ACE 4710 balance among URL

I have ACE 4710 and I need configuration:
I have real web-server with  folders : /1/index.html, /2/index.html, /3/index.html
I need to  balance virtual service:
If I try to connect URL: http://server/index.html,  then ACE balance among
http://real_server/1/index.html,
http://real_server/2/index.html,
http://real_server/3/index.htm
How can I  configure ACE ?

ACE, can't modify the url.
But it can send redirect.
So you could build 3 redirect rservers, and have ACE loadbalance between them.
rserver redirect HTTP-REDIRECT1
  webhost-redirection http://real_server/1/index.html
  inservice
rserver redirect HTTP-REDIRECT2
   webhost-redirection http://real_server/2/index.html
   inservice
rserver redirect HTTP-REDIRECT3
   webhost-redirection http://real_server/3/index.html
   inservice
serverfarm redirect SF_REDIRECT
  rserver HTTP-REDIRECT1
    inservice
  rserver HTTP-REDIRECT2
    inservice
  rserver HTTP-REDIRECT3
    inservice
But even if it works, this does not sound good.
It seems like a design done by an application server person who does not know how network loadbalancers work.
It seems like all you need is stickyness, which you are trying to achieve by redirecting to /1 or /2 or /3.
But this can be done differently with cookies or by just doing stickyness on source ip address.
Gilles.

Similar Messages

  • ACE 4710 - can I dynamically sticky all traffic to 1 server based on URL?

    Hello all, I'm new to the ACE 4710 and need to know some details about stickyness.
    As background, we are a small company with a SaaS product and a pair of webservers.
    I have set up the loadbalancing default L7 Load-balancing rule to sticky based on a Cookie based Stickey Group.
    That seems to be working and session traffic is sticking to a server during the user's session.
    Based on a request from our outsourced developer they would like the Loadbalancer to not only sticky the users sessions, but also sticky a url to a server.
    I would like this to happen dynamically as each of our clients will have their own url based on our standard domain like clientname.fixeddomain.com and I don't want to have to come back to the loadbalancer every time we add a client.
    As I said, I'm new to these devices but understand the concepts, and am in the position of having to make it work little to no tranining on this hardware and no budget at this point to pay someone else for configuration and setup.
    I just need to know at this point if I can stick all requests for a specific URL to a server to avoid caching issue while those sessions are active and have new connections to other client urls balanced among the webservers.
    Hopefully this request makes sense.
    Thanks,
    Mark Steeves.

    Daniel,
    Thanks for the reply, but I cannot reach the URL you included.  It gives me a 403.
    Therfore without reading the article, I wanted to ask if the proper setup would be:
    1. Default L7 load-balancing action: Primary action: Sticky: Stickey Group using
    Type = HTTP Header: Header name = Host
    2. Server Farm: Predictor: Least Connections or Round Robin to distribute the load between the 2 web servers.
    Using this setting in testing, it looks like all the traffic keeps going to 1 server only.  Granted there is not much traffic t the servers, but I have 2 different url being tested. url1.ourdomain.com & url2.ourdomain.com
    If you have another link for the above document, please let me know.
    Thanks,
    Mark Steeves.

  • Configuring ACE 4710 for Load Balancing Speech servers

    Hello, I'm configuring ACE 4710's for the first time and I want to load balance my Nuance speech servers on port 554. Here's my configuration on ACE01:
    hostname ace471001
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      shutdown
    interface gigabitEthernet 1/4
      shutdown
    access-list ALL line 8 extended permit ip any any
    rserver host nss01
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    interface vlan 1000
      ip address 10.20.17.21 255.255.248.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    How would I configure my speech server to isten on 554?
    Thanks in advance

    Hello Reginald
    Currently you have only basic network configuration, there is no loadbalancing config
    I'm not sure what exactly you're asking about , but basically you need to have
    - real servers configured on ACE (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/rsfarms.html#wp999495)
    - serverfarm configured on ACE (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/rsfarms.html#wp1014522)
    - L7 policy map (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1171109 ,
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1027248 )
    - L4 policy map , class-map (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1027819)
    And then apply it on necessary interface.
    This is a general configuration, in your specific case you may need to configure some additinal features (e.g. I think you will need to have stickiness enabled
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/sticky.html but it depends on your application)
    links are for old config guids , but basic is pretty much the same for all versions.
    Please check them and try to narrow down your question a bit.

  • Need help with ACE Load Balancing Base on URL pattern

    This is the first time for me trying to configure something like this on the ACE load balancer.  I need help configuring a load balancing policy base on URL pattern.  URL https://ineedhelp.com base on /willuhelpme and /imlost
    Key: ineedhelp_key
    cert:  ineedhelp_cert
    serverfarmA
    serverA 10.1.1.1 443
    serverfarmB
    serverB 10.1.1.2 443
    ineedhelp.com/willuhelpme-------serverfarmA
    ineedhelp.ocm/imlost---------------serverfarmB

    This is the first time for me trying to configure something like this on the ACE load balancer.  I need help configuring a load balancing policy base on URL pattern.  URL https://ineedhelp.com base on /willuhelpme and /imlost
    Key: ineedhelp_key
    cert:  ineedhelp_cert
    serverfarmA
    serverA 10.1.1.1 443
    serverfarmB
    serverB 10.1.1.2 443
    ineedhelp.com/willuhelpme-------serverfarmA
    ineedhelp.ocm/imlost---------------serverfarmB

  • SIP load balancing issue with ACE 4710

    SIP Load balancing Issue with ACE 4710
    I have a Cisco ace 4710 with vesion Version A4(2.2). i configued simple SIP load balancing first without stickiness. without stikeiness we are having a problem because bye packet at the was not going to the same server all the time that left our port in used even though user hang up the phone. its happen randmly. i have a total 20 licenced ports and its fill out very quickly. so i dicided to use the stickiness with call-ID but still same issue. below is the config
    rserver host CIN-VOX-31
      ip address 172.20.130.31
      inservice
    rserver host CIN-VOX-32
      ip address 172.20.130.32
      inservice
    serverfarm host CIN-VOX
      probe SIP-5060
      rserver CIN-VOX-31
        inservice
      rserver CIN-VOX-32
        inservice
    sticky sip-header Call-ID VOX_SIP_GROUP
      timeout 1
      timeout activeconns
      replicate sticky
      serverfarm CIN-VOX
    class-map match-all CIN_VOX_L4_CLASS
      2 match virtual-address 172.22.12.30 any
    class-map match-all CIN_VOX_SIP_L4_CLASS
      2 match virtual-address 172.22.12.30 udp eq sip
    policy-map type loadbalance sip first-match CIN_VOX_LB_SIP_POLICY
      class class-default
        sticky-serverfarm VOX_SIP_GROUP
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
      class CIN_VOX_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    interface vlan 20
      description VIP_DMZ_VLAN
      ip address 172.22.12.4 255.255.255.192
      alias 172.22.12.3 255.255.255.192
      peer ip address 172.22.12.5 255.255.255.192
      access-group input PERMIT-ANY-LB
      service-policy input GLOBAL_DMZ_POLICY
    could you please help me on this...
    thanks
    Rakesh Patel

    I mean there should be one more statement-
    class-map type sip loadbalance match-any CIN_VOX_LB_SIP_POLICY 
    match sip header Call_ID header-value sip:
    and that will be called under-
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    is that missing in your config ?

  • Setting up additional load balancing on ACE 4710

    I recently deployed ACE 4710 to load balance traffic to a group of web servers. I would like to add additional server farm(s) with different applications on them to ACE 4710 for load balancing the traffic. How can I best achieve this goal? I currently use 3 interfaces out of 4 interfaces (Server Side interface, Client side interface, and Failover interface). Do I need to use my last interface to set up for the new VIP address for a new server farm? Is virtualized service a possible solution? Thank you in advance.

    You can configure trunking so that multiple vlans can exist.
    Also note that the vip ip address does not have to belong to a subnet.
    You could configure a static route on the upstream router pointing the traffic for the new vip to the interface ip address.
    Gilles.

  • TCP SYNSEEN with load balancing Cisco ACE 4710

    I have a Cisco ACE 4710 load balancing the traffic to two proxy servers, the configuration is the same since December 2012,  but yesterday it stated to show SYNSEEN in the show conn command, and the hosts cannot browse. I think that means that the three-way-handshake is not complete.
    If I bypass the ACE the hosts can browse without problems. 
    I have tested with another ACE appliance and the same configuration but the behaviour is the same.
    I need help as soon as possible,
    thanks,
    I've attached the Show conn, show conn detail and show run.

    Hi Cesar,
    Thank you for your answer,
    The issue was solved,
    We were running an A3 software version, it seems to have a Bug so it doesn't show the NAT commands in the "show run", so when we made the configuration backup we didn't noticed it.
    The ACE reloaded because an electrical failure so it losted the NAT config.
    We just upgraded to an A4 version and also added a NAT/PAT to enable the communication between the Clients and the Proxy.
    Regards,

  • ACE 4710 HTTPS load balance configuration

    Have two ACE 4710 in HA setup. We would like to setup HTTPS loadbalance(actually just a primary and standby configuration in the serverfarm). Initially this would be for Exchange OWA connections but may expand to more HTTPS connections later.
    I know there are several ways to do SSL with the ACE( client, server, end-to-end). I am just wanting to know the easiest way to deploy this? Is a certificate always needed on the ACE for each connection? In HA mode would a certificate be needed for both or does it replicate in some way to the other ACE?
    Any configuration examples would be helpful.
    Thanks.

    IF you terminate SSL on the ACE you need certificates and key on ace in the context in which you are doing the termination. The certs and keys need to be installed on the active and standby (manually unless using anm to manage).
    when speaking of SSL
    SSL termination refers to ace terminating SSL and sending to server as clear text
    end to end - ACE terminates SSL (to look into payload to make a loadbalance decision or sticky decision) and then re-encrypts to the server, so to the client ACE is an ssl server and to the server the ace is an ssl client.
    You can find some config examples at
    http://docwiki.cisco.com/wiki/Category:Data_Center_Application_Services_Configuration_Examples

  • Full URL re-direct with ACE 4710

    Is there anyway to perform a redirect on the ACE 4710 so that it will redirect a request sent to the domain mydomain.com be redirected to www.mydomain.com, this is so that an installed SSL certificate will match.
    Thanks

    Thank you for your response, but the redirect would occur before any encyption.. for example today this is what happens
    someone goes to
    http://www.mydomain.com
    and the ACE redirects the connection to
    https://www.mydomain.com
    What I want is for someone to go to
    http://mydomain.com (without the www) and for it to redirect to
    http://www.mydomain.com which will inturn redirect to https://www.mydomain.com
    or it can just redirect to https://www.mydomain.com
    So the encryption will not occur until it is redirected to teh correct websit

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • ACE 4710 and mangled HTTP requests

    After replacing a Cisco CSS/SSL  Accelorator and PIX firewall with an ACE 4710 to do load balancing and  SSL encryption behind an ASA firewall we started seeing mangled HTTP  requests in the Apache access logs for the servers in the server farm.  Here is one example:
    XX.XX.XXX.XXX  - - [21/Oct/2012:01:42:12 -0500]  "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    Rather  than appearing just after the timestamp, the "POST /register/LServlet"  is tacked on to header information that shouldn't even appear in the  log. Also the first letter in that header information is always missing  (heckoutFlag instead of checkoutFlag in this example). 
    The  mangled request always shows up as a 501 HTTP error and shows up late  in the Apache access logs (timestamp is out of chronogical order) and  always appears with several duplicate POSTs:
    XX.XX.XXX.XXX - - [21/Oct/2012:01:42:23 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XX.XXX  - - [21/Oct/2012:01:42:12 -0500]   "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet"  "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    This is occurring for several different URLs and not just the one above and for multiple web browsers.
    The ACE load balances to servers running Tomcat 7 with Apache HTTP server v. 2.2.14.
    A recent ACE software upgrade to A5(2.1) has not fixed the problem.
    Has anyone seen this before?
    Thanks for any insight you can provide.
    -Kari

    Hi Kari,
    Do you have a sample of the configuration which you got with the CSS?
    What is the current configuration which you got on the ACE?
    Can you shows this output: # show stats http?
    Jorge

  • ACE 4710 transparent LB with two Caches and two routers.

    Hello,
    I have ACE 4710 that load balance two cach flows (bluecoat), i am doing pbr on the routers to send the traffic destined to port 80 to ACE then Cach farm. After that the Cach flow will get the page from the internet via two routers. The return traffic will match another pbr on the routers with source port 80 that will send it to the ACE then CachFlow again .....then to the users.
    I am not using ip-spoofing on the CachFlow for now. In the figure attached i created a VIP 0.0.0.0 0.0.0.0 port 80 on the interface on the ACE facing the routers, but the question is do i have to create another VIP 0.0.0.0 0.0.0.0 port 80 on the interface on ACE facing the Cach Flow? or just forward the traffic on the default route? What might be the default route since i have to use two routers and i cannot use hsrp?
    Kindly I need some assistance
    Thank you and regards,
    George
    access-list PERMIT_ALL line 8 extended permit ip any any
    access-list CFLOW line 8 extended permit ip any any
    ip name-server 8.8.8.8
    ip name-server 4.2.2.2
    ##################################Config for Cache Cache Servers###################
    probe http CISCO_WWW_PROBE
      ip address 72.163.4.161
      interval 2
      faildetect 2
      passdetect interval 2
      passdetect count 5
      request method head url /index.html
      expect status 200 200
      exit
    probe http YAHOO_WWW_PROBE
      ip address 87.248.112.181
      interval 2
      faildetect 2
      passdetect interval 2
      passdetect count 5
      request method head url /index.html
      expect status 200 200
      exit
    serverfarm host TRANSPARENT_PROXY_SF
      description Transparent Proxy Farm
      transparent
      predictor hash url
      probe CISCO_WWW_PROBE
      probe YAHOO_WWW_PROBE
      rserver CFLOW01
        inservice
      rserver CFLOW02
        inservice
      exit
      exit
    ############################################# Router Cache Farm ############################
    probe icmp ICMP_PROBE
      description *** Probe for icmp health monitoring ***
      interval 5
      faildetect 2
      passdetect interval 60
      passdetect count 2
      exit
    rserver host Router01
      description Connection to Sodetel Router
      ip address 192.168.14.4
      probe ICMP_PROBE
      inservice
    rserver host Router02
      description Connection to IDM Router
      ip address 192.168.14.5
      probe ICMP_PROBE
      inservice
    serverfarm host Routers
      description Transparent Proxy Farm
      transparent
      predictor hash url
      probe ICMP_PROBE
      rserver Router01
        inservice
      rserver Router02
        inservice
      exit
      exit
    ################################# Management################################
    class-map type management match-any REMOTE_MGMT
      description Allow Remote management for below protocols
      8 match protocol icmp any
      9 match protocol ssh source-address 172.31.13.31 255.255.255.255
      10 match protocol ssh source-address 172.31.31.21 255.255.255.255
    policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
      class REMOTE_MGMT
        permit
    class-map match-all CFLO2Internet
      2 match virtual-address 0.0.0.0 0.0.0.0 any
    class-map match-all TRANSPARENT_VIP_CM
      2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq www
    policy-map type loadbalance first-match TRANSPARENT_LB_PM
      class class-default
        serverfarm TRANSPARENT_PROXY_SF backup Routers
    policy-map type loadbalance first-match CFLO2Internet_LB
      class class-default
        serverfarm Routers
    policy-map multi-match CFLO2Internet_PM
      class CFLO2Internet
        loadbalance vip inservice
        loadbalance policy CFLO2Internet_LB
        loadbalance vip icmp-reply active
        connection advanced-options TCP
    policy-map multi-match L3L4_PM
      class TRANSPARENT_VIP_CM
        loadbalance vip inservice
        loadbalance policy TRANSPARENT_LB_PM
        loadbalance vip icmp-reply active
        connection advanced-options TCP
    ====Interfaces======
    interface vlan 11
      description Interface between Routers and ACE
      ip address 192.168.14.2 255.255.255.224
      alias 192.168.14.1 255.255.255.224
      peer ip address 192.168.14.3 255.255.255.224
      no icmp-guard
      access-group input PERMIT_ALL
      service-policy input REMOTE_MGMT_ALLOW_POLICY
      service-policy input L3L4_PM
      no shutdown
    interface vlan 21
      description Connection to CFlow ServerFarm
      ip address 192.168.12.2 255.255.255.224
      alias 192.168.12.1 255.255.255.224
      peer ip address 192.168.12.3 255.255.255.224
      no icmp-guard
      access-group input CFLOW
      service-policy input CFLO2Internet_PM ------>>>> Is this necessary???
      no shutdown

    Hi George,
    In the topology you described, only the service-policy in the interface towards the routers is necessary. For the traffic from the caches, the ACE will just forward to the default gateway.
    The only problem is, as you mentioned, that you cannot use HSRP. In that case, you can still configure two default gateways, but there is no way to predict which one the ACE will use at a given time (the way it does to select the one it will use is sending an ARP request to both gateways and using the one that replies first until the ARP entry expires)
    If you need to load-balance the traffic between both routers, then yes, you would need to configure a new VIP on the cache side and load-balanced to a transparent serverfarm composed of both routers.
    Regards
    Daniel

  • ACE 4710 is not working

    Hi. I'm working on the Cisco ACE 4710 to be able to load balance web Traffic between several web servers. but despite following the steps mentioned on the Cisco configuration guide (specially this link and related docs: http://docwiki.cisco.com/wiki/Cisco_ACE_4700_Series_Appliance_Quick_Start_Guide,_Release_A3(1.0)_--_Creating_a_Virtual_Context) we did not managed to make it. we tested both the "bridged scenario" and "routed scenario" but none of them is working. specifically "configuring Nat" in the above link is very confusing and is not clear; because it's not the same as Cisco IOS, which we used to implement it that way. 
    Routed Scenario:
    ==========================================
    probe http Http_Probe
      description Server Healty Check
      port 80
      request method head url /index.htm
    probe icmp ICMP_Check
      interval 10
      passdetect interval 5
    rserver host NetCad_Server_1
      ip address 172.16.1.100
      probe ICMP_Check
      inservice
    rserver host NetCad_Server_2
      ip address 172.16.1.101
      probe ICMP_Check
      inservice
    rserver host NetCad_Server_3
      ip address 172.16.1.102
      probe ICMP_Check
      inservice
    serverfarm host NetCad_Servers
      probe Http_Probe
      rserver NetCad_Server_1 80
        inservice
      rserver NetCad_Server_2 80
        inservice
      rserver NetCad_Server_3 80
        inservice
    sticky http-cookie Cookie1 1
      serverfarm NetCad_Servers
    class-map match-all VS_NetCad
      2 match virtual-address 192.168.13.162 255.255.252.0 tcp any
    policy-map type management first-match mgmt-pm
      class class-default
        permit
    policy-map type loadbalance first-match VS_NetCad-l7slb
      class class-default
        serverfarm NetCad_Servers
    policy-map multi-match int40
      class VS_NetCad
        loadbalance vip inservice
        loadbalance policy VS_NetCad-l7slb
        loadbalance vip icmp-reply
    interface vlan 40
      description Client Side
      ip address 192.168.13.161 255.255.252.0
      ip options allow
      no normalization
      no icmp-guard
      access-group input Permit_ALL
      service-policy input mgmt-pm
      service-policy input int40
      no shutdown
    interface vlan 41
      description Server Side
      ip address 172.16.1.1 255.255.255.0
      ip options allow
      no normalization
      no icmp-guard
      access-group input Permit_ALL
      nat-pool 1 172.16.1.110 172.16.1.110 netmask 255.255.255.255 pat
      service-policy input mgmt-pm
      no shutdown
    ip route 0.0.0.0 0.0.0.0 192.168.12.1
    ==========================================

    Hi,
    Let me explain you.
    Assuming client IP as 1.1.1.1, VIP as 2.2.2.2 and Real Server as 3.3.3.3
    Consider the simple situation where client needs to access an application hosted on 3.3.3.3. Client sends a request which comes to VIP.
    src 1.1.1.1----->dst------->2.2.2.2. ACE after matching conditions and taking LB decision decides to send  it to 3.3.3.3 real server. Performs destination NAT and forwards the client request to 3.3.3.3. So the above packet L3 header will now look like:
    src 1.1.1.1       dst 3.3.3.3. When reply comes from server, ACE will change src 3.3.3.3 back to 2.2.2.2 and forwards the request to client 1.1.1.1. SIMPLE LB.
    Now comes a situation where let's say you want to hide the client IP from server or let's say server's default GW is not ACE or client and server are in same subnet but need to communicate through VIP on ACE etc.
    Src 1.1.1.1 dst 2.2.2.2
    After LB ace decides to send it to 3.3.3.3 but also policy multi match has nat rule (nat dynamic 1 vlan x). But packet would be forwarded from server vlan where you have NAT pool defined. So let's say pool IP is 3.3.3.4. So ACE will perform both destination as well as src NAT here before forwarding the packet to server and packet L3 header will look like:
    src 3.3.3.4 ----->dst 3.3.3.3
    Now when 3.3.3.3 has to send packet back, ACE will answer ARP for 3.3.3.3 and hence packet will come back to ACE which will again change the L3 header IP's and send it out the client VLAN towards client.
    So NAT is always applied to server side vlan and  that's why pool is  chosen from server side subnet.
    Let me know if you have any questions.
    Regards,
    Kanwal

  • ACE 4710 Can not confirm http cookie sticky connections

    We are using a ACE 4710 with A3(2.6) software release.
    I had to change our sticky load balancing method for HTTPS to cookie based.
    However while connections appear to work if I look at the sho sticky database table I can not see or confirm sticky entries for the cookie based connections.
    Here or config snippets to show the config
    sticky http-cookie ghh-www scook-ghh
      cookie insert browser-expire
      serverfarm ghh-www-443
    class-map match-all ghh-www-443_CLASS
      2 match virtual-address 172.16.1.21 tcp eq https
    class-map type http loadbalance match-any ghh-www-443_CLASSURL
      2 match http url [.]*
    policy-map type loadbalance first-match ghh-sticky-443_POLICY
      class class-default
        sticky-serverfarm scook-ghh
    policy-map multi-match POLICY
    class ghh-www-443_CLASS
          loadbalance vip inservice
          loadbalance policy ghh-sticky-443_POLICY
          loadbalance vip icmp-reply active
          appl-parameter http advanced-options CASE_PARAM

    Another point: please check whether your servers are listening only for HTTPS traffic or also for HTTP traffic:
    in the first case the ACE will have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and then re-encrypt it and send it to the server
    in the second case the ACE would have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and send it out as it is unencrypted to the server
    the second solution would have the benefit of being easier to configure and to require less resoucerces both on the ACE (only decryption to be performed) and on the servers (no need for SSL operations at all there) but it might be that your company or business sector have requirements for which this traffic should never flow unencrypted, in which case you would have to go for the first solution.
    Here you have a config example for the first solution:
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c6f37.shtml
    I would not expect you to have to pay extra for importing the cert and kepair into the ace, it would be just a copy, however as Alex said that may still depend on the license agreement with the CA.
    Cheers,
    Francesco

  • ACE 4710 & OC4J

    Hi …
    I configured two Cisco load balancers (two ACE 4710 in active/standby HAV mode), to balance web requests on port 80 among two AS-10g Oracle application servers (OC4J).
    I am getting the following error when I try to access OC4J forms though Cisco ACE 4710:
    FRM-92101: There was a failure in the forms server during startup.
    This could happen due to invalid configuration.
    Please look in the web-server log file for details
    This message appears only, when both OC4J instances are running. if one is running, everything works fine.
    Also it appears after authenticating with DB server, not upon entering the application server.
    However , I attached the output of 'sh  run' in both load balancers, and also the output of 'sh ver' in one appliance (the second has the same version)
    I was wondering, if you could help me, so I can know, what may cause this problem, is it related to this Oracle application, or it is caused by Cisco 4710.
    Eng.Sami Armoush

    Hi...
    Just I want to inform you, that I solved the problem by fixing the stickiness configuration on ace 4710.
    Thanks in advance..
    Sami Armoush

Maybe you are looking for