Steelhead Appliance Deployment Guide October 2012

454 Pages·2012·7.48 MB·English

Steelhead®Appliance Deployment Guide

Including the Riverbed® Central Management Console and
the Steelhead® Mobile Controller
October 2012
© 2012 Riverbed Technology. All rights reserved.
Riverbed®, Cloud Steelhead®, Granite™, Interceptor®, RiOS®, Steelhead®, Think Fast®, Virtual Steelhead®, Whitewater®,
Mazu®, Cascade®, Shark®, AirPcap®, BlockStream™, SkipWare®, TurboCap®, WinPcap®, Wireshark®, TrafficScript®, and
Stingray™ are trademarks or registered trademarks of Riverbed Technology, Inc. in the United States and other countries.
Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other
trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the
prior written consent of Riverbed Technology or their respective owners.
Akamai® and the Akamai wave logo are registered trademarks of Akamai Technologies, Inc. SureRoute is a service mark of
Akamai. Apple and Mac are registered trademarks of Apple, Incorporated in the United States and in other countries. Cisco is a
registered trademark of Cisco Systems, Inc. and its affiliates in the United States and in other countries. EMC, Symmetrix, and
SRDF are registered trademarks of EMC Corporation and its affiliates in the United States and in other countries. IBM, iSeries, and
AS/400 are registered trademarks of IBM Corporation and its affiliates in the United States and in other countries. Linux is a
trademark of Linus Torvalds in the United States and in other countries. Microsoft, Windows, Vista, Outlook, and Internet
Explorer are trademarks or registered trademarks of Microsoft Corporation in the United States and in other countries. Oracle and
JInitiator are trademarks or registered trademarks of Oracle Corporation in the United States and in other countries. UNIX is a
registered trademark in the United States and in other countries, exclusively licensed through X/Open Company, Ltd. VMware,
ESX, ESXi are trademarks or registered trademarks of VMware, Incorporated in the United States and in other countries.
This product includes software developed by the University of California, Berkeley (and its contributors), EMC, and Comtech
AHA Corporation. This product is derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm.
NetApp Manageability Software Development Kit (NM SDK), including any third-party software available for review with such
SDK which can be found at http://communities.netapp.com/docs/DOC-1152, and are included in a NOTICES file included
within the downloaded files.
For a list of open source software (including libraries) used in the development of this software along with associated copyright
and license agreements, see the Riverbed Support site at https//support.riverbed.com. You must log in to Riverbed Support to
view this information.
This documentation is furnished “AS IS” and is subject to change without notice and should not be construed as a commitment
by Riverbed Technology. This documentation may not be copied, modified or distributed without the express authorization of
Riverbed Technology and may be used only in connection with Riverbed products and services. Use, duplication, reproduction,
release, modification, disclosure or transfer of this documentation is restricted in accordance with the Federal Acquisition
Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military
agencies. This documentation qualifies as “commercial computer software documentation” and any use by the government shall
be governed solely by these terms. All other use is prohibited. Riverbed Technology assumes no responsibility or liability for any
errors or inaccuracies that may appear in this documentation.
Riverbed Technology
199 Fremont Street
San Francisco, CA 94105
Phone: [phone]
Fax: [phone] Part Number
Web: http://www.riverbed.com 712-00003-15
Contents
Preface.........................................................................................................................................................1
About This Guide..........................................................................................................................................1
Audience..................................................................................................................................................2
Types of Steelhead Appliances.............................................................................................................2
Document Conventions.........................................................................................................................3
Additional Resources....................................................................................................................................3
Release Notes..........................................................................................................................................4
Riverbed Documentation and Support Knowledge Base.................................................................4
Online Documentation...........................................................................................................................4
Contacting Riverbed......................................................................................................................................4
Internet.....................................................................................................................................................4
Technical Support...................................................................................................................................4
Riverbed Professional Services.............................................................................................................5
Documentation........................................................................................................................................5
What Is New...................................................................................................................................................5
Chapter 1 - Optimization Techniques and Design Fundamentals..........................................................7
How Steelhead Appliances Optimize Data...............................................................................................7
Data Streamlining..........................................................................................................................................8
Scalable Data Referencing.....................................................................................................................8
Bi-Directional Synchronized RiOS Data Store....................................................................................9
Unified RiOS Data Store.......................................................................................................................9
QoS............................................................................................................................................................9
Transport Streamlining.................................................................................................................................9
Connection Pooling..............................................................................................................................10
DSCP and TOS QoS Mirroring...........................................................................................................10
Application Streamlining............................................................................................................................10
Management Streamlining.........................................................................................................................11
RiOS Data Store Synchronization..............................................................................................................12
RiOS Data Store Synchronization Requirements.............................................................................12
RiOS Data Store Error Alarms...........................................................................................................13
Steelhead Appliance Deployment Guide iii
Contents

Choosing the Right Steelhead Appliance.................................................................................................13
Deployment Modes for the Steelhead Appliance...................................................................................15
The Auto-Discovery Protocol.....................................................................................................................15
Original Auto-Discovery Process.......................................................................................................17
Configuring Enhanced Auto-Discovery...........................................................................................19
Auto-Discovery and Firewall Considerations.........................................................................................19
Removal of the Riverbed TCP Option Probe....................................................................................19
Stateful Firewall Device in a Multiple In-Path Environment.........................................................20
Multiple In-Path Discovery Behavior.......................................................................................................21
Controlling Optimization...........................................................................................................................22
In-Path Rules.........................................................................................................................................22
Default In-Path Rules...........................................................................................................................23
Peering Rules.........................................................................................................................................23
The Kickoff and Automatic Kickoff Features...................................................................................24
Controlling Optimization Configuration Examples...............................................................................26
Configuring High-Bandwidth, Low-Latency Environment...........................................................26
Configuring Pass-Through Transit Traffic........................................................................................28
Fixed-Target In-Path Rules.........................................................................................................................31
Configuring a Fixed-Target In-Path Rule for an In-Path Deployment.........................................32
Fixed-Target In-Path Rule for an Out-Of-Path Deployment..........................................................33
Best Practices for Steelhead Appliance Deployments............................................................................33
Chapter 2 - Network Integration Tools....................................................................................................37
Redundancy and Clustering......................................................................................................................37
Physical In-Path Deployments...........................................................................................................37
Virtual In-Path Deployments..............................................................................................................38
Out-of-Path Deployments...................................................................................................................38
Fail-to-Wire and Fail-to-Block....................................................................................................................39
Overview of Link State Propagation.........................................................................................................39
Connection Forwarding..............................................................................................................................39
Configuring Connection Forwarding................................................................................................40
Failure Handling Within Connection Forwarding..........................................................................41
Connection-Forwarding Neighbor Latency.....................................................................................42
Overview of Simplified Routing................................................................................................................42
Chapter 3 - WAN Visibility Modes...........................................................................................................45
Overview of WAN Visibility......................................................................................................................45
Correct Addressing......................................................................................................................................46
Transparent Addressing..............................................................................................................................47
Port Transparency.................................................................................................................................48
Full Address Transparency.................................................................................................................49
Full Address Transparency with Forward Reset..............................................................................51
iv Steelhead Appliance Deployment Guide
Contents

Implications of Transparent Addressing..................................................................................................52
Stateful Systems....................................................................................................................................52
Network Design Issues........................................................................................................................53
Integration into Networks Using NAT..............................................................................................56
The Out-of-Band Connection.....................................................................................................................64
Overview of OOB Connections and Addressing Modes................................................................65
Configuring OOB Connection Destination Transparency..............................................................65
Configuring OOB Connection Full Transparency...........................................................................66
Configuring WAN Visibility Modes.........................................................................................................67
Chapter 4 - QoS Configuration and Integration.....................................................................................69
Overview of Riverbed QoS.........................................................................................................................70
Introduction to Riverbed QoS.............................................................................................................70
Enforcing QoS Policies using Riverbed QoS....................................................................................71
Integrating Steelhead Appliances into Existing QoS Architectures.....................................................71
WAN-Side Traffic Characteristics and QoS.......................................................................................72
QoS Integration Techniques................................................................................................................72
QoS Marking.........................................................................................................................................74
Application Flow Engine............................................................................................................................76
Basic Outbound QoS...................................................................................................................................76
Configuring Basic Outbound QoS.....................................................................................................77
Basic Outbound QoS Mode Restrictions...........................................................................................78
WAN Oversubscription.......................................................................................................................79
Advanced Outbound QoS..........................................................................................................................80
QoS Classes............................................................................................................................................80
Choosing a QoS Enforcement System...............................................................................................83
QoS Class Parameters..........................................................................................................................84
QoS Rules...............................................................................................................................................86
Inbound QoS.................................................................................................................................................90
Inbound QoS Limitations....................................................................................................................90
Inbound QoS Limits.............................................................................................................................91
Guidelines for the Maximum Number of QoS Classes, Sites, and Rules............................................91
LAN Bypass..................................................................................................................................................93
QoS in Virtual In-Path and Out-of-Path Deployments..........................................................................93
QoS in Multiple Steelhead Appliance Deployments..............................................................................94
QoS and Multiple WAN Interfaces...........................................................................................................94
QoS Enforcement Best Practices................................................................................................................95
Migrating Between Basic and Advanced Outbound QoS Modes........................................................96
Upgrading to RiOS v6.5 and Later...........................................................................................................97
Chapter 5 - QoS Configuration Examples..............................................................................................99
Visualizing and Drawing Your QoS Configuration................................................................................99
Steelhead Appliance Deployment Guide v
Contents

Configuring QoS Using Best Practices....................................................................................................103
Example QoS Scenario.......................................................................................................................103
Configuring QoS on the Data Center Steelhead Appliance.........................................................105
Configuring QoS on the Branch Office Steelhead Appliance......................................................109
Configuring QoS Marking on Steelhead Appliances...........................................................................111
Configuring QoS and MX-TCP................................................................................................................115
Chapter 6 - Physical In-Path Deployments...........................................................................................121
Overview of In-Path Deployment...........................................................................................................121
The Logical In-Path Interface...................................................................................................................122
In-Path IP Address Selection.............................................................................................................123
In-Path Default Gateway and Routing............................................................................................123
Failure Modes.............................................................................................................................................124
Fail-to-Wire Mode...............................................................................................................................124
Fail-to-Block Mode.............................................................................................................................125
Configuring Failure Modes...............................................................................................................126
Configuring Link State Propagation.......................................................................................................126
Cabling and Duplex...................................................................................................................................127
Choosing the Correct Cables.............................................................................................................128
Duplex Configuration........................................................................................................................128
Troubleshooting Cable and Duplex Issues.....................................................................................129
Physical In-Path Deployment Configuration Examples......................................................................130
Configuring a Basic Physical In-Path Deployment.......................................................................130
Configuring a Physical In-Path with Dual Links Deployment....................................................132
Configuring a Serial Cluster Deployment with Multiple Links..................................................133
In-Path Redundancy and Clustering Examples....................................................................................135
Configuring Master and Backup Deployments.............................................................................135
Configuring Serial Cluster Deployments .......................................................................................138
Configuring Simplified Routing..............................................................................................................141
Multiple WAN Router Deployments......................................................................................................143
Configuring Multiple WAN Router Deployments Without Connection Forwarding.............143
Configuring Multiple WAN Router Deployments with Connection Forwarding....................147
802.1Q Trunk Deployments......................................................................................................................155
Overview of VLAN Trunk.................................................................................................................156
Configuring a Steelhead Appliance on an 802.1Q Trunk Link....................................................157
Capturing Network Traces Using tcpdump...................................................................................158
Layer-2 WAN Deployments.....................................................................................................................158
Layer-2 WANs.....................................................................................................................................158
Broadcast Layer-2 WANs...................................................................................................................159
VLAN Bridging Deployments.................................................................................................................160
Overview of VLAN Bridging Deployment.....................................................................................160
VLAN Bridging Considerations.......................................................................................................161
VLAN Bridging Variations................................................................................................................162
vi Steelhead Appliance Deployment Guide
Contents

Chapter 7 - Virtual In-Path Deployments..............................................................................................165
Overview of Virtual In-Path Deployment..............................................................................................165
Configuring an In-Path, Load-Balanced, Layer-4 Switch Deployment.............................................166
Configuring Flow Data Exports in Virtual In-Path Deployments......................................................168
Chapter 8 - WCCP Virtual In-Path Deployments..................................................................................169
Overview of WCCP...................................................................................................................................169
WCCP Fundamentals................................................................................................................................170
Service Groups....................................................................................................................................170
Assignment Methods.........................................................................................................................171
Redirection and Return Methods.....................................................................................................173
WCCP Clustering and Failover........................................................................................................175
Multiple In-Path WCCP.....................................................................................................................176
The Advantages and Disadvantages of WCCP.....................................................................................176
Configuring WCCP...................................................................................................................................177
Basic Steps for Configuring WCCP..................................................................................................177
Configuring a Simple WCCP Deployment.....................................................................................178
Adding a Steelhead Appliance to an Existing WCCP Deployment............................................181
Configuring a WCCP High Availability Deployment...................................................................182
Configuring a Basic WCCP Router..................................................................................................190
Configuring Additional WCCP Features...............................................................................................191
Specifying the Service Group Password.........................................................................................191
Configuring Multicast Groups.........................................................................................................192
Configuring Group Lists to Limit Service Group Members........................................................193
Configuring Access Control Lists.....................................................................................................194
Configuring Load Balancing in WCCP...........................................................................................197
Flow Data in WCCP..................................................................................................................................200
Verifying and Troubleshooting WCCP Configurations.......................................................................200
Chapter 9 - Policy-Based Routing Virtual In-Path Deployments........................................................205
Overview of PBR........................................................................................................................................205
PBR Failover and Cisco Discovery Protocol...................................................................................206
Alternate PBR Failover Mechanisms...............................................................................................207
Connecting the Steelhead Appliance in a PBR Deployment...............................................................208
Configuring PBR........................................................................................................................................208
Overview of Configuring PBR..........................................................................................................208
Configuring a Steelhead Appliance to Directly Connect to the Router......................................209
Configuring a Steelhead Appliance to Connect to Layer-2 Switch.............................................210
Configuring a Steelhead Appliance to Connect to a Layer-3 Switch..........................................212
Configuring a Steelhead Appliance with Object Tracking...........................................................213
Configuring a Steelhead Appliance with Multiple PBR Interfaces.............................................214
Configuring Multiple Steelhead Appliances to Connect to Multiple Routers..........................215
Configuring PBR for Load-Balancing WAN Circuits....................................................................218
Configuring Local PBR for ICMP Redirection in a Mixed MTU Environment.........................222
Steelhead Appliance Deployment Guide vii
Contents

Exporting Flow Data and Virtual In-Path Deployments.....................................................................224
Chapter 10 - Packet Mode Optimization...............................................................................................225
Overview of Packet Mode Optimization................................................................................................225
Comparison with TCP Proxy Mode Optimization...............................................................................225
Configuring Packet Mode Optimization................................................................................................226
Design Considerations..............................................................................................................................231
Best Practices for Packet Mode Optimization........................................................................................232
Chapter 11 - Satellite Optimization.......................................................................................................233
Overview of Satellite Networks...............................................................................................................234
Impact of Latency...............................................................................................................................234
Impact of Loss.....................................................................................................................................234
Satellite Transport Options................................................................................................................235
Overview of SCPS......................................................................................................................................235
SCPS Benefits.......................................................................................................................................236
Common Uses for SCPS....................................................................................................................236
SCPS and Steelhead Appliances.......................................................................................................237
TCP Optimization for Satellite Environments.......................................................................................237
SCPS Discovery...................................................................................................................................238
Transport Optimization for Satellite Environments......................................................................238
Configuring Automatic Detect TCP Optimization........................................................................240
Integrating the Steelhead Appliance with Existing Satellite Modem TCP Acceleration.........241
Licensing SCPS on a Steelhead Appliance.............................................................................................241
Configuring Transport Optimization......................................................................................................242
Configuring Single-Ended Connection Rule Table Settings.........................................................245
Verification and Troubleshooting............................................................................................................247
Analyzing Connection Optimization Information........................................................................247
Analyzing Packets for Discovery Probe Stripping........................................................................252
Understanding the Health of the Satellite Signal...........................................................................254
Potential Performance Impact of Loss at the Start of Flow..........................................................254
Variance in SCPS Performance.........................................................................................................255
Chapter 12 - VPN Routing and Forwarding..........................................................................................257
Overview of NSV with VRF Select..........................................................................................................257
Virtual Routing and Forwarding .....................................................................................................258
NSV with VRF Select .........................................................................................................................259
IOS Requirements...............................................................................................................................260
Prerequisites for NSV.........................................................................................................................260
Example NSV Network Deployment.....................................................................................................260
Configuring NSV.......................................................................................................................................262
Basic Steps for Configuring NSV.....................................................................................................262
Configuring the Data Center Router...............................................................................................263
viii Steelhead Appliance Deployment Guide
Contents

Configuring the PBR Route Map......................................................................................................264
Decoupling VRF from the Subinterface to Implement NSV........................................................265
Configuring the Branch Office Router ............................................................................................266
Configuring the Data Center Steelhead Appliance.......................................................................266
Configuring the Branch Office Steelhead Appliance ...................................................................267
Chapter 13 - Out-of-Path Deployments.................................................................................................269
Overview of Out-of-Path Deployment...................................................................................................269
Limitations of Out-of-Path Deployments...............................................................................................270
Configuring Out-of-Path Deployments..................................................................................................271
Chapter 14 - Data Protection Deployments..........................................................................................273
Overview of Data Protection....................................................................................................................273
Planning for a Data Protection Deployment.........................................................................................274
LAN-side Throughput and Data Reduction Requirements.........................................................275
Predeployment Questionnaire..........................................................................................................276
Configuring Steelhead Appliances for Data Protection.......................................................................279
Adaptive Data Streamlining Feature Settings................................................................................280
CPU Settings........................................................................................................................................281
Best Practices for Data Streamlining and Compression................................................................282
MX-TCP Settings.................................................................................................................................282
The Steelhead Appliance WAN Buffer Settings.............................................................................283
The Router WAN Buffer Settings.....................................................................................................283
Common Data Protection Deployments................................................................................................283
Remote Office, Branch Office Backups............................................................................................284
Network Attached Storage Replication...........................................................................................284
Storage Area Network Replication..................................................................................................285
Designing for Scalability and High Availability...................................................................................285
Overview of N+M Architecture.......................................................................................................285
Using MX-TCP in N+M Deployments............................................................................................286
Troubleshooting and Fine-Tuning...........................................................................................................287
Third-Party Interoperability.....................................................................................................................288
Chapter 15 - Storage Area Network Replication..................................................................................291
Overview of SAN Replication..................................................................................................................291
Storage Optimization Modules................................................................................................................292
FCIP Optimization Module...............................................................................................................292
SRDF Optimization Module.............................................................................................................295
Best Practices for SAN Replication Using TCP/IP...............................................................................300
Best Practices for SAN Replication Using FCIP....................................................................................301
Best Practices for a Cisco MDS FCIP Configuration.....................................................................301
Best Practices for a Brocade 7800 Configuration............................................................................305
Best Practices for a Brocade 7500 Configuration............................................................................311
Steelhead Appliance Deployment Guide ix
Contents

Chapter 16 - Proxy File Services Deployments...................................................................................315
Overview of Proxy File Services..............................................................................................................315
When to Use PFS.................................................................................................................................316
PFS Terms.............................................................................................................................................316
Upgrading V2.x PFS Shares......................................................................................................................317
Domain and Local Workgroup Settings.................................................................................................318
Domain Mode.....................................................................................................................................318
Local Workgroup Mode.....................................................................................................................319
PFS Share Operating Modes.....................................................................................................................319
Lock Files....................................................................................................................................................321
Configuring PFS.........................................................................................................................................321
Chapter 17 - Video Optimization...........................................................................................................323
Overview of Video Optimization............................................................................................................323
HTTP Stream Splitting..............................................................................................................................324
Configuring Microsoft Silverlight....................................................................................................325
Configuring Adobe HTTP Dynamic Streaming.............................................................................327
Video On-Demand with HTTP Prepopulation......................................................................................328
Chapter 18 - Authentication, Security, Operations, and Monitoring..................................................329
Overview of Authentication.....................................................................................................................329
Authentication Features............................................................................................................................330
Configuring a RADIUS Server.................................................................................................................331
Configuring a RADIUS Server with FreeRADIUS........................................................................331
Configuring RADIUS Authentication in the Steelhead Appliance.............................................332
Configuring a TACACS+ Server..............................................................................................................333
Configuring TACACS+ with Cisco Secure Access Control Servers............................................333
Configuring TACACS+ Authentication in the Steelhead Appliance..........................................334
Securing Steelhead Appliances................................................................................................................334
Overview of Securing Steelhead Appliances.................................................................................334
Best Practices for Securing Access to Steelhead Appliances........................................................335
Best Practices for Enabling Steelhead Appliance Security Features...........................................340
Best Practices for Policy Controls.....................................................................................................343
Best Practices for Security Monitoring............................................................................................343
Configuring SSL Certificates for Web User Interface....................................................................344
Capacity Planning......................................................................................................................................345
Model Characteristics........................................................................................................................345
Admission Control.............................................................................................................................347
Overview of Exporting Flow Data..........................................................................................................349
SNMP Monitoring.....................................................................................................................................350
x Steelhead Appliance Deployment Guide