Cisco Wide Area Application Engine 612 Manual de usuario descargar pdf (Pagina 33)

Interception Techniques and Protocols 107

The keepalive frequency is conﬁgurable between 1 and 10 seconds. The default failover

timer is set to 3 seconds. The transition between intercept operating mode and bypass

operating mode does cause a momentary loss of line protocol. If one or more of the inline

ports are connected to a LAN switch, this transition in interface state can cause the Spanning

Tree Protocol (STP) recalculation. To prevent the STP calculation from interrupting trafﬁc

forwarding, the switchport connected to the inline module on the WAE should have the STP

PortFast feature enabled. Failure of a single inline port in the group is propagated to the

other port in the group. For example, if the LAN0 port in InlineGroup 1/0 goes down, the

WAE will take down line protocol on the WAN0 port in the same inline group. This prop-

agation of interface state between the ports in the same inline group prevents situations

where adjacent devices connected to an operational InlinePort believe the network path to be

online and usable, when in reality the connection on the other side of the WAE is unavailable.

When a WAE is deployed physically inline, all trafﬁc between the two network elements

will be seen by the WAE. Non-TCP trafﬁc is bridged through the inline module without

modiﬁcation. In addition, packets associated with a connection that was ﬁrst seen on the

opposite inline port in a group are bridged. This type of trafﬁc ﬂow is common when a WAE

is deployed inline on a trunk between a router and LAN switch. If the router is providing

routing for trafﬁc going between VLANs locally, it is possible for trafﬁc to traverse the

inline module twice. Figure 4-15 shows an example of this type of trafﬁc ﬂow.

Figure 4-15 Physical In-Path Deployment with One-Armed Routing

The inline module also supports 802.1Q trunk connections between the two network

elements. An added beneﬁt to using the inline module is the ability to deﬁne which VLANs

are evaluated for interception. Trafﬁc that is received by the inline module tagged with a

802.1q Trunk

WAN

1 2 ... 28 29 30 31 32 33 34 35 36 37 38 39 40 41

Sin comentarios

Cisco Wide Area Application Engine 612 Manual de usuario Pagina 33