10 Replies Latest reply: May 15, 2012 10:20 AM by biggybiggy RSS

    wccp redirect


      I have a Catalyst 3560 directly connected to the Websense and my users are in vlan1. the connection between my switch and the websense is in vlan3 and that's what it should be for wccp to work. So if I understand correctly, wccp L2 only works for local users; users who are assigned to the vlan configured on the switch that is directly connected to the Websense. How about if I have another users on a different vlan? HOw will they be redeitected to the Websense? Thx

        • 1. Re: wccp redirect
          Steven Williams

          Where are you applying your WCCP redirect command? There are two ways you can approach this, you can configure the redirect on the outbound interface/vlan that leads to the internet, which is not the preferred way to do this. The other way is to confgure the WCCP redirect on every inbound interface to the 3560. So if Vlan3 is the outbound interface to the Internet and Vlan1 and Vlan2 are internal Vlan's you would configure the WCCP redirect on both vlan1 and vlan2 SVI.


          you would use this command:


          ip wccp (Service#) redirect in

          • 2. Re: wccp redirect

            i am using redirect in on vlan1 on the 3560. My vlan3 is on a Cisco 1841 router.


            1841 with vlan3 configured as fa0/0.3 with encapsulation dot1q to switch1.


            1841 - vlan3 (fa0/0) <--> (fa0/1)2960 switch1 (gig0/1)<--> (fa0/5) 3560 - vlan1(fa0/24) <-- websense)

            • 3. Re: wccp redirect
              Steven Williams

              so your layer 3 routing is being done on the 3560?

              • 4. Re: wccp redirect

                yes. I have svi configured for vlan1. the 1841 router has also svi conifgured with router on a stick fashion.

                • 5. Re: wccp redirect
                  Steven Williams

                  Ok so same rule would apply if you have an SVI for any other vlan you are going to create. All the redirect commands will be configured at the layer 3 SVI on the 3560.

                  • 6. Re: wccp redirect

                    ip wccp redirect in is configured in vlan1. So do I need to conifgure ip wccp redirect in for vlan 3 on the 1841 as well?

                    • 7. Re: wccp redirect
                      Steven Williams

                      Depends on the network layout. what is the IP of your websense appliance? what vlan is your websense appliance on? Does all traffic from the 3560 become vlan 3 when it leaves the 3560 to the 1841?

                      • 8. Re: wccp redirect

                        Per Cisco recommendation, the websense interface and the 3560 interface is in the same vlan & same subnet. vlan 3 is defined in the 1841 router. vlan 1 is defined on the 3560.

                        I am a bit confused about wccp. wccp only redirects traffic locally, meaning users within the vlan defined on the switch where wccp is configured. Correct?

                        • 9. Re: wccp redirect
                          Steven Williams

                          I do not understand what you mean when you say redirects traffic locally?


                          So like for me I have multiple Layer 3 links out to multiple locations via P-to-P fiber. All connections from all locations come back to my 6500 Core switch. I enable WCCP redirect on the inbound interfaces on the Core from those locations. Then the traffic comes into the core, is redirected for my WCCP function and then is either permitted or denied, if denied is then served a deny page from my web filter.

                          • 10. Re: wccp redirect

                            I understand your setup. With my setup, I configured wccp redirection for vlan1 on my 3560 (which is my core). But my vlan 3 is defined on the router. I have a static route from the router to the firewall and the router is connected to another switch then the 3560. So it is comunicating at layer 3 from the router to the 3560. So my assumption is to configure wccp redirection on the interface where the router traffic is coming in, which is fa0/5. But the 3560 does not support wccp redirect command on the interface.