Key considerations of network settings in WCCP mode
1. WCCP settings
-
On the firewall/route/switch, configure it as a WCCP server.
-
Service Group ID: Use web-cache (standard for HTTP/HTTPS).
-
Redirect ACL: Specify which traffic to redirect (e.g., HTTP/HTTPS on ports 80/443).
-
WCCP Client IP: Add FortiWeb’s IP address as a WCCP client.
-
-
On FortiWeb, configure it as a WCCP client through System > Config > WCCP Client.
-
Service Group: web-cache (must match the firewall’s service group).
-
WCCP Server IP: Enter the firewall’s IP address.
-
Redirect Method:
-
GRE Tunneling: For Layer 3 redirection (most common).
-
Layer 2 Redirection: For MAC address rewriting (requires same subnet).
-
-
Priority: Set priority for FortiWeb in a multi-node WCCP group (lower = higher priority).
-
-
On FortiWeb, assign an IP address for the Interface connecting with the back-end servers.
2. Client IPs
In WCCP mode, after FortiWeb inspects the traffic, it forwards the traffic to the back-end server, with the source IP replaced by its WCCP interface IP (e.g., Port3's IP 192.0.2.1). As a result:
-
The web server does not see the real IP address of the client.
-
Instead, it sees FortiWeb’s WCCP interface IP address as the source of incoming requests.
Since some web applications need the real client IP (e.g., for rate limiting, logging, or geographical analysis), FortiWeb allows you to insert or append the client’s original IP into an HTTP header, such as:
-
X-Forwarded-For (XFF)
This resolves the issue, as most modern web servers (e.g., Apache, Nginx, IIS) can be configured to trust the X-Forwarded-For header and use it instead of the direct source IP. For details on configuring these headers, see Indicating the original client’s IP to back-end web servers.