Two Box Mode
Two box mode is a WCCP one-arm based deployment where the SD-WAN SE appliance acts as a WCCP router and the SD-WAN WANOP (4000/5000/4100/5100) appliances act as WCCP clients and help establish WCCP convergence. This way all the virtual path/Intranet service oriented TCP packets reaching the SD-WAN SE appliance get redirected to the SDWAN-WANOP appliance for optimization benefits thereby providing both SD-WAN SE and WANOP benefits for the customer traffic.
Two Box mode is supported only on the following appliance models:
- SD-WAN SE appliances – 4000, 4100, and 5100
- SDWAN-WANOP appliances – 4000, 5000, 4100, and 5100
High Availability and WCCP deployment modes are not accessible when Two Box mode is enabled. However, these deployment modes will be available for the user to administer.
- Although the legacy WCCP deployment is disabled when Two Box Mode is enabled, the Service Group convergence can only be verified from the WCCP monitoring page. There is no separate GUI page under the monitoring section for the Two Box Mode.
- If WCCP process running on the Standard Edition appliance reboots multiple times within a short interval of time, for example; 3 times in a minute then Service Group shuts down automatically. In such scenario, to get the WCCP convergence on the WANOP appliance, re-enable the WCCP feature in the WANOP appliance web GUI.
- When there is a change in the WCCP configuration or WAN optimization related to configuration on the Standard Edition appliance, the external WANOP appliance reboots. For example, enabling/disabling the WCCP checkbox in the Interface Group of config editor followed by Change Management process, restarts the WANOP appliance as well.
Also, note the following points to consider when implementing the two box mode:
- When a routing domain is selected to be redirected to the WANOP appliance from the Configuration Editor, it should be added in the Interface Group for which WCCP is enabled.
- The same routing domain’s traffic should be selected on the partner site as well. For example; MCN > Branch01 to observe WAN optimization benefits.
- If a routing domain is selected in the interface group on which WCCP is enabled, another interface group which contains the bridged interfaces should have the same routing domain configured. Only if WCCP enabled interface group has the routing domain configured it is not enough to transmit the end-to-end traffic flowing with WAN optimization benefits.
NetScaler SD-WAN Standard Edition
To configure two-box mode solution in the Standard Edition appliance at the DC or Branch site:
In the NetScaler SD-WAN SE web management interface, go to Configuration > Virtual WAN > Configuration Editor. Open an existing configuration package or create a new package.
In the chosen configuration package, go to the Advanced tab to view the configuration details.
Open Global settings and expand Routing Domains to view that the Redirect to WANOP checkbox is enabled.
Expand DC to enable WCCP for the Virtual Interface under Interface Group settings that will signify which virtual network interface the appliance will be enabled for.
Expand Sites+ Add to view the Branch routing domain and interface group settings. Under the Branch site, the Redirect to WANOP checkbox is enabled for Routing Domains.
The WCCP listener should be enabled only for those virtual network interfaces which have only ONE Ethernet Interface configured. This indicates that WCCP Listener should not be enabled on a BRIDGED Pair. It is intended to be enabled on the ONE-ARM interface between the SD-WAN SE and SD-WAN WANOP appliances.
NetScaler SD-WAN WANOP Configuration
To configure two-box deployment mode in the SD-WAN WANOP appliance web GUI:
In the NetScaler SD-WAN WANOP web management interface, go to Configuration > Appliance Settings > Advanced Deployments > Two Box Solution.
Click the Edit icon to edit the two box mode settings. Information dialog about Cache IPs is displayed. Click OK.
Enable the Two Box Enabled checkbox.
Enter the Peer IP. Peer IP is the Netscaler SD-WAN Standard Edition appliance IP address.
Enter the user credentials and click Apply.
Two Box Mode Configuration and Manageability
Following are some of the two box mode configuration and manageability points to consider for deployment:
SD-WAN WANOP configurations mentioned below can be configured from SD-WAN SE configuration editor as a unified pane
You can monitor SD-WAN WANOP traffic directly using the Monitoring page of the SD-WAN SE appliance’s web UI. This allows for a single pane monitoring of both the SDWAN-SE and SDWAN-WO appliances while processing data traffic. You can view the connection details, secure partner details and so on under the WAN Optimization node in the SDWAN-SE UI.
You can configure APPFLOW directly from the SD-WAN-SE Configuration page under APPFLOW node. This enables SD-WAN-SE to act as a single pane for configuration of APPFLOW and other data processing configuration attributes such as Service Class, Application Classifiers and so on. The configuration done on the SD-WAN-SE reflects on the SD-WAN-WO configuration, maintaining seamless APPFLOW functionality support.
SD-WAN WANOP already discovered by an insight center, if used in Two Box Mode should be isolated and not configured using MAS/Insight until this mode is turned off. This is because the configuration of WANOP for traffic processing is governed by the SD-WAN SE appliance in the Two Box Mode.
Advanced Optimizations or Secure Acceleration should be directly configured on the SD-WAN-SE appliance like we would configure on the SD-WAN-WO appliance. This helps maintain a single pane of configuration of configurations like Domain Join or Secure Acceleration/SSL Profile creation for Advanced optimizations or SSL Proxy.
Licensing should be separately managed for each of SD-WAN SE and SD-WAN WANOP appliances.
Software Upgrade should be separately managed for each of of SD-WAN SE and SD-WAN WANOP appliances with the respective software packages. For example, tar.gz for SD-WAN SE and upgrade upg for SD-WAN WANOP.
Data path integration should be configured between SD-WAN SE and External WANOP appliances through the WCCP deployment mode.
At data path level both WCCP and Virtual WAN features are offered through data path integration between WANOP and SE externally in one-arm mode to obtain optimization benefits.
Unified Configuration and Monitoring
When you enable the two box mode with SD-WAN SE and SD-WAN-WANOP appliances, you can view the configuration in the SD-WAN SE appliance similar to how you can view two box configuration with the SD-WAN-EE appliance.
Go to Configuration > Virtual WAN > WAN Optimization
Appflow node under Configuration > Appliance Settings
WAN Optimzation node under Configuration.
This information is redirected from the SD-WAN WANOP appliance which is in Two box mode with the SD-WAN SE appliance.
Configuration related to WANOP, such as SSL Acceleration and AppFlow can now be performed from SD-WAN SE web GUI.
Traffic related statistics, such as Connections, Compression, CIFS/SMB , ICA Advanced, MAPI and partners can now be monitored from SD-WAN SE web GUI under Monitoring > WAN Optimization similar to the SD-WAN Enterprise edition appliance.
Management IP Address Change for SD-WAN WANOP Appliance in Two Box Mode
To change the management IP address of SD-WAN-WANOP appliance in Two box mode:
- Execute command clear_wo_sync on the SD-WAN SE appliance. This ensures that the SD-WAN WANOP IP address information is cleared for GUI redirection.
- Disable and enable Two box mode config on the SD-WAN WANOP appliance. The new IP address (changed IP) of SD-WAN WANOP appliance is sent to SD-WAN SE. The new changed IP address is displayed in the URL redirection pages.
The management IP address is used for peer IP configuration.
Disable Two Box mode on SD-WAN WANOP Appliance
To disable or decouple the SD-WAN WANOP and SD-WAN SE appliances from the Two Box mode:
Disable the Two Box mode from SD-WAN WANOP appliance.
It is expected to still see the SD-WAN WANOP appliance two box mode pages in the SD-WAN SE web GUI. To clear these pages, execute the command: clear_wo_sync.