srtintf port5

   set dstintf port1

   set srcaddr WCCP_client_addr

   set dstaddr all

   set action accept

   set schedule always

   set service ALL

   set nat enable

   end

Configuring the WCCP client (WCCP_client)

Use the following steps to configure WCCP_client as the WCCP client for the example network. The example steps only describe the WCCP-related configuration.

To configure WCCP_client as a WCCP client

1. Configure WCCP_client to operate as a WCCP client.

   config system settings

   set wccp-cache-engine enable

   end

   You cannot enter the wccp-cache-engine enable command if you have already added a WCCP service group. When you enter this command an interface named w.<vdom_name> is added to the FortiGate configuration (for example w.root). All traffic redirected from a WCCP router is considered to be received at this interface of the FortiGate unit operating as a WCCP client. A default route to this interface with lowest priority is added.

2. Enable WCCP on the port1 interface.

   config system interface

   edit port1

   set wccp enable

   end

3. Add a WCCP service group with service ID 90. This service group also specifies to cache sessions on ports 80 and 443 (for HTTP and HTTPS) and protocol number 6.

   config system wccp

   edit 90

   set cache-id 10.51.101.10

   set router-list 10.51.101.100

   set ports 80 443

   set protocol 6

   end