Ace 4710 SSL Proxy TLS (Beast) Mitigation

Has anyone heard if there is an upgrade path to mitigate this recent tls1.0 and sslv3 exploit?
Thanks
Darren
Sent from Cisco Technical Support iPad App

Hi Darren,
I haven't seen any official cisco comment about this yet.
Also our customers are asking for updates on this security advisory....
Edwin

Similar Messages

  • ACE 4710 & SSL Offloading

    I testing the 4710 for load balancing between 2 web servers. I have the http portion working just fine but would like to get some input on the SSL portion.
    We have a section of our site that requires user login and the whole session is https from when they login and when they are browsing through our site.
    My questions are within the design aspects. Would this best be designed using SSL offloading and then using clear text from the ACE to the web servers? Also, what would the differences be with configuring ssl offloading with stickiness if configured with http server load balancing on the same server farm versus creating a new server farm just for https? Would end-to-end ssl be best in this scenario?
    Description of the web application usage:
    Users log in and their whole session is https. Users will be filling out forms, inputting data, registering for events and uploading some files.

    Okay so that makes sense to me now. When the client requests an HTTPS page and the ACE terminates the connection, the ACE uses SSL rewrite/redirect to send the request back to the client so that the client still maintains the SSL connection. Otherwise it will request an HTTP page instead of the HTTPS page.
    Am I correct?

  • ACE 4710 SSL server LB with stickiness

    I will be replacing 11500 CSS which are not doing SSL termination, just load-balancing SSL sessions terminated on servers with ACE 4710.
    On their CSS config, they were doing SSL-sticky. I understand the 4710 doesn't support SSL sticky, but can perform the same function by parsing the HTTP header. Has anyone done this config before and know where/how to parse the header to look for the SSL session# and stick connections to same server?
    THANKS!

    In Ace 2.x code GPP (Generic protocol parsing) was introduced that enables ACE to look into the Layer 4 payload.Which is how this stickiness id achieved.
    details at
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/slb/guide/sticky.html#wp1133923
    I dont think its currently available on ACE appliance yet.
    Syed

  • ACE 4710 like Proxy Log?

    Hi guys!
    I have one question to the ACE.
    We using the ACE as Proxy.
    Can write the ACE a proxy log? (GET, Post requests)
    Like so
    192.168.0.1 - - [09/Oct/2010:02:12:40 +0200] "GET / HTTP/1.1" 302 304 "http://www.cisco.com" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.10) Gecko/20100914 AskTbCDS/3.9.0.12758 Firefox/3.6.10"
    192.168.0.1 - - [09/Oct/2010:06:17:14 +0200] "GET /oks/app HTTP/1.1" 200 3861 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)"
    192.168.0.1 - - [09/Oct/2010:06:17:15 +0200] "GET /css/default.css HTTP/1.1" 304 - "https://blablbla.at/oks/app" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C
    did anybody know that the ACE can do this.
    He can also forward the events to a sys Server. Is it posible?
    Thanks
    regards Markus

    Hi Markus,
    The short answer is no.
    This kind of logging you are looking for is more common in HTTP caching devices. However, the ACE will only proxy connections in order to get enough information to make a load-balancing decision.
    Regards
    Daniel

  • ACE 4710, reverse proxy?

    Hello All,
    Please forgive my ignorance but can the ACE appliance behave as a reverse proxy for http and ssl traffic? I would assume it can given how it does SLB but SLB is not a requirement at this time. Thanks for your input.

    Hi Mate,
    The reverse proxy servers can perform many tasks, like:
    Note: this info from Wikipedia: http://en.wikipedia.org/wiki/Reverse_proxy
    Reverse proxies can hide the existence and characteristics of the origin server(s), The ACE will do that.
    Application firewall features can protect against common web-based attacks. Without a reverse proxy, removing malware or initiating takedowns, for example, can become difficult, The ACE has some built-in security features, you can refer to this document for full detail:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/security/guide/securgd.html
    In the case of secure websites, the SSL encryption is sometimes not performed by the web server itself, but is instead offloaded to a reverse proxy that may be equipped with SSL acceleration hardware. The ACE can do this:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/ssl/guide/sslgd.html
    A reverse proxy can distribute the load from incoming requests to several servers, with each server serving its own application area. In the case of reverse proxying in the neighborhood of web servers, the reverse proxy may have to rewrite the URL in each incoming request in order to match the relevant internal location of the requested resource. The ACE can do that perfectly.
    A reverse proxy can reduce load on its origin servers by caching static content, as well as dynamic content. Proxy caches of this sort can often satisfy a considerable amount of website requests, greatly reducing the load on the origin server(s). Another term for this is web accelerator. A reverse proxy can optimize content by compressing it in order to speed up loading times. Please check this link for more detail about ACE Application Acceleration and Optimization:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/app_acc_and_opt/guide/appaccoptgd.html
    Best regards,
    Ahmad

  • ACE 4710 - 'reverse proxy' infront of serverfarm - fail-over/sorry server design issue

    Hi All,
    I'm working on a specific config and have an issue in the backup farm/fail-over/sorry server area.
    The customer wants the following:
    They have an existing serverfarm with X web servers, they want a single server to act as a reverse-proxy in front of the farm.
    So that all traffic goes trough that server, that server then forwards the request to the original serverfarm.
    The problem in my design is in the fail-over, if i configure the reverse-proxy server in a new serverfarm and use the original (web servers) farm as backup it has fail-over, but if the reverse-proxy AND the original serverfarm fail, there is no nice way to get the users on a sorry server.
    I could give the original serverfarms rservers a 'backup standby' server but that won't give the desired effect either.
    For maintance they first take 50% of the servers offline and switch to the other 50% after that, so then users would see a sorry page even if there where operational servers in the farm left.
    The 4710's are running routed mode, and the farms use Sticky Cookie, and also some http URL & Cookie matching is done.
    Anyone have an idea how to build this?

    Hi,
    It need additional testing but as per my understanding if you put the back up in this order then the last backup server will be choosen first.
    In your case it will be like " RSERVER1 >> backup sorry server >> backup web content
    As per the below example:
    I put test 2 as first backup server and test1 as second backup server but if you look at the first part it took rserver test1 as first backup.
    serverfarm host 1313-GIN-GWAP-SDC-80
      rserver RSERVER1
        backup-rserver test1
        inservice
      rserver test1
        inservice standby
      rserver test2
        inservice standby
    regards,
    Ajay Kumar

  • CSS11503/ACE 4710 - SSL session id cache

    I have a couple of questions.
    1. I'd like to know what happens when the SSL session id cache (def 10k) gets filled on a CSS11503. Do new connections get dropped or do they still work but are they less efficient?
    2. What is the cache size on an ACE4710?

    The problem was caused by an incorrect nat pool.   Correct Mask was 255.255.255.0.

  • ACE 4710 SSL connection rate

    What exactly happens when the SSL connection rate is exceeded. Is the connection dropped, queued or what ?
    Defined as the SSL TPS. In our case 1000 but upgradeable to 5000

    Hi,
    The connection will be denied once the SSL connection rate is exceeded.
    That can be identified by using the command :
    show resource usage all
    You will see something like this :
            Resource         Current       Peak        Min        Max       Denied
    ssl-connections rate        995       1000          0       1000     28975
    You will notice that the deny counter will start increasing once the rate is exceeded.
    hope that helps.
    regards,
    Ajay Kumar

  • SSL Certificates Update Error in ACE 4710

    Hi,
    I am facing a problem while updating the SSL certificates in ACE 4710. Our certificate is expired and we have purchased a new certificate from CA. Moreover the common name of the certificate is also changed.
    I tried importing the certificate to the repository and change the SSL proxy likewise to use the new certificate. but still the new certificate with new CN is not recognised by the clients. they can see the old certificate only. I even tried deleting and creating a new ssl proxy service with the new cert and attaching it to policy map.
    but still the new certificate is not used even after a reboot,
    Attaching screenshots and running config. Any help will be appreciated.
    BR//Rajiv

    Ravi,
          Here are the procedures for updating your certificate on the ACE. 
    1) Create New RSA Key
    2) Create CSR
    3) Send CSR to CA authority for a new certificate
    4) Import Certificate into the ACE
    5) Change the ssl-proxy to use the new Certificate and Key
    6) Remove the SSL-Proxy from the policy map and reapply
    Now if you created the CSR on a different box, you will need to import both the RSA key are the certificate.  Another thing you should be aware of is a possible change in the Root and intermediate certicates that are used by the CA.  In your configuration, you have
    crypto chaingroup iotms-chain-gr-1
      cert inter-root-new
    Is the the correct certificates for your cert?  If so, it seems odd that there is only on certificate in the Chaingroup.  Most CAs use an intermediate and and a root certificate. 
    Verify that you have the correct chaingroup (with the correct root and intermediate certificates). 

  • Ace ssl-proxy problem, Online store.

    Hello!
    I have a problem with moving our online store loadbalancing to a Cisco ACE solution from Windows NLB that it runs on now. And also relive the servers from the ssl encrypt and decrypting of sessions.
    The load balancing works', as long the session is Http, but when the "customer" comes to the point that i is going to pay. Our shop is jumping over to HTTPs and this is where the problem appear.
    The "customer" is getting the certificate right but the site is not displayed = the session to the shop seems to die.
    If i have missed something in the config or if someone have any other idea why this dont work for me..
    Appreciate any help!
    My config:
    (at the moment only web5 is in use)
    ACE-1/CO-WEB1# show run
    access-list ANY line 10 extended permit ip any any
    access-list icmp line 8 extended permit icmp any any
    probe http PROBE-HTTP
    interval 3
    passdetect interval 10
    passdetect count 2
    expect status 200 200
    expect status 300 323
    parameter-map type ssl SSLPARAMS
    cipher RSA_WITH_RC4_128_MD5
    rserver host vmware-server1
    description testserver1
    ip address 219.222.4.180
    probe PROBE-HTTP
    inservice
    rserver host vmware-server2
    description testserver 2
    ip address 219.222.4.181
    probe PROBE-HTTP
    inservice
    rserver host web5
    description testserver from windows nlb
    ip address 219.222.4.185
    probe PROBE-HTTP
    inservice
    ssl-proxy service SSL-PROXY-SE
    key cert-se.key
    cert cert-se.pem
    ssl advanced-options SSLPARAMS
    serverfarm host WM-ware_servers
    rserver vmware-server1
    inservice
    serverfarm host webtest
    description testserver-farm
    predictor leastconns
    rserver vmware-server1 80
    rserver vmware-server2 80
    rserver web5
    inservice
    sticky ip-netmask 255.255.255.0 address source STICKY-GROUP1
    timeout 60
    serverfarm webtest
    class-map match-all VIP-HTTP
    2 match virtual-address 219.222.4.178 tcp eq www
    class-map match-all VIP-HTTPS
    2 match virtual-address 219.222.4.178 tcp eq https
    class-map type management match-any icmp
    description for icmp reply
    2 match protocol icmp any
    policy-map type management first-match icmp
    class icmp
    permit
    policy-map type loadbalance first-match VIP-HTTP
    class class-default
    sticky-serverfarm STICKY-GROUP1
    policy-map type loadbalance first-match VIP-SSL
    class class-default
    serverfarm webtest
    policy-map multi-match SLB-VIP-HTTP
    class VIP-HTTP
    loadbalance vip inservice
    loadbalance policy VIP-HTTP
    loadbalance vip icmp-reply
    class VIP-HTTPS
    loadbalance vip inservice
    loadbalance policy VIP-SSL
    loadbalance vip icmp-reply
    ssl-proxy server SSL-PROXY-SE
    interface vlan 21
    description ### ACE OUTSIDE mot FW ###
    ip address 219.222.4.171 255.255.255.240
    access-group input ANY
    access-group output ANY
    service-policy input icmp
    service-policy input SLB-VIP-HTTP
    no shutdown
    interface vlan 22
    description ### ACE INSIDE Gateway for Web-servers ###
    ip address 219.222.4.177 255.255.255.240
    access-group input ANY
    access-group output ANY
    service-policy input icmp
    no shutdown
    ip route 0.0.0.0 0.0.0.0 219.222.4.161
    ACE-1/CO-WEB1#
    as seen in "show conn" the sessions is established, first when i enter site, and go to payment (jumping over to SSL):
    ACE-1/CO-WEB1# show conn
    total current connections : 4
    conn-id np dir proto vlan source destination state
    ----------+--+---+-----+----+---------------------+---------------------+------+
    4 1 in TCP 21 219.222.0.2:49972 219.222.4.178:443 ESTAB
    14 1 out TCP 22 219.222.4.185:443 219.222.0.2:49972 ESTAB
    11 2 in TCP 21 219.222.0.2:49923 219.222.4.178:80 ESTAB
    3 2 out TCP 22 219.222.4.185:80 219.222.0.2:49923 ESTAB
    ACE-1/CO-WEB1#

    Hello Krille
    i had the same problem.
    The HTT Probe you define will do a check if
    the return code is
    expect status 200 200
    expect status 300 323
    Now if a user is accessing the hppts site, in the flow there will be an expect status like 404, the ACE now is not establish an sticky connection, cause it think that the flow is not ok.
    The only output after ther Certificates is a blank site.
    If you change the Probing to ICMP you will be able to access the https site and the connection is sticky. With a litte tool like IE Watch you will be able to see the wrong Status codes.
    regards
    eberhard

  • SSL Termination in ACE 4710 not working

    Hi,
    I have configured a new ACE 4710 with only a sinlge context to redirect https traffic to http real servers using SSL Termination. When I do a telnet on port 443 or 80 to the VIP it works fine but when I try to open the URL it prompts me for accepting the certificate then it tries to find and establish connection to the URL but eventually dies out giving a "Page cannot be displayed error". I have done some troubleshooting and found that the connection to the VIP on 443 port is Established but the out connection from the real server to the client remains in the INIT state. I am attaching the configs and all the troubleshooting data I have collected. Pls someone help.

    Yes the "server pkt count" for the "class: VIP_HTTPD_Redirect" is not incrementing and yes the servers do not have the default gateway towards the ACE.So as suggested I have configured default route in the servers towards the ACE interface vlan ip address. Still the server packet count is not incrementing. I am posting the updated configuration of the ACE as an attachment. Pls help.

  • ACE 4710 in failover - ssl offload, cert for second ACE

    Hi,
    I'm testing two ACE 4710 appliances that should work in active/standby mode and do ssl offload in bridged mode.
    At the moment I have configured one of the devices to do basic load balancing (without ssl offload).
    Now I would like to move further and configure ssl offload and configure High availability.
    I read that the certificate for ssl can be localy generated on the ACE device but I couldn't find any information regarding the cert that should be used on the second ACE.
    Should I generate a new cert od the standby unit or somehow use the one on the first ACE?
    Is it better to first set up high availability and then configure ssl offload or vice versa?
    Does anyone have a config example of ssl offload and active/standby configuration?
    Thank you in advance.

    You simply need to generate keys & CSR on the primary ACE. Export the Keys from Primary ACE, Import these keys to Standby ACE and once you recieve the certs from CA then simply import the cert to both ACEs.
    FOllowing will be steps to achive that
    On primary Ace
    1. create RSA Keys
    crypto generate key 2048 app1.key
    2. Create CSR & send it to CA
    ace/Admin(config)# crypto csr-params app1-csr
    ace/Admin(config-csr-params)# common-name www.app1.com
    ace/Admin(config-csr-params)# country US
    ace/Admin(config-csr-params)# email [email protected]
    ace/Admin(config-csr-params)# locality xyz
    ace/Admin(config-csr-params)# organization-name xyz
    ace/Admin(config-csr-params)# organization-unit xyz
    ace/Admin(config-csr-params)# state CA
    ace/Admin(config-csr-params)# serial-number 1234
    ace/Admin(config-csr-params)# end
    ace/Admin(config)# crypto generate csr app1-csr app1.key
    (copy the result to a file)
    4. Import certificate recieved from CA
    crypto import terminal app1.cert
    (pasted the content from the cert)
    5. verify the cert & keys match
    crypto verify app1.key app1.cert
    6. Export the keys from Active
    crypto export app1.key
    (copy the result to a file)
    ON Standby ACE:
    1. Import the keys
    crypto import terminal app1.key
    2. Import the cert
    crypto import terminal app1.cert
    3.verify the cert & keys match
    crypto verify app1.key app1.cert
    Hope this helps
    Syed

  • ACE SSL Proxy performance issue

    Hi I've got an ACE module in a 6500 that is being used as an SSL Proxy For a web service.
    So the configuration is fairly basic, matches a VIP which has been Nat'ed from the public IP address port 443 and load balances over a number of reservers with the server ports being set to 80.
    The problem is the main web site is hosted elsewhere and so when they switch to checkout on a secure port the browser page requests multiple https:// files .
    The users are seeing very slow page loads a considerable amount longer than equivalent on http and more than you'd expect. The ACE is no where near any throughout or transaction limits.
    My concern is on how the session is tracked, would the ACE attempt to renegotiate with every https:// get? I've seen example configs for stickiness inserting cookies for normal end-end load balancing but not with an SSL proxy configuration.
    Sent from Cisco Technical Support iPad App

    Hi Craig,
    The SSL negotiation/handshake will happen everytime a client opens a new TCP connection i.e comes with a different source port.
    To make sure that ACE doesn't renegotiate you can try and use this command:
    (config-parammap-ssl)# session-cache timeout . You can use 24 hours or anytime you think is suitable.
    This is basically to enable SSL session reuse. A little explanation below for your reference:
    When client connects to a server over SSL, the server creates a session for that connection. This session ID is sent as a part of the Server Hello message. This is to make things efficient, in case the client has any plans of closing the current connection and reconnect in the near future. Most of the servers have a time out for these sessions (I think 24 hours is a common value, unless pressed for space).
    When the client connects to the same server again, it can send the same session ID as a part of the Client Hello. The server will first look up if it can find any sessions with that ID. If found, the same session will be reused. Thus the time spent in verifying the certs and negotiating the keys is saved. If the server cannot find a matching session, then it responds with a new session ID and its certificate in Server Hello message. The client knows that it has to verity the cert and negotiate the key again.
    Considerable amount of time is spent in validating server certs. Reusing SSL session will save this time.
    Having said that you need to check if the client is coming with a session ID which it got in previous handshake or not. If it doesn't and it is a new TCP connection then SSL handshake will happen. Please enable that command before testing.
    Also, ensure that you have allocated proper SSL resources to your context. Lack of resources can also cause dropped connections and sluggish performance.
    Regards,
    Kanwal

  • ACE 4710 - Parameters Lost in URL

    Hi Everyone,
    I have configured SSL offloading and redirection on a 4710 appliance. Everything works fine. The issue I am facing is that some parameters in url are getting lost.
    I have https://%h/%p configured as a redirect server which works fine as far as hostname and path is concerned. i.e. full hostname and path are preserved, but that there are some parameters after the full path in encrypted format which are getting lost. I think 307 redirect can resolve this issue but ACE does not support that.
    Has anyone faced something similar? Any suggestions would be helpful.
    Thanks.
    Rehan

    Hi,
    See the snip of the config
    parameter-map type ssl SSL-MAP
      session-cache timeout 600
    parameter-map type http HTTP-MAP
      persistence-rebalance
    rserver host E-SERVER01
      ip address X.X.X.Y
      inservice
    rserver host E-SERVER02
      ip address X.X.X.Z
      inservice
    rserver redirect E-SERVICE
      webhost-redirection https://%h/%p 302
      inservice
    serverfarm host E-SERVERS
      rserver E-SERVER01 80
        inservice
      rserver E-SERVER02 80
        inservice
    serverfarm redirect SF-RE-DIRECT
      rserver E-SERVICE
        inservice
    class-map match-any E-WEB-HTTP
      2 match virtual-address X.X.X.15 tcp eq www
    class-map match-any E-WEB-HTTPS
      3 match virtual-address X.X.X.15 tcp eq https
    sticky ip-netmask 255.255.255.255 address source WEB-STICKY
      replicate sticky
      serverfarm E-SERVERS
    policy-map type loadbalance first-match PM-E-WEB
      class class-default
        sticky-serverfarm WEB-STICKY
        insert-http ClientProtocol header-value "https"
    policy-map type loadbalance first-match PM-REDIRECT
      class class-default
        serverfarm SF-RE-DIRECT
    policy-map multi-match SLB-POLICY
      class E-WEB-HTTPS
        loadbalance vip inservice
        loadbalance policy PM-E-WEB
        loadbalance vip icmp-reply
        appl-parameter http advanced-options HTTP-MAP
        ssl-proxy server SSL-MAP
      class E-WEB-HTTP
        loadbalance vip inservice
        loadbalance policy PM-REDIRECT
        loadbalance vip icmp-reply
        appl-parameter http advanced-options HTTP-MAP
    @Jorge: The device has many policies and has been running for a few years, therefore the show stats http command will not be of much help as we may see other traffic statistics/errors. If your looking for max parse len errors then thats not happening. The url length is not that long. Let me know if anything specific you want me to check.
    @Cesar: I will check but as per the information I have there are some parameters after the complete path "/" which are hash value of an authentication request. Basically what is happening when the user goes to the page, user needs to enter credentials. Once the user clicks submit the page just reloads, instead of going to the requested url.
    Thanks for your support,
    Rehan

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

Maybe you are looking for