Manual Chapter : WANJet® Appliance Administrator Guide: 3 - Installation

Applies To:

Show Versions Show Versions


  • 4.2.10, 4.2.3, 4.2.2, 4.2.1, 4.2.0
Manual Chapter



WANJet appliance deployment

This chapter provides conceptual guidelines concerning WANJet appliance installation and configuration. The Quick Start Card included in the shipping box with your WANJet appliance provides the initial hardware installation and setup instructions. You can also find the Quick Start Card on the F5 Networks Technical Support web site,

Types of deployment

Following are the primary ways to deploy a WANJet appliance within a corporate network:

  • Inline deployment, using one of the following configurations:
    • Point-to-point
    • Point-to-multi-point
  • One-arm deployment, using one of the following configurations:
    • Static routing (non-transparent)
    • Static transparent proxy
    • Transparent proxy with WCCP v2 protocol
    • Transparent proxy with GRE encapsulation

The way you choose to deploy the WANJet appliance depends on your current network topology and requirements.

Inline deployment

Inline deployment is the most common way to deploy WANJet appliances. In this configuration, you place WANJet appliances directly in the path of traffic, or inline, between a WAN router and LAN switch.

You can scale inline deployment from a simple point-to-point configuration to a more complex point-to-multi-point configuration.

Point-to-point configuration

Point-to-point configuration is a simple one-to-one topology where you place WANJet appliances at each end of the WAN between their respective WAN routers and LAN switches.

Each WANJet appliance is configured to search for traffic that matches specified source and destination subnets, and ports. If the local WANJet appliance detects a match, it processes the traffic and sends it through a tunnel to the remote WANJet appliance, which, in turn, reverses the process and delivers the packets exactly as they originally were. If there is no match, the local WANJet appliance acts as a bridge, and passes the packets unaltered to the WAN.

Figure 3.1 shows inline deployment with two WANJet appliances in a point-to-point configuration, connecting a corporate data center and one remote office.

Figure 3.1 Inline deployment in point-to-point configuration

Point-to-multipoint configuration

Point-to-multipoint configuration is more complex and involves three or more WANJet appliances. Figure 3.2 illustrates a point-to-multipoint deployment that consists of five appliances that connect to each other across intranets and the Internet.

As with the point-to-point configuration, the WANJet appliance processes traffic that matches user-specified source and destination subnets and ports, and then delivers the traffic across the WAN through a tunnel to the appropriate WANJet appliance.

Figure 3.2 Inline deployment in a point-to-multi-point configuration

One-arm deployment

In certain cases, it is not desirable or even possible to deploy the WANJet appliance inline. For example, in the case of a collapsed backbone where the WAN router and LAN switch are in one physical device, you may not be able to deploy the WANJet appliance inline.

When inline deployment is not an option, you can use one-arm deployment. In this deployment, the WANJet appliance has a single (hence the term one-arm) connection to the WAN router (or LAN switch) and has all relevant traffic redirected to it by the WAN router. Figure 3.3 shows a simple one-arm deployment in a corporation that has two networks. Network 1 includes the servers, and network 2 is where the clients are located.


Figure 3.3 One-arm deployment of WANJet appliance

Figure 3.4 shows the basic topology and traffic flow for a one-arm deployment.


Figure 3.4 One-arm topology and traffic flow

The traffic flow sequence shown in Figure 3.4 is as follows.

  • Step 1: The client initiates a session.
  • Step 2: A WAN router redirects traffic to the WANJet appliance.
  • Step 3: The WANJet appliance processes traffic and sends it back to the WAN router.
  • Step 4: The WAN router forwards traffic across the WAN.

For more information on how to configure one-arm deployment, refer to Configuring one-arm topology , located in Chapter 6.

One-arm deployment methods

You deploy the WANJet appliance using a one-arm configuration in a transparent or non-transparent manner. The transparent method is most common, but there may be certain circumstances when the non-transparent method is more appropriate. This decision depends on your network configuration and specific needs.

As the name implies, the transparent method is totally transparent on the network and requires no modification to any client settings (such as the default gateway). However, you must reconfigure the WAN router.

You can configure the WAN router to redirect traffic by using one of the following methods:

  • Static routing (non-transparent)
  • Static transparent proxy
  • Transparent proxy with WCCP v2 protocol
  • Transparent proxy with GRE encapsulation

Using static routing

Static routing is a non-transparent one-arm deployment most suitable for smaller offices. If using static routing, the WANJet appliance connects to a LAN switch, and the LAN switch connects to all of the clients on the network, as well as to the router. Every client on the LAN uses the WANJet appliance as its default gateway. In this deployment, all client traffic is routed to the WANJet appliance. The WANJet appliance can optimize specific traffic, apply different services to specific traffic, and leave other traffic untouched.

This method is non-transparent because, for this to work, all clients have to be reconfigured to use the WANJet appliance IP address as their default gateway. You can reconfigure the clients by either individually modifying each client's default gateway address or, more typically, by updating the DHCP server to provide the WANJet appliance IP address as the default gateway for all of its DHCP clients. All outbound traffic from any client is then first sent to the WANJet appliance for optimization (or passthrough), and the WANJet appliance, in turn, forwards the traffic to the WAN router.

Static routing supports only one subnet (all clients must be in the same subnet as the WANJet appliance), and there is no redundancy. If the WANJet appliance were to fail, clients would no longer have a way to forward traffic to the WAN, just as if a WAN router failed. In a branch office, where support for multiple subnets and redundancy are not as crucial, this deployment mode may be ideal because its principle benefit is its simplicity. All WAN-bound traffic is automatically sent to the WANJet appliance, which processes it according to defined policies, and sends the traffic on to the WAN. You do not have to reconfigure the WAN router.

In the WANJet appliance Web UI, you set up static routing on the Operational Mode screen by selecting Static Routing as the redirection method.

Using static transparent proxy

If using static transparent proxy, the WANJet appliance connects directly to the router and is transparent to the rest of the LAN clients.

The router (by means of a configured routing rule) directs to the WANJet appliance only traffic that the WANJet appliance is configured to process (optimize or applying specific services). You configure the router not to send passthrough traffic to the WANJet appliance. Otherwise, the WANJet appliance drops the passthrough traffic. In this deployment, the WANJet appliance optimizes traffic according to specified policies and then sends all traffic back to the router.

Using transparent proxy with WCCP v2 protocol

Web Cache Communication Protocol (WCCP) was originally developed by Cisco Systems® to specify interactions between one or more routers (or Layer 3 switches) and one or more devices, such as a web cache. The purpose of the interaction is to establish and maintain the transparent redirection of selected types of traffic flowing through a group of routers. WCCP v2 supports traffic redirection to other devices, such as the WANJet appliance. For detailed specifications about the WCCP protocol, see

The WANJet appliance can use the WCCP protocol to advertise itself to a LAN router as a web cache. Local routers and web caches together form a service group. Routers redirect traffic to the group-member web caches, for example, the local WANJet appliance, in accordance with an algorithm defined for the service group.

The advantage to this deployment method is that it is more tolerant of a failure. If the WANJet appliance fails, the router detects that and handles the traffic properly without sending it back to the WANJet appliance.

If using transparent proxy with WCCP v2 protocol, the WANJet appliance connects to the router directly and is transparent to the LAN clients. You route all LAN traffic to the WANJet appliance just as you do for static transparent proxy.

The difference is that the WANJet appliance communicates with the router using WCCP v2 protocol (the router must support WCCP v2 and you must configure it on the router). In accordance with configured optimization policies, the WANJet appliance determines which traffic to optimize, and which traffic to apply services to. The rest of the traffic is sent back to the router for proper handling.

Using transparent proxy with generic routing encapsulation tunneling

If your network topology uses generic routing encapsulation (GRE), the WANJet appliance may need to process encapsulated traffic within a GRE tunnel. Typically, GRE tunneling connects private IP networks over an Internet connection using two routers (or switches) that support GRE encapsulation.

If you are using GRE tunneling, you can deploy the WANJet appliances using a one-arm configuration so they connect to the routers on both ends of the GRE tunnel. Each router is configured to forward GRE traffic to the WANJet appliance which either optimizes the traffic or sends it through as pass-through traffic.

Figure 3.5 illustrates GRE tunneling and shows how the WANJet appliance optimizes traffic through a TCP tunnel but sends passthrough traffic through the GRE tunnel.


Figure 3.5 WANJet appliance configuration with GRE tunnel

To use this method, on the Operational Mode screen, you select Transparent Proxy as the redirection method and Static as the discovery method on both WANJet appliances. If you are using GRE tunneling, you also need to configure local (source) and remote (destination) GRE IP addresses on both appliances. You set the Local GRE IP (the local end of the GRE tunnel) and Remote GRE IP (the remote end of the GRE tunnel) from the Remote WANJets screen. See Configuring one-arm topology , located in Chapter 6, for more details.

When the WANJet appliance receives a GRE packet and recognizes the local and remote GRE IP addresses included in the header, the appliance processes the original encapsulated packet in accordance with its optimization policies. Traffic that the WANJet appliance can optimize uses the TCP tunnel, and pass-through traffic uses the GRE tunnel.

Firewall guidelines

If the WANJet appliance is placed behind a firewall, you must open certain ports for the WANJet appliance to operate properly. Table 3.1 lists the ports that you must open to allow the traffic to pass through the firewall.

Table 3.1 Ports to open when the WANJet appliance is behind a firewall
Port Number
Used for
A UDP port used for DNS.
A UDP port used for SNMP.
An optional UDP port used for SNMP traps.
A TCP port used for SSH.
A TCP port that you use to connect to the Web UI for managing the WANJet appliance remotely.
The default port that the WANJet appliance uses to send real-time chart data.
The default port that the WANJet appliance uses for managing connections.
The default port that the WANJet appliance uses for TCP data tunnels.
The default port that the WANJet appliance uses to proxy UDP over TCP.


You must also allow the ICMP protocol to pass through the firewall, so that you can ping the WANJet appliance.

Hardware installation

See the WANJet® Appliance Quick Start Card for the WANJet 200, 400, or 500 appliance for instructions on installing WANJet appliances and connecting them to your network. If you have a WANJet 500, refer also to the Platform Guide: WANJet® 500 for additional details on hardware installation.

Site information worksheet

Use the following site information worksheet to capture relevant site data. When you complete the site information sheet, we recommend that you attach a detailed network diagram for each WANJet appliance site.


State/Province, Country:
Contact Person:
Work phone: Cell phone:
Speed in Kb/s:
Utilization %: Peak Average
Make: Model:
IP address:
Routing protocols used:
Static routing table rules:
Make: Model:
IP address:
WANJet Appliance:
Alias: IP address:
Subnet mask:
Default gateway:
Local Networks:
Alias: IP address: Subnet:
Alias: IP address: Subnet:
Alias: IP address: Subnet:
Remote Networks:
Alias: IP address: Subnet:
Alias: IP address: Subnet:
Alias: IP address: Subnet: