> ## Documentation Index > Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt > Use this file to discover all available pages before exploring further. # WCCP WCCP works with WCCP routers to redirect traffic to SafeSquid without setting a proxy in each browser. The router intercepts traffic and hands it to SafeSquid, so clients need no proxy configuration. The router or switch, not SafeSquid, decides which packets get redirected, based on the service group both sides have agreed on — SafeSquid's role is to register itself with the router(s) as willing to serve one or more service groups, describe which traffic it wants redirected, and accept and process the redirected packets. **Confirm WCCP redirection works on your build before relying on it.** Legacy SafeSquid documentation states WCCP redirection is broken and recommends explicit proxy configuration instead. That claim could not be confirmed or refuted against build `2026.0627.1344.3` — the console exposes the section normally, but a working router is needed to test redirection end to end. **Missing:** the functional status of WCCP redirection in the shipping build. Test redirection in a lab with a real WCCP router before committing to it in production, and keep an explicit-proxy or PAC fallback ready. Escalate to engineering rather than treating the section's presence in the console as proof it works. ## Globals / subsections **Enabled** (global master switch, `FALSE` by default) and **WCCP policies** (the policy rows). ## Processing All enabled WCCP policies can be used for router communication. Traffic selection is described two ways at once: **Application Protocol** tells SafeSquid which protocols it expects (HTTP, HTTPS, FTP, SFTP), while **Ports** further restricts redirection to specific TCP ports or ranges. Both need to reflect what you actually intend to intercept, or traffic the router captures may not be what SafeSquid expects on this entry. ## Schema Fields ### Global fields * **Enabled (enabled)** — Master switch for WCCP router communication. ### Policy rows * **Enabled (enabled)** — Enable or disable this policy. * **Comment (comment)** — Explains the entry's purpose for future readers. * **Proxy host (proxyhost)** — Regex matching the proxy hosts this entry applies to. Useful when one configuration file is shared between several proxy servers. * **WCCP Version (wccp\_version)** — `WCCPV1` or `WCCPV2`. * **Router IP Address (router\_ip)** — Router addresses SafeSquid interacts with for transparent redirection. WCCP v1 allows a single router per service group; v2 allows multiple. * **Application Protocol (traffic\_capture)** — Traffic type the routers redirect: `HTTP`, `HTTPS`, `FTP`, `SFTP`. `HTTP` and `HTTPS` are on by default; `FTP` and `SFTP` are off by default. * **Service Type (service\_type)** — `WELLKNOWN` (predefined, needs no service definition) or `DYNAMIC` (you define the service group with a service ID and parameters). * **Service Group ID (service\_id)** — Service ID of the service group. **Must be between 97 and 255.** * **Service Group Name (service\_name)** — Name of the service group. * **Security (security)** — `NOSECURITY` or `MD5SECURITY` for packet authorization. `NOSECURITY` needs no password. * **Encrypted Password (enc\_pwd)** — Encrypted password for packet authentication. Required when Security is `MD5SECURITY`. * **Acceptable Forward Method (forward\_method)** — How the router transfers packets to SafeSquid: `GRE` (default) or `L2`. Layer 2 requires supporting network architecture. SafeSquid negotiates with the router for a supported method if its preferred one isn't supported. * **Acceptable Assignment Method (assignment\_method)** — Method used when SafeSquid becomes the designated proxy: `HASH` or `MASK` (default, confirmed live on build `2026.0627.1344.3` — a brand-new, unsaved policy entry pre-fills `MASK`). * **Acceptable Packet Return Method (packet\_return\_method)** — How SafeSquid returns packets to the router: `GRE` (default) or `L2`. * **Ports (portrange)** — Comma-separated list of ports or port ranges this entry applies to. WCCP v2 allows up to 8 ports. * **Network Protocol (network\_protocol)** — `TCP` or `UDP`. SafeSquid informs the router of this selection. Both `TCP` and `UDP` are enabled by default. * **Webcache IP Address (webcache\_ip)** — SafeSquid addresses that interact with the WCCP routers. Must be an address SafeSquid is genuinely listening on — this is the address the router actually redirects traffic to. ## Important entry fields * **Service Group ID** — Values outside 97–255 are invalid. Coordinate the ID with the network team so it matches the router's service group. * **Security / Encrypted Password** — Set both together. `MD5SECURITY` without a password fails packet authentication. * **Acceptable Assignment Method / Acceptable Packet Return Method** — Do not select `GRE` as the return method when the assignment method is `L2`. * **Acceptable Forward Method / Acceptable Packet Return Method** — Configured independently and don't have to match — but a common misconfiguration is selecting one method as the assignment/forward choice while still expecting the other as the return method, when the router's own capabilities don't actually support that combination. Confirm supported forwarding and return methods with the router's own documentation and the network team. * **Router IP Address / Webcache IP Address** — Both sides of the relationship. The router list must match the service group configured on the router itself. ## Examples ### A standard well-known HTTP/HTTPS redirection Enabled on, WCCP Version v2, one router address, Application Protocol HTTP and HTTPS, Service Type WELLKNOWN, Security NOSECURITY, default forward/assignment/return methods, Network Protocol TCP, Webcache IP Address the appliance's client-facing address. The shape of the most common single-router deployment. ### A custom dynamic service group with authentication Service Type DYNAMIC, Service Group ID `98` (agreed in advance with the network team and matched on the router), Service Group Name `SafeSquid-Web`, Security MD5SECURITY with an Encrypted Password matching the router's secret, two routers listed under WCCP v2. Needed whenever the well-known service group doesn't fit — for example redirecting only a specific port range. ### Restricting to specific ports Ports `8081,9000-9010` alongside Application Protocol HTTP. Only traffic on those ports is what SafeSquid told the router it wants for this entry; standard port 80 would need a separate entry or need to be added to this entry's Ports list. ## How to verify The checks below confirm the configuration is complete, not that transparent redirection is actually working end to end — see the reliability warning above. 1. Confirm the global Enabled switch and the entry's own Enabled switch are both on. 2. Confirm the Service Group ID (dynamic service) and any Encrypted Password (MD5 security) exactly match what's configured on the router side — SafeSquid does not surface a clear mismatch error in the Web UI. 3. Work with the network team to confirm, from the router or switch's own status output, that it has actually formed the service group and is redirecting matching traffic. 4. Once redirected traffic is confirmed arriving, check Detailed logs for those transactions the same way as explicitly-proxied traffic. 5. Re-confirm the whole chain after any router firmware change, network re-addressing, or SafeSquid version update. ## Notes Coordinate service group IDs and passwords with the network team. The **Enabled** global is `FALSE` on a default appliance, so WCCP does nothing until it is switched on. Most WCCP failures come from the two sides of the negotiation (router configuration and this Web UI section) drifting out of agreement, not from either side being wrong in isolation. ## See also * [network](/configuration/application_setup/network_settings_and_listeners) * [integrations](/configuration/start_here/integrations) * [Architecture](/configuration/start_here/architecture) * [Logging](/configuration/start_here/logging)