Benefits and limitations of the WCCP modes

Key benefits

• Minimal Network Disruption

  • Clients and servers retain their original IP addresses. No need to reconfigure DNS or routing tables.

  • Operates out-of-path (one-arm topology), avoiding inline deployment complexities.

• Scalability & High Availability

  • WCCP by nature supports multiple WCCP clients in a WCCP group, which enables distributing traffic across multiple FortiWeb appliances for horizontal scaling.

  • WCCP automatically reroutes traffic if a FortiWeb node fails.

• Fail-to-Wire: Traffic bypasses FortiWeb during power failures (ensures uptime). See Fail-to-wire for power loss/reboots

Limitations

• No SSL/TLS offloading
  • What is SSL/TLS offloading

    SSL/TLS offloading means that FortiWeb functions as an SSL proxy. It terminates the HTTPS connection from the client and presents a server certificate to prove authority for your application domain.

    After inspecting the decrypted traffic, FortiWeb initiates a new connection to the back-end server, which can be either encrypted (HTTPS) or unencrypted (HTTP), depending on the configured settings between FortiWeb and the server. This back-end connection setup is entirely independent of the front-end connection.

  • Is SSL/TLS offloading supported in WCCP mode?

    In WCCP mode, FortiWeb does not perform SSL/TLS offloading. Instead:

    • The web server terminates the SSL/TLS connection using its own certificate.

    • FortiWeb does not present any certificate to the client, as it does not act as the endpoint of the SSL/TLS connection.

    • You do not need to upload your CA-signed certificate to FortiWeb, as is required in Reverse Proxy mode. Instead, the CA-signed certificate remains solely on your web server.

    • FortiWeb uses its own internal or default certificate only for decrypting SSL traffic to screen out attacks, not for authentication with the client.

• Limited Protocol Support

  • HTTP/HTTPS Only: Non-web traffic (e.g., SSH, FTP) bypasses FortiWeb.

  • No UDP/WebSocket: WCCPv2 focuses on TCP-based HTTP/HTTPS.