ProxySG VA Initial Configuration Guide.A
ProxySG VA Initial Configuration Guide.A
ProxySG VA Initial Configuration Guide.A
Contact Information
Americas: Blue Coat Systems Inc. 410 North Mary Ave Sunnyvale, CA 94085-4121 Rest of the World: Blue Coat Systems International SARL 3a Route des Arsenaux 1700 Fribourg, Switzerland http://www.bluecoat.com/support/contactsupport http://www.bluecoat.com For concerns or feedback about the documentation: documentation@bluecoat.com
Copyright 1999-2010 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of Blue Coat Systems, Inc. All right, title and interest in and to the Software and documentation are and shall remain the exclusive property of Blue Coat Systems, Inc. and its licensors. ProxyAV, CacheOS, SGOS, SG, Spyware Interceptor, Scope, ProxyRA Connector, ProxyRA Manager, Remote Access and MACH5 are trademarks of Blue Coat Systems, Inc. and CacheFlow, Blue Coat, Accelerating The Internet, ProxySG, WinProxy, PacketShaper, PacketShaper Xpress, PolicyCenter, PacketWise, AccessNow, Ositis, Powering Internet Management, The Ultimate Internet Sharing Solution, Cerberian, Permeo, Permeo Technologies, Inc., and the Cerberian and Permeo logos are registered trademarks of Blue Coat Systems, Inc. All other trademarks contained in this document and in the Software are the property of their respective owners. BLUE COAT SYSTEMS, INC. AND BLUE COAT SYSTEMS INTERNATIONAL SARL (COLLECTIVELY BLUE COAT) DISCLAIM ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC. HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Americas: Blue Coat Systems, Inc. 420 N. Mary Ave. Sunnyvale, CA 94085
Rest of the World: Blue Coat Systems International SARL 3a Route des Arsenaux 1700 Fribourg, Switzerland
Document Number: 231-03049 Document Revision: SGOS 5.5.2, March 2010, Rev. B
ii
Table of Contents
Table of Contents
Chapter 1: Overview Chapter 2: Before You Begin
Confirm System Requirements for the ProxySG VA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9 Host Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9 Support for RAID. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11 WCCP-Capable Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11 Support for VMware Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-11 Support for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12 Verify Resource Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12 Retrieve Appliance Serial Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13 Create a Virtual Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14
iii
Table of Contents
iv
Overview
The ProxySG Virtual Appliance (ProxySG VA) is a software solution that can be installed and deployed on a server running VMwares ESX or ESXi Server. It is a branch office solution that accelerates the flow of data and applications between the branch office and data center, and facilitates server consolidation since the ProxySG VA can co-exist with other virtual machines on a single hardware platform. With the ProxySG VA providing WAN acceleration, the other virtual machines can provide branch office services (such as Domain Controller, print, DNS, and DHCP), as well as any VMware-certified software application. The ProxySG VA must be installed virtually in-path using Web Cache Communication Protocol (WCCP). WCCP is a protocol that is used when a caching device, such as the ProxySG VA, is not deployed physically in-path with the router. Using the WCCP protocol, a WCCP-capable router transparently intercepts traffic and redirects it to the ProxySG VA. The following network diagram shows an Application Delivery Network (ADN) where the ProxySG VA is deployed virtually inline at a branch office and a ProxySG hardware appliance is deployed inline at the data center.
Before You Begin Create the ProxySG Virtual Appliance Configure the ProxySG VA WCCP Reference Upgrading the ProxySG VA Check Blue Touch Online for the most up-do-date version of this guide.
Note
1-5
Overview
Terminology
The following table lists the terms used in this guide. Term Application Delivery Network (ADN) Appliance Serial Number Blue Coat Sky BCLP Datastore Director Definition A Blue Coat solution that provides visibility, acceleration, and control for the application traffic traversing a WAN. A string of 10 characters that uniquely identifies a Blue Coat appliance. On the first boot, you must enter the appliance serial number to begin initial configuration on the ProxySG VA. The default Web interface for the MACH 5 license.
https://services.bluecoat.com/eservice_enu/licensing/register.cgi
Storage defined in ESX/i, made up of one or more physical disks. The Blue Coat Director is the centralized change, configuration, and policy management platform. It allows you to effectively manage multiple ProxySG appliances in your network. A mode that allows administrative privileges on the Command Line Interface (CLI) of the ProxySG appliance. You can make permanent changes to the configuration in this mode. A password used to access enable mode so that you can configure an appliance. The enable password is for administrators who are authorized to configure an appliance. The physical computer (host) onto which VMwares virtualization product is installed. The ESX or ESXi Server provides CPU and memory resources, access to storage, and network connectivity to multiple virtual machines. Note: Throughout this guide, ESX/i Server is used as a shorthand for ESX or ESXi Server.
Enable Mode
Enable Password
ESX/i Server
1-6
Overview
Definition The Web interface for advanced configuration on the ProxySG VA. Enter the following URL in the Web browser for directly accessing the Management Console: https://<ProxySG_IP_address>:8082/mgmt where <ProxySG_IP_address> is the IP address of your ProxySG VA.
MACH5
Blue Coats MACH5 edition license on the ProxySG is used for acceleration deployments. The MACH5 base license allows acceleration of HTTP, FTP, CIFS, DNS, email, and streaming protocols. Security-related features are not included. The Open Virtualization Format is a format for packaging and distributing virtual machines. It is an XML text file that defines the attributes of a specific virtual machine package. A ProxySG running as a virtual appliance on VMwares ESX or ESXi Server.
OVF
ProxySG VA
SGOS VAP
The ProxySG operating system. The Virtual Appliance Package is the zip file that contains the OVF file and the virtual disk files (.vmdk) required for creating the ProxySG VA. It also includes this guide, the ProxySG V Initial Configuration Guide. A An instance of an operating system and one or more applications that run in an isolated partition of an ESX or ESXi Server. ProxySG VA is a virtual machine. Virtual Local Area Network. A local area network (LAN) that is created with software. It maps clients (hosts) on a basis other than by geographic location and extends across LAN segments rather than remaining in one physical LAN. Web Cache Communication Protocol. Allows you to establish redirection of the traffic that flows through routers.
WCCP
1-7
Overview
1-8
This chapter assumes that you have configured your hardware platform as an ESX/i Server, have created datastores, and have configured the ESX/i Server for network access. For information on setting up your ESX/i Server, refer to the VMware documentation. Before you proceed with creating the ProxySG VA, perform the following tasks:
Confirm System Requirements for the ProxySG VA Retrieve Appliance Serial Numbers Create a Virtual Switch
Host Server
The host server must be on VMwares Hardware Compatibility List (refer to http://www.vmware.com/resources/compatibility/search.php). The server must have sufficient virtual resources to run your ProxySG VA model, as described in the following table.
Table 2-1 Resource requirements by model
Model Virtual CPU minimum Virtual memory Virtual drives Minimum storage space * Minimum number of physical drives in a non-RAID system. For disk drive requirements in a RAID configuration, see "Support for RAID" on page 2-11.
ProxySG VA-5 ProxySG VA-10 ProxySG VA-15 ProxySG VA-20 ( 5 - 10 users) ( 10 - 50 users) ( 50 - 125 users) ( 125 - 300 users) 1.0 GHz 1024 MB 1 100 GB 1 1.5 GHz 1536 MB 2 200 GB 1 2.0 GHz 2048 MB 4 400 GB 2*** 2.5 GHz 3072 MB 6 600 GB 3***
storage partition in which a ProxySG VA is installed must include the minimum number of physical drives shown in this table. This requirement ensures that adequate disk IO bandwidth is available to support the throughput for which the model is rated. The storage partition must be on the ESX/i Server and it must contain adequate storage space.
The
2-9
On some platforms with RAID controllers, the storage set-up utility might allow a single drive to be configured as a RAID 0. Although a single drive is technically not a RAID configuration, it is an acceptable configuration for the ProxySG VA-5 and the ProxySG VA-10. *** To configure drives on the ProxySG VA-15 and ProxySG VA-20, add extents to the datastore; refer to the VMware documentation for details.
Deployment Recommendations Create only one ProxySG VA on an ESX or ESXi Server. For optimal performance, follow these guidelines:
Use only up to 85% of the available disk space on a datastore, as recommended by VMware. For example, when selecting a datastore for a ProxySG VA-15 that uses 400GB of disk space, ensure that at least 15% disk space is still available on the datastore after the ProxySG VA is created. To meet performance expectations, the ProxySG VA requires local storage; SAN and NAS are not supported storage options and might result in reduced performance. To make a back up of your system configuration, use the archiving feature in the ProxySG VA. Do not take snapshots of the ProxySG VA configuration. Snapshots are detrimental to the performance of the ProxySG VA because they occupy too much disk space. When a snapshot is created, a delta file is created on the Virtual Machine File System. The initial size of the delta file is 16MB, but it grows in increments of 16 MB as writes are made to the disk. Do not suspend and resume the ProxySG VA. When you suspend the ProxySG VA, any active TCP connection is suspended at first and is subsequently aborted. Clients will need to reconnect when the ProxySG VA becomes available again. This suspend and resume action thereby creates a poor performance experience for the users.
2 - 10
WCCP-Capable Router
The ProxySG VA must be installed virtually in-path using Web Cache Communication Protocol (WCCP). WCCP is a protocol that is used when a caching device, such as the ProxySG VA, is not deployed physically in-path with the router. Using the WCCP protocol, a WCCP-capable router transparently intercepts traffic and redirects it to the ProxySG VA.
ESX or ESXi Server v3.5 (update 3 or 4) or v4.0 VI Client v2.5 or vSphere Client 4.0 vCenter Server v2.5 or v4.0
Note
VMotion, Distributed Resource Scheduling (DRS), High Availability (HA), clustering and resource pools are not supported in this release.
Blue Coat worked closely with VMware to ensure that the ProxySG VA runs efficiently in the virtual environment and meets all technical criteria and specifications. The VMware Ready program is a validation program designed to provide the best possible user experience among virtual appliances being deployed in production. This status indicates that Blue Coat has followed best practices and the software is optimized for VMware vSphere, helping to ensure ready-to-run reliability and security.
2 - 11
Step 2 Display the summary of the ESX/i Servers resources. Step 3 Verify adequate resource availability. For ProxySG VA resource requirements, see Table 2-1 on page 2 - 10.
a. b. a.
Select the ESX/i Server. Click the Summary tab. In the General panel, confirm availability of the minimum Processor speed requirement for your ProxySG VA model. In the Memory Usage section of the Resources panel, confirm availability of adequate memory resources. In the Datastore section of the Resources panel, confirm adequate free storage space availability on a local datastore on the ESX/i Server.
b.
c.
2 - 12
b. Step 4 Enter the activation code. You can select any of a. the ProxySG VA activation codes that are listed in the email; the system retrieves all serial numbers from the same purchase order.
b.
Step 5 Record the appliance serial number(s). You will Perform one of the following tasks to note the appliance serial number. need to refer to the serial number when you perform initial configuration on the Write down the serial number(s) listed on ProxySG VA. the screen.
2 - 13
Each appliance serial number is unique. When performing initial configuration on the ProxySG VA, make sure that you use a dedicated serial number for each instance of a ProxySG VA. If you reuse a serial number, the ProxySG VA license could be suspended. License suspension disables proxy functionality and the graphical user interface displays the Duplicate serial number detected error message. To re-enable your license, the ProxySG VA with the duplicate serial number must be deleted.
If you use VLANs for segregating traffic within the ESX/i Server or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations.
2 - 14
d. In the Add Network Wizard, select Virtual Machine in the Connection Types dialog. Click Next. e. f. Select Create a virtual switch. Select the physical NIC to manage the traffic to and from the ProxySG VA. This physical NIC will be mapped to the virtual switch. Click Next.
g. Specify the Network Label. The default label is Virtual Machine Network. h. Verify that the VLAN ID field is blank or enter 0. This guide assumes that you do not use VLANs. If you use VLANs, enter 4095 to enable VLAN trunking. This value enables Virtual Guest Machine Tagging mode on the switch, and it allows the virtual switch to preserve VLAN tags between the virtual machine and the external switch/router. Refer to the WAN Optimization and Application Acceleration Guide for advanced configuration details on configuring your ProxySG VA with VLANs. i. Verify the details and exit the Add Network Wizard.
2 - 15
2 - 16
This chapter describes how to import a virtual appliance in to the ESX/i Server, enable performance monitoring on the virtual appliance, and ensure that the ProxySG VA has the resources available for optimal performance. To create the ProxySG VA, you must have administrative privileges on the ESX/i Server. Note: Blue Coat recommends creating only one ProxySG VA on an ESX/i Server. The following topics are covered in this chapter:
Download the Virtual Appliance Package Import a ProxySG VA Enable Performance Monitoring on the ProxySG VA Reserve Resources for the ProxySG VA Power on the ProxySG VA
Open Virtualized Format (OVF) file Virtual Machine Disk Format (VMDK) files, one for each virtual disk required on the model. For
example, the ProxySG VA-20 has six .vmdk files.
https://bto.bluecoat.com/download
Enter your login credentials when prompted. In BTO, click the Downloads tab. Select ProxySG. Click SGOS5.5.
d. In the Virtual Appliance Installer section, select the VAP file for your ProxySG VA model. e. Follow the onscreen instructions.
3 - 17
Downloading the VAP Step 3 Extract the contents of the VAP file. The files should be extracted to a location that can be accessed from the system running the VMware client or vCenter Server.
Note
Because the .ovf file includes a pointer to the .vmdk files, you must extract and store the contents of the .zip file within the same folder. Do not rename the files.
3 - 18
Import a ProxySG VA
The instructions in this section use vSphere Client v4.0. Importing the OVF File Step 1 Create the ProxySG VA on your host ESX/i Server.
Note
a. b.
In your VMware client, select your host ESX/i Server. Select File > Deploy OVF Template. The equivalent command in VI Client is
File > Virtual Appliance > Import.
In ESX 4.0, you cannot deploy the OVF from vSphere Server; you must use the vSphere Client to import OVF templates.
Note
c.
Select Deploy from file or Deploy from URL and browse to the location of the .ovf file. Click Next.
d. Verify the OVF template details and click Next. e. Enter a name for the ProxySG VA, for example: SGVA_Model15_Sydney. The name should be unique within your ESX/i host. Click Next. Choose a datastore with sufficient free space. See Confirm System Requirements for the ProxySG VA on page 2-9 for disk space requirements. Click Next.
f.
g. For the WAN and LAN interfaces, select the vSwitch to be used by the ProxySG VA. Click Next. h. (Optional) Connect the third interface to a different virtual switch on the ESX/i host. This interface is required only if a client on a private subnet requires management access to the ProxySG VA, for example, if the management client cannot access the ProxySG VA through its WAN and LAN ports. i. Review the details and click Finish to begin creating the ProxySG VA. See the Recent Tasks panel located at the bottom of your VMware client screen, for the progress bar indicating the percentage complete.
3 - 19
Importing the OVF File (Continued) Step 2 (Optional) Enable the vSwitch for the third interface.
Note
a. b.
Select the ProxySG VA, on the ESX/i Server. Right click and select Edit Settings.
This step is required only if you plan to use the c. Select Hardware > Network Adapter 3. third interface on the ProxySG VA. d. In the Device Status panel, enable the check box for Connect at power on. e. Click OK to exit the dialog.
d. Click Configuration Parameters. Step 2 Add the string for monitoring performance. a. b. c. Click Add row, in the Configuration Parameters window. Enter monitor_control.pseudo_perfctr in the Name column of the new row. Enter 1 in the Value column.
d. Verify that the string has no typographical errors. e. f. Click OK. Click OK to close the dialog.
The ProxySG VA uses the monitor_control.pseudo_perfctr counter to monitor stolen time. Stolen time is the difference between real time (as measured on the host servers clock) and apparent time (as measured on the ProxySG); small amounts of stolen time are an inevitable occurrence on virtual machines. Stolen time can become excessive when the ProxySG VA is running at 100% CPU utilization, the ESX/i Server is overloaded, and the recommended resources for the ProxySG are not reserved (as described in the next section). Because excessive stolen time can create issues with ProxySG reporting and operations, the following actions are taken when stolen time on your ProxySG VA has exceeded predefined thresholds:
3 - 20
If instantaneous stolen time exceeds 15 seconds, the ProyxSG VA automatically reboots. If accumulated stolen time exceeds 30 minutes in a 24-hour period, the ProxySG license is temporarily disabled, and all traffic is bypassed. The health state of the ProxySG VA transitions to Critical, and the following alerts appear:
License expired. All traffic is now bypassed. Virtual appliance stolen time threshold exceeded.
d. Multiply this number by 1000 to obtain the value in MHz. For example, 1000 x 2.26 = 2260 MHz. Step 2 Specify the CPU reservation value for the ProxySG VA. a. b. Select the ProxySG VA, on the ESX/i host. Right click and select Edit Settings. The Virtual Machine Properties window displays. In the Resources tab, select CPU.
c.
d. Specify the Reservation value for the CPU that you determined in Step 2. e. Retain the default values for the other options.
3 - 21
Reserving Resources (Continued) Step 3 Specify the memory reservation for the ProxySG VA. a. b. In the Resources tab, select Memory. Specify the Reservation value for memory allotted to the ProxySG VA. Input the value recommended for your model. See Confirm System Requirements for the ProxySG VA on page 2-9 for the values by model. Retain the default values for the other options.
c.
a. Step 4 Give the virtual disks on the ProxySG VA a higher priority access to the physical disks on b. the ESX/i Server. (Recommended if the ProxySG VAs datastore is shared by other virtual machines on the ESX/i Server.) c.
In the Resources tab, select Disk. For each of the disks on the ProxySG VA, change the value to High in the Shares field. Setting this value to high ensures that the ProxySG VA gains higher priority access to disk resources, as compared to other virtual machines that use the same physical disks. Click OK to exit the dialog.
3 - 22
This chapter describes how to perform the initial set-up and configuration of the ProxySG VA for transparent redirection of traffic. The following topics are covered in this chapter:
Perform Initial Configuration Launch Blue Coat Sky Register and License the ProxySG VA Configure WCCP Verify your Configuration Next Steps
4 - 23
Description
Value
Interface configuration Identify the IP addresses and subnet masks for the WAN and LAN interfaces. Blue Coat recommends keeping the WAN and LAN interfaces of the ProxySG VA on the same subnet. Both interfaces will be connected to one virtual switch that is connected to the same physical NIC on the ESX/i Server. You also have an option to assign a VLAN ID to each interface. If you use VLANs for segregating traffic within the ESX/i Server or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations. Default value: none provided Default gateway Provide the IP address for the default gateway. Default value: none provided Primary DNS server Provide the IP address for the primary DNS server. Default value: none provided Administrator username (ID) and password The password you assign here will also be used for accessing enable mode in the CLI. Enable mode allows the user to make configuration changes. Default username: admin Default password: none provided Use the instructions below for performing initial configuration on the ProxySG VA. Completing Initial Configuration Step 1 Verify that your ProxySG VA is powered on. a. b. Log in to the ESX/i Server using your VMware client. Check for power on status. If the ProxySG VA is powered on, a green arrow appears next to its virtual machine name.
Step 2 Access the virtual console of the ProxySG VA on a. Select the ProxySG VA on the ESX/i Server. the ESX/i Server. b. Select the Console tab and click inside the console window to activate your mouse. Step 3 The appliance serial number has 10 digits. It is a. Enter the appliance serial number at the prompt. unique for each appliance and must be used on only one ProxySG VA. See "Retrieve Appliance Note The leading zeroes are significant for Serial Numbers" on page 2-13. serial numbers. Enter all 10 digits at the prompt. b. Press Enter.
4 - 24
Completing Initial Configuration (Continued) Step 4 Follow the prompts and enter the details in the a. set-up script. Press Enter three times to activate the serial console. To release the mouse from the VMware clients Console tab, press the Ctrl and Alt keys on your keyboard.
Note
b.
Step 1: For the question How do you plan to configure this appliance? select your
preference for either configuring the ProxySG VA manually or using Director, If using Director, you must assign a registration password on Director and enter the password in the set-up console, when prompted. For information on setting up a registration password, refer to the Blue Coat Director Configuration and Management Guide. c.
Step 2: For the question Which solution would you like to implement? press Enter to
accept the auto-selected value (Acceleration). d. Step 3: For the question How will you deploy this appliance? press Enter to accept the auto-selected value (WCCP) e.
Step 4: (Optional) Enter an appliance name
for the ProxySG VA. The default value is ProxySG VA serial number. This name helps identify the appliance when you log in to the appliance using a Web browser. The name displays on your Web browser and on the banner on Blue Coat Sky. f.
Step 5: Add the IP address and subnet mask for two interfaces WAN and LAN on your ProxySG VA.
Note
You will also be asked if you want to assign a VLAN ID to each interface. If you use VLANs for segregating traffic within the ESX/i Server or across your network, you must enable VLAN trunking on all interconnecting devices such as switches or routers. This guide does not include information on VLAN configurations.
4 - 25
Completing Initial Configuration (Continued) Setup script continued g. Step 6: Add the IP address for the default gateway. h. Step 7: Add the IP address for the DNS server. i.
Step 8: Change the username for
administrative access privilege. k. Step 10: Confirm that you would like to activate acceleration after you configure WCCP. Step 5 Verify the configuration settings. a. b. c. Step 6 Enable return to sender (RTS) for Inbound and a. Outbound requests. Inbound RTS is enabled by b. default, but you must enable RTS for Outbound. c. Note RTS configures the ProxySG to send response packets back to the same interface that received d. the request packet. e. f. Look over the configuration settings displayed on the screen. To modify a setting, follow the onscreen prompts. Press Enter to save the settings. Press Enter three times. Enter 1 to go to the command line interface. At the console prompt, enter enable and type the enable password when prompted. Enter conf t. The (config) prompt displays. Enter the following command:
return-to-sender outbound enable
#(config)show return-to-sender
Return to sender: Inbound sessions: enabled Outbound sessions: enabled Overwrite static route entry: disabled Version: 2
a. b.
Press Ctrl and Alt to release the mouse from the Console. Click any other tab in the VMware client (such as Summary).
4 - 26
or
https://192.168.16.10:8082/sky
To access the Management Console directly, enter the following URL in your Web browser: https://<ProxySG_IP_Address>:8082/mgmt For example, https://192.168.16.10:8082/mgmt Before you can accelerate traffic in your network, you must obtain and install the license for the ProxySG VA and configure WCCP for transparent redirection of traffic to the ProxySG VA. When you log in to Blue Coat Sky, two alerts are displayed, one for licensing the appliance and the other for configuring WCCP. Use the following instructions to complete initial configuration on the ProxySG VA. Accessing Blue Coat Sky Step 1 Access Blue Coat Sky. Enter the IP address of the ProxySG VA into the Web browser. For example:
https://192.168.16.10:8082
or
https://192.168.16.10:8082/sky
The WCCP configuration incomplete dialog box displays. Step 2 Close the WCCP configuration incomplete dialog a. box. (You will configure WCCP later.) Step 3 View the alerts and proceed with additional configuration tasks. a. b. Click Do it Later. On the Monitor tab, view the messages in the Alerts panel. Perform the following tasks: Click the license alert to retrieve the license for the ProxySG VA. See Register and License the ProxySG VA on page 4-28. Click the WCCP alert to configure WCCP on the ProxySG VA. See Configure WCCP on page 4-31.
Note
Before you can accelerate traffic in your network, you must complete both tasks: licensing and WCCP configuration.
4 - 27
Supported Licenses
The ProxySG VA supports only the Blue Coat MACH5 Edition license which allows acceleration of HTTP, FTP, CIFS, DNS, email, and streaming protocols. Security-related features are not included. The ProxySG VA also includes an SSL license for intercepting SSL traffic. The following license components are not supported:
4 - 28
Licensing the ProxySG VA Step 2 Install the ProxySG VA license. a. In the Install License panel, enter your BlueTouch Online credentials (User ID and Password). Click Submit credentials and install license. After a moment, the message License installed successfully displays. Click OK. Refresh your browser. (The licensing information may not display until you refresh the browser.) The ProxySG VA model number displays on the banner, in place of the Unlicensed message.
b.
b.
Return to the Licensing configuration page. The Type now reflects the license type: SGOS 5 MACH5 Edition, and the Expiration Date indicates when your license subscription will expire.
Note
For 90 days before the license expires, Blue Coat Sky and the Management Console alert you that the license will be expiring. If your license expires before you have renewed the subscription, the ProxySG VA will cease to optimize your network traffic; all traffic will be bypassed. Therefore, it's important that you renew your license during the warning period so that you never lose functionality.
4 - 29
Manually Licensing the ProxySG VA Step 1 Log in to Blue Coats licensing portal. a. From a workstation with Internet access, use a Web browser and navigate to
https://bto.bluecoat.com/licensing
b. c.
Click License a Proxy on the page that displays. Use your BlueTouch Online credentials to log on to the License Configuration and Management System portal. A list displays all Blue Coat appliances registered to this BTO account. Click on the appropriate virtual appliance serial number. Select Manage Software Serial Numbers. The License Self-Service page displays. Click Get License. The Get License link is located in the Cust Info > Links tab. A new window displays with the .bin LKF file.
Step 2 Download the License Key File for the ProxySG a. VA. b. c.
d. Verify that the serial number is correct and save the LKF on a local directory or a Web server. Step 3 Manually install the License Key File. a. b. In Blue Coat Sky, select Configure > Device > Licensing. In the Manually install a new license section, select one of the following:
URL Enter the address/name of the web
server and the path to the License Key File; then click Upload and install.
Local file Click Browse and install and locate the License Key File; then click Open. Text editor Paste in the contents of the License Key File; then click Install. (You need to open the .bin file in a text editor, such as Notepad.)
4 - 30
Manually Licensing the ProxySG VA Step 4 Verify that your license is installed. a. Refresh your browser. (The licensing information may not display until you refresh the browser.) The ProxySG VA model number displays on the banner, in place of the Unlicensed message.
b.
Return to the Licensing configuration page. The Type now reflects the license type: SGOS 5 MACH5 Edition, and the Expiration Date indicates when your license subscription will expire.
Note
For 90 days before the license expires, Blue Coat Sky and the Management Console alert you that the license will be expiring. If your license expires before you have renewed the subscription, the ProxySG VA will cease to optimize your network traffic; all traffic will be bypassed. Therefore, it's important that you renew your license during the warning period so that you never lose functionality.
Configure WCCP
WCCP is a routing protocol that allows certain Cisco switches and routers to transparently redirect traffic to a caching device such as the ProxySG VA. To facilitate transparent traffic redirection and service requests from clients, you need to configure both the WCCP-capable switch or router and the ProxySG VA to participate in a service group scheme. A service group is established when the WCCP-capable device and the ProxySG VA are able to discover, advertise, and verify connectivity to each other. To configure WCCP, perform the following tasks:
Plan two service groups for redirecting traffic between the ProxySG VA and the WCCP-capable switch or router. On the ProxySG VA and the WCCP-capable device, you must create two service groups to redirect traffic from the WAN and the LAN to the ProxySG VA. See Overview on page 1-5, for a network diagram. Creating separate service groups allows you to segregate WAN and LAN traffic and helps you monitor the performance of LAN and WAN traffic on your network. Determine the WCCP capabilities that your switch or router supports. The packet forwarding and return mechanism (L2 or GRE) that you choose for redirecting traffic between the switch or router and the ProxySG VA must be supported on your switch or router. Refer to your switch or router documentation for details. Configure your router with the service groups, define the unicast or multicast addressing scheme, and enable WCCP. For a sample router configuration, see Configure WCCP on the Router on page 4-32. Configure WCCP on the ProxySG VA. See Configure WCCP on the ProxySG VA on page 4-32.
For more information on configuring WCCP on the ProxySG VA, refer to the WCCP Reference Guide at
https://bto.bluecoat.com/documentation/pubs/ProxySG
4 - 31
For planning the service groups in your configuration, use the empty Worksheet for Configuring WCCP (Blank) on page A-2. For a sample completed worksheet, see Worksheet for Configuring WCCP (Sample) on page A-3.
Use the following instructions to configure WCCP on the ProxySG VA. Configuring WCCP for Traffic Redirection Step 1 Access Blue Coat Sky. Enter the IP address of the ProxySG VA into the Web browser. For example:
https://192.168.16.10:8082
Click the WCCP message in the Alerts panel. or Select Configure > Network > WCCP.
4 - 32
Configuring WCCP for Traffic Redirection (Continued) Step 3 Enable WCCP. Select Enable WCCP.
Click Add new pair. The WCCP Configuration Pair details display.
4 - 33
Configuring WCCP for Traffic Redirection (Continued) Step 5 Define your service groups for the LAN to WAN a. and the WAN to LAN interfaces and apply the respective service group to each interface of the ProxySG VA. Select the interface on the ProxySG VA from the drop-down list. For example, the LAN to WAN interface handles LAN traffic that is redirected from the router to the ProxySG VA. For example:
1:0 (192.168.16.10)
b.
Make sure the Same for the pair check box is selected. This selection retains identical settings for router IP address, forwarding and returning type configuration on both service groups of the ProxySG VA. Add the unicast address in the Home Router IP field to establish and maintain the service group. The home router address that you use for a service group on the ProxySG VA should match the IP address that the ProxySG VA uses to communicate with the router. The ProxySG VA and the router use this IP address to communicate WCCP messages with each other.
c.
d. Select the forwarding method and returning method: GRE (default) or L2. Forwarding type defines the method that the router uses to redirect traffic to the ProxySG VA. Returning type defines the method that the router uses to return bypassed packets to the ProyxSG VA. If you select GRE forwarding, GRE returning is auto selected. With L2 forwarding, you can select either GRE return or L2 return. e. Enter the Service group number for the LAN to WAN interface; this number needs to match what was configured on the router. Enter the Service group number for the WAN to LAN interface; this number also needs to match the router configuration. Click to expand the More Settings panel for both LAN to WAN and WAN to LAN traffic. Make sure to leave TCP ports to redirect at its default setting (All ports). b. Step 7 Save the settings. a. Use the help button for an explanation of any of these settings. Click Commit all. (You may need to scroll up to see the button.)
f.
Step 6 (Optional) Change advanced settings if a. necessary. For example, use these instructions to change the default assignment type.
4 - 34
Viewing WCCP Service Group Status Step 1 View WCCP status. a. b. Step 2 Verify WCCP status. Navigate to the Configure > Network >
WCCP page.
WCCP is enabled. Each service group is in the Ready state. The overall status is All Ready. Messages are being sent to the router (Here I
Am sent) and received from the router (I See You received). These statistics are updated
every minute. If a service group state is not Ready, see "About Service Group States" on page A-1 for descriptions of other states.
4 - 35
Verifying Acceleration
Use the steps below to verify that network connectivity is uninterrupted and intercepted traffic is being accelerated and optimized.
Verify Performance Step 1 Verify that the ProxySG VA is in acceleration mode. a. b. In Blue Coat Sky, select Configure > Acceleration > Traffic Management. If necessary, select Acceleration Mode and click Commit all.
Step 2 Verify that the services enabled on your ProxySG VA are being accelerated.
Select Report > Intercepted Connections to view the sessions that are being intercepted and optimized by the ProxySG VA.
4 - 36
Verify Performance Step 3 Verify traffic optimization. Select Monitor and view the graphs for details on traffic or services that are being intercepted.
Bandwidth Usage by Service: Displays the top four services that use the most bandwidth, and aggregates all other traffic in to the label Other. The gray area, Transmitted, is the rate of server data that was transmitted over the WAN after optimization. The yellow area, Savings, represents the rate of traffic that didnt need to traverse the WAN due to optimization (client server). The blue area, Bypassed, is the rate of traffic that was not controlled by the ProxySG VA. Transfer, Reduction, Gain statistics are also displayed.
Bandwidth Usage Overview: Displays a pie graph of the four top bandwidth-using services and aggregates all other intercepted traffic into a slice labeled Other. The overall statistics for the time period aggregates the traffic and calculates the acceleration benefit during the graphing time period.
Optimized Throughput: Displays a bar graph to compare the transmission rate of optimized traffic versus unoptimized traffic for a specific time period. The report calculates average bandwidth reduction, peak reduction, and gain. You can also include bypassed traffic in this graph.
4 - 37
Backing up the system Upgrading the server software Taking the server offline for maintenance Migrating the ProxySG VA to a different server Installing additional or higher-capacity drives on the ESX/i host Adding a serial port to the ProxySG VA Upgrading the virtual appliance model
Shutting Down the ProxySG VA Step 1 Save all configuration changes and shut down. a. b. In the Blue Coat Sky Configure tab, click Commit all to save all configuration changes. Click Shut down, a link on the right side of the banner. The Shut Down ProxySG VA dialog box displays.
c.
To power the system back on, you need to use your VMware client. See "Power on the ProxySG VA" on page 3-22.
4 - 38
Next Steps
Next Steps
You have completed configuring and verifying your initial configuration on the ProxySG VA. For further information, use the context-sensitive online help in Blue Coat Sky or the Management Console. You can also refer to the following documents at:
https://bto.bluecoat.com/documentation/pubs/ProxySG
Acceleration Deployment Guide for deployment information. ProxySG Administration Guide for complete product documentation on SGOS. WCCP Reference Guide for comprehensive information on WCCP concepts and configuration tasks.
4 - 39
Next Steps
4 - 40
Description The router does not support the assignment type (hash or mask) that is configured for the service group. The home-router specified in the service group configuration does not match the actual router ID. The ProxySG VA listed in the service group does not match the one specified on the router. The WCCP configuration includes capabilities that the router does not support. WCCP was just enabled and the ProxySG VA is getting ready to send out its first HERE_I_AM message. The ProxySG VA cannot send the HERE_I_AM message because the interface link is down. The ProxySG VA received the I_SEE_YOU message from the router but has not yet negotiated the service group capabilities. The ProxySG VA sent the HERE_I_AM message and is waiting for an I_SEE_YOU message from the router. The router does not support the forwarding method (GRE or L2) that is configured for the service group. The router does not support the return method (GRE or L2) that is configured for the service group. The service group formed successfully and the ProxySG VA sent the REDIRECT_ASSIGN message to the router with the hash or mask values table. The router and the ProxySG VA have a mismatch in port, protocol, priority, and/or other service flags. The service group passwords on the router and the ProxySG VA do not match.
Bad router id
Capability mismatch
Initializing
Negotiating assignment
Negotiating membership
Ready
Security mismatch
A-1
Service Group ID: Router Configuration for Service Group Router Name: Interfaces to Redirect: ProxySG VA Configuration for Service Group ProxySG VA Interface: 1:0 (LAN to WAN) Protocol: 6 (TCP) ProxySG VA-Facing Interface: Redirect Direction
In Out
Ports to Redirect: All HTTP (80) HTTPS (443) CIFS (139, 445) RTSP (554) Other Priority (0-255): Forwarding/Return Method: 0 Home Router IP Address: Assignment Type:
Hash Mask
Source IP Dest IP Source Port Dest Port Did you check whether settings are compatible with router hardware/software? Yes No
Field to use in Assignment Type Algorithm: Service Group ID: Router Configuration for Service Group Router Name: Interfaces to Redirect: ProxySG VA Configuration for Service Group ProxySG VA Interface: Protocol: ProxySG VA-Facing Interface: Redirect Direction
In Out
Ports to Redirect: All HTTP (80) HTTPS (443) CIFS (139, 445) RTSP (554) Other Priority (0-255): Forwarding/Return Method: Home Router IP Address:
Assignment Type:
Hash Mask
Source IP Dest IP Source Port Dest Port Did you check whether settings are compatible with router hardware/software? Yes No
Field to use in Assignment Type Algorithm:
A-2
Service Group ID: 10 Router Configuration for Service Group Router Name: Interfaces to Redirect: ABC GigE 0/1 ProxySG VA-Facing Interface: Redirect Direction GigE 0/0
In Out
ProxySG VA Configuration for Service Group ProxySG VA Interface: 1:0 (LAN to WAN) Protocol: TCP
Ports to Redirect: All HTTP (80) HTTPS (443) CIFS (139, 445) RTSP (554) Other Priority (0-255): Forwarding/Return Method: 1 Home Router IP Address: Assignment Type: 192.168.16.1
Hash Mask
Source IP Dest IP Source Port Dest Port Did you check whether settings are compatible with router hardware/software? Yes No
Field to use in Assignment Type Algorithm: Service Group ID: 11 Router Configuration for Service Group Router Name: Interfaces to Redirect: ABC GigE 0/2 ProxySG VA-Facing Interface: Redirect Direction GigE 0/0
In Out
ProxySG VA Configuration for Service Group ProxySG VA Interface: 0:0 (WAN to LAN) Protocol: TCP
Ports to Redirect: All HTTP (80) HTTPS (443) CIFS (139, 445) RTSP (554) Other Priority (0-255): Forwarding/Return Method: 1 Home Router IP Address: Assignment Type: 192.168.16.1
Hash Mask
Source IP Dest IP Source Port Dest Port Did you check whether settings are compatible with router hardware/software? Yes No
Field to use in Assignment Type Algorithm:
A-3
A-4
You must have a valid, unexpired license to upgrade your virtual appliance software. If your ProxySG
VA license has expired, you need to renew your subscription with Blue Coat Systems before you can upgrade the software.
The first SGOS version that supports the virtual appliance is 5.5.2.1. You can only upgrade to versions
higher than 5.5.2.1.
The procedure for upgrading a virtual appliance is the same as for upgrading a physical appliance. See
the Blue Coat SGOS 5.5.x Release Notes for details.
You download the image for the ESX Server, instead of a hardware model (such as 810). All ProxySG VA models use the same image; in other words, there are not separate image files for each
ProxySG VA model (VA-5, VA-10, and so forth).
When upgrading the software, you do not need to download and install a Virtual Appliance Package
(VAP). VAPs are used for initial configuration only.
B-1
B-2