dslreports logo
site
spacer

spacer
 
    All FAQs Site FAQ DSL FAQ Cable Tech About DSL Distance DSL Hurdles »»
spc

spacer




how-to block ads



Introduction

Riverbed Steelhead as WAN accelerator is deployed in WAN environment when traffic between WAN network (i.e. MPLS, Frame Relay) need to be optimized, hence creating so-called "WAN acceleration". With "standard" WAN network consists of WAN routers and LAN switches, typically the Riverbed Steelhead is in place inline between the WAN routers and LAN switches. Following is an illustration.

LAN 1 Switch --- Riverbed Steelhead 1                        Site 1
|
|
WAN 1 Router
| +
| +
MPLS/Frame Relay WAN
| +
| +
WAN 2 Router
|
|
Riverbed Steelhead 2 --- LAN 2 Switch Site 2


In some cases, this WAN network consist of site-to-site IPSec VPN tunnel where ASA/PIX Firewall is used as the IPSec VPN termination. Instead of between routers and switches, the Riverbed Steelhead is in place between the ASA/PIX Firewall and the LAN switches in case of the site-to-site IPSec VPN tunnel with ASA/PIX Firewall as the IPSec VPN termination. Following is an illustration.

LAN 1 Switch --- Riverbed Steelhead 1                        Site 1
|
|
ASA/PIX Firewall 1
| +
| +
Internet IPSec VPN tunnel
| +
| +
ASA/PIX Firewall 2
|
|
Riverbed Steelhead 2 --- LAN 2 Switch Site 2



Riverbed Steelhead Mechanism

Riverbed Steelhead optimizes TCP SYN and SYN-ACK transaction between sites in order to achieve the so-called WAN optimization. By default, TCP option 76 is only carried in the SYN and SYN-ACK packets of each TCP connection. This is used for autodiscovery.

In addition, Riverbed Steelhead uses TCP option 78 that is carried in every TCP segment of a connection. This is necessary to allow the Steelheads distinguish full transpareny packets.

Note that the above 76 and 78 option numbers are the default values, and that they can be changed through the Steelhead configuration. Check out the following official Riverbed links for more info (PDF file).

Riverbed Steelhead Appliance Installation and Configuration Guide
Riverbed Steelhead Appliance Deployment Guide

Sample Configuration

Since ASA/PIX Firewall by default is a security device, there must be specific configuration in place to permit TCP option 76 and TCP option 78 as that is used by Riverbed Steelhead to be operational, should the Steelhead is in place between ASA/PIX Firewall and LAN switches.

Following is sample configuration using ASA/PIX Firewall version 7.0 or above

access-list Riverbed_TCP_Option_76 extended permit tcp any any log
access-list Riverbed_TCP_Option_78 extended permit tcp any any log
tcp-map Riverbed_TCP_Option_76_Tmap
tcp-options range 76 76 allow
tcp-map Riverbed_TCP_Option_78_Tmap
tcp-options range 78 78 allow
class-map Riverbed_TCP_Option_76_Cmap
match access-list Riverbed_TCP_Option_76
class-map Riverbed_TCP_Option_78_Cmap
match access-list Riverbed_TCP_Option_78
policy-map global_policy
class Riverbed_TCP_Option_76_Cmap
set connection advanced-options Riverbed_TCP_Option_76_Tmap
class Riverbed_TCP_Option_78_Cmap
set connection advanced-options Riverbed_TCP_Option_78_Tmap
 

In many organizations, the Riverbed Steelhead is configured to use TCP option 76 for both the autodiscovery and the full transpareny packets. When this is the case, following is the sample configuration using ASA/PIX Firewall version 7.0 or above.

access-list Riverbed_TCP_Option_76 extended permit tcp any any log
tcp-map Riverbed_TCP_Option_76_Tmap
tcp-options range 76 76 allow
class-map Riverbed_TCP_Option_76_Cmap
match access-list Riverbed_TCP_Option_76
policy-map global_policy
class Riverbed_TCP_Option_76_Cmap
set connection advanced-options Riverbed_TCP_Option_76_Tmap
 

With new Riverbed development, TCP Option 77 is also used for auto discovery to separate itself from actual traffic optimization process. A simple modification to accommodate TCP Options 76 to 78 is as follows.

access-list Riverbed_TCP_Options_76-78 extended permit tcp any any log
tcp-map Riverbed_TCP_Options_76-78_Tmap
tcp-options range 76 78 allow
class-map Riverbed_TCP_Options_76-78_Cmap
match access-list Riverbed_TCP_Options_76-78
policy-map global_policy
class Riverbed_TCP_Options_76-78_Cmap
set connection advanced-options Riverbed_TCP_Options_76-78_Tmap
 


Feedback received on this FAQ entry:
  • Nice thanks. Getting ready to do this next week.

    2014-06-06 04:50:48

  • Riverbed recommends allowing 76, 77, & 78, the reason is for future plans. The future has arrived with Riverbed's DX platform which uses option 77 for autodiscovery so that it doesn't interact with the normal optimization.

    2014-02-19 13:13:17 (PA23 See Profile)



Expand got feedback?

by aryoba See Profile
last modified: 2014-03-13 12:37:26