ACE Module and Limiting Connections

We currently use the ACE module to Load-balancing IPSEC connection into SPA's.  Since the SPA's only support 60 new connections per second.  I was looking for a way to limit the amount of connecitons from the ACE to the SPA's.

Hello,
Have a look at the Configuring Real Server Rate Limiting section of the ACE documentation.  I think this will meet your needs.
Hope this helps,
Sean

Similar Messages

  • Difference between ACE module and ACE appliance

    Hi All,
    Can someone help to understand the difference between ACE module and ACE appliance, as i am observing ACE module is providing more throughput when compared the ACE appliance, Is the only advantage we getting with contexts ....
    thanks inadvance,
    Narayana Mallidi

    Hi Narayan,
    Apart from providing throughput, ACE module has more to offer ,
    http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Troubleshooting_Guide_--_ACE_Resource_Limits
    The above link will provide a comparision of ACE module and Ace appliance interms of scalability. Apart from that legacy modules wont support compression, but ACE 30 module can support compression.
    The major advantage of ACE 30 module is with resepct to SSL throughput, SSL TPS, L4 & L7 CPS, & Concurent Connections per second, apart from the increased contexts
    ACE 4710 Data Sheet :
    http://www.cisco.com/en/US/prod/collateral/contnetw/ps5719/ps7027/Data_Sheet_Cisco_ACE_4710.html
    ACE20 Data Sheet
    http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/product_data_sheet0900aecd8045861b.html
    ACE 30 Data Sheet
    http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/data_sheet_c78_632383.html
    Regards
    Abijith

  • Can ACE module and 4710 appliance work redundant together

    Hi.
    I am setting up a testlab for ACE loadbalancing and need to test functionality on both the ACE module and the 4710 appliance.
    Can one of each of these two be set up redundant together with full functionality? Or do I have to test redundancy for 2x ACE modules and 2x 4710 appliances seperate?
    Thanks in advance for any help!

    It won't work.
    The code checks if the devices are the same during the HA negotiation.
    If you do a 'show ft peer detail' you should see at the end :
    SRG Compatibility            : WARM_COMPATIBLE
    License Compatibility        : INCOMPATIBLE
    These 2 entries indicate if the box are compatible to run HA between each other.
    The version is checked and the license.
    Both would be different between an ACE module and ACE appliance.
    Gilles

  • ACE Module uneven current connections

    Good morning all,
      I currently have an issue where using the round-robin predictor we are getting some servers being hit with larger numbers of connections than others. This is causing the web servers to drop connections due to being hit very fast in a short period of time.
    This is the output from a show serverfarm showing the issue. MK-HOST15 somehow has 1858 current connections and 48 connection failures ....
    MK-ACE01/001# show serverfarm MK-FARM-sf
    serverfarm     : MK-FARM-sf, type: HOST
    total rservers : 8
                                                    ----------connections-----------
           real                  weight state        current    total      failures
       ---+---------------------+------+------------+----------+----------+---------
       rserver: MK-HOST10
           10.10.1.10:0          8      OPERATIONAL  92         206929     16
       rserver: MK-HOST11
           10.10.1.11:0          8      OPERATIONAL  93         206859     86
       rserver: MK-HOST12
           10.10.1.12:0          8      OPERATIONAL  93         206943     2
       rserver: MK-HOST13
           10.10.1.13:0          8      OPERATIONAL  116        206934     10
       rserver: MK-HOST14
           10.10.1.14:0          8      OPERATIONAL  93         206941     3
       rserver: MK-HOST15
           10.10.1.15:0          8      OPERATIONAL  1858       206896     48
       rserver: MK-HOST16
           10.10.1.16:0          8      OPERATIONAL  93         206935     9
       rserver: MK-HOST17
           10.10.1.17:0          8      OPERATIONAL  95         206838     106
    When this happens the failure counter for MK-HOST15 increases a lot
    MK-ACE01/001# show serverfarm MK-FARM-sf
    serverfarm     : MK-FARM-sf, type: HOST
    total rservers : 8
                                                    ----------connections-----------
           real                  weight state        current    total      failures
       ---+---------------------+------+------------+----------+----------+---------
       rserver: MK-HOST10
           10.10.1.10:0          8      OPERATIONAL  229        345394     80
       rserver: MK-HOST11
           10.10.1.11:0          8      OPERATIONAL  216        345347     126
       rserver: MK-HOST12
           10.10.1.12:0          8      OPERATIONAL  210        345275     201
       rserver: MK-HOST13
           10.10.1.13:0          8      OPERATIONAL  669        345369     106
       rserver: MK-HOST14
           10.10.1.14:0          8      OPERATIONAL  210        345442     32
       rserver: MK-HOST15
           10.10.1.15:0          8      OPERATIONAL  203        345167     309
       rserver: MK-HOST16
           10.10.1.16:0          8      OPERATIONAL  228        345417     59
       rserver: MK-HOST17
           10.10.1.17:0          8      OPERATIONAL  256        345370     108
    This behavior keeps occuring and I am not able to figure out why the current connections shows uneven numbers to such a large degree. The overall connection counters seem approximately even though.
    We are running ACE Code A2(2.3)
    The web servers are running Apache and keepalives are off inline with our production enviroments. TCP-Reuse is also turned off. There is no stickyness configured.
    Any ideas why certain servers keep getting hit with more connections than others ? It's like roundrobin keeps stopping at a server for a second before moving on to the next one. Any suggestions appreciated.
    Thanks.

    Hello,
    Have a look at the Configuring Real Server Rate Limiting section of the ACE documentation.  I think this will meet your needs.
    Hope this helps,
    Sean

  • ACE Module SNMP limits

    I am monitoring an ACE module using snmp. The values returned from certain OIDs are graphed using Cacti. I found the 64 bit counters on interfaces for the ACE wrap at 10,000,000,000 instead of 2^64. Now that I have configured cacti to expect the wrap at 10 billion, I am concerned about the 32 bit counters. I am querying this snmp oid to get L7 connection counter
    cslbxStatsL7PolicyConns
    1.3.6.1.4.1.9.9.254.1.1.1.1.8
    Should I expect this counter to wrap at 2^32 or a lower value?

    The maximum value for a 32bit OID should be 4294967296, I do have a value in my lab that is above 1 billion for that counter, so I wouldn't think there is an issue immediately. One common issue - when you clear stats manually, the counter will reset to 0. As well, I found an internal bug that that suggested some pocket case within the code could have cleared stats incorrectly, but it has never been seen since. There is a guess that someone logged into the test bed and cleared it without permission, but it was not able to be verified. Hence the bug was created to investigate the code, turned up nothing, and was junked accordingly.
    What you might want to do is keep a sharp eye on the counter. When it looks like it rolls, login to the context you are polling and take a look at the accounting log. If you find that someone cleared the logging, that answers the question. If not - log a TAC case and we can replicate your exact configuration/code version in our lab to see if there what the deviation is that causes it to clear. A bug would be logged and fixed.
    Regards,
    Chris Higgins

  • Downloading podcasts and limited connectivity

    Has anyone else noticed a problem with their internet connection dropping to limited connectivity when you try to download podcasts?

    It only happens when you try and download more than 1 podcast - if its just 1 downloading there are no issues but its frustrating as Im having to do them all individually rather than queuing them. The simultaneous downloads box is ticked by the way.

  • (IMP)Application module and database connection

    Hi,
    How application module pooling and database connection pooling is working ?
    Currently i m facing a problem like if i am creating 10 browser session then it doesn't mean that i'll have only 10 db sessions. While closing the browser session of application module time out respective db session is not removed.
    In this case, invalid db session are created in bulk which is crashing database sometime. We have writter script to kill those session periodically but in this case if application module is accessing such dbconnection then we are getting session killed error or not logged in error.
    To over come we need to bounce the server (middle tier).
    Is there any proper way to solve this or am i doing something wrong ?
    Please let me know if you need any more details.
    Thanks in advance
    Devang

    Thanks for your prompt reply Ricky.
    I just found out that in some of the JSP pages in application
    <jbo:ReleasePageResources/> is not written. Should this problem arise because of this?
    could you please tell me how can I release page resources in UIX pages ?
    Datasources.xml file content
    <data-source class="com.evermind.sql.DriverManagerDataSource"
    name="AITDS"
    location="jdbc/AITCoreDS"
    pooled-location="jdbc/pooled/AITPDS"
    xa-location="jdbc/xa/AITXADS"
    ejb-location="jdbc/AITDS"
    connection-driver="oracle.jdbc.driver.OracleDriver"
    username=<USERNAME>
    password=<PASSWORD>
    url=<URL>
    inactivity-timeout="30"
    />
    bc4j.xcfg file
    <BC4JConfig>
    <AppModuleConfigBag>
    <AppModuleConfig name="GsaServerModuleLocal">
    <DeployPlatform>LOCAL</DeployPlatform>
    <JDBCDataSource>jdbc/AITCoreDS</JDBCDataSource>
    <jbo.project>gsa</jbo.project>
    <AppModuleJndiName>oracle.appsit.gsa.server.GsaServerModule</AppModuleJndiName>
    <java.naming.factory.initial>oracle.jbo.common.JboInitialContextFactory</java.naming.factory.initial>
    <ApplicationName>oracle.appsit.gsa.server.GsaServerModule</ApplicationName>
    </AppModuleConfig>
    </AppModuleConfigBag>
    </BC4JConfig>
    Let me know if you need any more detail.
    Thanks in advance
    Devang

  • ACE Module and IPSEC

    Hi,
    can i Loadbalance IPSEC to a Couple of Routers via the ACE Module?
    Sven

    Yes, the ACE module supports ipsec.
    You need stickyness based on src ip to guarantee that the isakmp traffic goes to the same router as the ipsec traffic.
    Gilles.

  • (IMP)application module and DB connection issue

    Hi,
    In my BC4J application, Application module is not releasing DB connection after the execution of the JSP page. It usually takes approx 3500-4000sec. to release it. On what parameters this time is dependent??
    I am using data-source to connect to DB. Application Module configurations parameters are set with default values.
    If i select "Disconnect Application Module Upon Release" from the configuration of Application module, it releases DBconnection at the end of http Request. Is it a proper solution to the issue ? any performance related issues with it?
    My JSP code's basic structure is
    try
    <jbo:ApplicationModule id="<AM ID>" definition="<Fully qualified AM classname>" releasemode="Stateless/stateFul" />
    // application code
    catch(Exception e)
    // Code to take necessary action if exception occurs
    finally
    <jbo:ReleasePageResources appid="<AM ID>" releasemode="Stateless/StateFul"/>
    Please guide me on this.
    Thanks in advance,
    Devang

    Hi john,
    Thanks for your reply... in other way can i restrict the number of connections created for the application module By selecting the Disconnect Application Module Upon Release in application module configuration.
    If i select that check box in Appmodule-->configurations->Edit->Pooling and Scalability means, while loading my screen number of connections are increased after completion of loading a screen immediatly connections also got reduced. if i select this check box whether it will give any other problems.
    Here am using the uishell dynamic tab after opening more number of tabs am getting connection pool error.not allways.. thats why am trying to restrict the no.of connections opening.
    please can you provide some info regarding this
    Reg,
    Brahma B

  • WLAN Controller module and LAP connection

    Hi,
    I'm new to setting up WLC and LAP. My question is, do the WLC and LAP require a wired connection between them? Can't they be set up with wireless connection?
    Thanks!

    Hi,
    The Wireless runs on top of Wired network.. so to get the wireless network up and running, the wired network should be up.
    Now regardyour question..
    WLC will be connected to the switch or the router.... the LAP will get connected to the switch or the router..
    So the WLC and the LAP are connected indirectly to wired... however the wirless comes into picture when we have a client to connect.. instead of holding a LAN cable plugged into the laptop we can move around using wireless.
    I request you to let me know if the above answered your question.
    Regards
    Surendra

  • ACE module and inspect http

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:Standardowy;
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin-top:0cm;
    mso-para-margin-right:0cm;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0cm;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    I find information on Cisco.COM how to perform the deep packet inspection of Layer 7 HTTP but I don’t want to use such deep inspection so I decided to use inspect http without policy Layer7 and I don’t know what ACE performs.  Could you tell me what ACE checks? Is it possible to customize?
    I have to be honest. I found something like this “the ACE performs a general set of Layer 3 and Layer 4 HTTP fixup actions and internal RFC “ but I couldn’t image how HTTP could be fixup and what is internal RFC.
    Regards
    Falcon

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:Standardowy;
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin-top:0cm;
    mso-para-margin-right:0cm;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0cm;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:Standardowy;
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin-top:0cm;
    mso-para-margin-right:0cm;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0cm;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    Hi Chris,
    I’ m so grateful to you for answering to me but I still have a problem “inspect http”. In my case I would like to check only method. I don’t want to check URL parsing or header parsing etc. Is it possible? I ask because the owner of webside is not sure about standard in URL or Header response.
    Cheers,
    Falcon

  • GT70 2PC-1044US - Dropping and limited connection

    I play World of Warcraft and just got this beauty of a laptop last week. I am finding that I keep losing and disconnecting and when you are in a group raid it ticks people off. Any one else having or know how to fix this issue.
    I am on Wifi and using Killer Wireless-N 1202 Network Adapter. All my powers saving modes are turned off and all drivers up to date. Not router or modem both function and tested on two other laptops.
    Computer Specs:
    Model GT70 2PC-1044US Dominator
    Operating System Windows 8.1
    Type Gaming Notebook
    Processor Intel Sharkbay i7-4800MQ
    Standard Memory 8GB
    Hard Drive 1TB
    Optical Drive Super Multi
    Display Size 17.3"
    Display Technology Anti-Glare (1920*1080)
    Touch Screen No
    Graphics Nvidia Geforce GTX870M
    Wireless 802.11b/g/n
    Ethernet Killer Gaming Network
    Bluetooth Bluetooth 4.0
    Webcam 720p HD
    HDMI Yes
    USB USB3.0x3,USB2.0x2
    Keyboard Steel Series Gaming Backlit 102 keys
    Battery 9 cell
    Color Black
    Dimensions 16.85"x11.34"x2.17"
    Weight 8.6 lbs
    Warranty 2 years

    Editors' Choice Award. Good job MSI !!
    http://www.computershopper.com/laptops/reviews/msi-gt70-dominator-893#review-body

  • ACE module, TLS and smtp

    Hello,
    On a ACE module running software version ACE2(1.0), I have defined a virtual smtp server that is load-balanced to a serverfarm containing 2 SMTP servers. Normal SMTP connexions on port 25 work fine. SMTPS connexions to port 465 of a second vserver also work fine: SSL termination occurs at the ACE module and SMTP connexions to the real servers are in clear text on port 25. But I am having problems with TLS.
    If a client connecting to port 25 of the first vserver tries to negotiate TLS, it works but it's the real server that handles TLS encryption. This is normal behavior - but the certificate has to be installed on each of the real servers. I would like the ACE module to handle TLS (it's supported according to the documentation). That way the certificate would only have to be installed on the ACE module.
    So I tried to setup a third vserver on port 587 with the same "proxy-service" as the second vserver used for SSL. If a client connects to port 587 of the vserver via TLS, we only see the 3-way handshake between the client and the vserver, then a pause of a few seconds, then a FIN from the client and finally an ACK and a RESET from the vserver.
    There are absolutely no lines in the log that could help me find out what's happening.
    I found the "debug ssl" command in the documentation but I don't know how to use it - I entered the command and nothing happened; I don't know where the debugging information goes. This is probably why there's a warning that says that "The ACE debug commands are intended for use by trained Cisco personnel only."...
    So my questions are: why is TLS not working? How can I find out why it's not working? Where does the "debug" information go when we use the "debug" commands?
    Thanks a lot for any help you can give me!
    Regards,
    Marc.

    SMTP over TLS is not supported in ACE currently.
    SMTP doesnt use SSL/TLS simply as a secure transport like LDAP, IMAP, POP, HTTP.
    In case of SMTP client needs to open a new conn.
    So ACE or for that matter any other SMTP relay device needs to terminate conn, look in to the SMTP pkts and punch hole according to the new client conns.
    You can get more details at
    http://tools.ietf.org/html/rfc2487
    Syed

  • ACE Module throughput

    Hi
    In the Datashhet of the ACE-Module (ACE20-MOD-K9) there is the following promise:
    Throughput
    16 Gbps*, 8 Gbps*, and 4 Gbps
    We have a base license, so I assume we have a throughput of 4Gbps (gigabits per second).
    Are these 4Gbps bidirectional or unidirectional?
    Is it 2Gbps in one direction and 2Gbps in the other direction?
    Imagine we have just 1 host (A) before the ACE module and just 1 host (B) behind the ACE module. Can I transfer data from A to B (unidirectional) with 4Gbps? Assume the hosts are connected with 10Gbps to the network and use multiple flows!
    How can I measure the effective used bandwith on the ACE module?
    What hapens, if host A tries to send data faster than 4Gbps? Does it deny single packets? Base on what? Does it deny additional sessions?
    How do I know that the ACE runs at it's bandwith limitation?
    Any Ideas?
    Thanks
    Patrik

    Hi Patrik,
    See my answers inline:
    We have a base license, so I assume we have a throughput of 4Gbps (gigabits per second).Are these 4Gbps bidirectional or unidirectional?Is it 2Gbps in one direction and 2Gbps in the other direction?
    It measures the total throughput going through the box. It includes both directions. Also take into account that, for any traffic through the ACE, the packets are seen twice (client to ACE and ACE to server), so the effective throughput is half of the licensed one.
    Imagine we have just 1 host (A) before the ACE module and just 1 host (B) behind the ACE module. Can I transfer data from A to B (unidirectional) with 4Gbps? Assume the hosts are connected with 10Gbps to the network and use multiple flows!
    You could get up to 2Gbps unidirectional. This traffic will go through the ACE twice, adding to the 4Gbps license
    How can I measure the effective used bandwith on the ACE module?
    With the "show resource usage" command
    What hapens, if host A tries to send data faster than 4Gbps? Does it deny single packets? Base on what? Does it deny additional sessions?
    It will drop packets that go over the bandwidth without taking into account to which connection they belong
    How do I know that the ACE runs at it's bandwith limitation?
    Again, "show resource usage"
    Regards
    Daniel

  • ACE Module

    Basically we have a running ACE context which works however we are using natting and we have some applications complaining that they can't see the source address of things. So I created a whole new context with the following config but I have the problem of when the client is on the server side network the traffic never makes it there.
    ACE1/10.0.0.0_Network# sho run
    Generating configuration....
    access-list ALL line 8 extended permit ip any any
    rserver host CE-565-1
    ip address 10.0.2.83
    inservice
    serverfarm host Content_Engine_SF
    rserver CE-565-1
    inservice
    class-map match-all Content_Engine_VIP
    2 match virtual-address 10.0.18.101 any
    class-map type management match-any Remote_Management
    2 match protocol http any
    3 match protocol icmp any
    4 match protocol telnet any
    5 match protocol ssh any
    policy-map type management first-match rmt_mgt_policy
    class Remote_Management
    permit
    policy-map type loadbalance first-match Content_Engine_VIP-l7slb
    class class-default
    serverfarm Content_Engine_SF
    policy-map multi-match int18
    class Content_Engine_VIP
    loadbalance vip inservice
    loadbalance policy Content_Engine_VIP-l7slb
    loadbalance vip icmp-reply active
    access-group input ALL
    interface vlan 3
    description Server_Side
    ip address 10.0.3.240 255.255.254.0
    mac-sticky enable
    no shutdown
    interface vlan 18
    description Client Side Network
    ip address 10.0.18.251 255.255.255.0
    mac-sticky enable
    service-policy input int18
    no shutdown
    ip route 0.0.0.0 0.0.0.0 10.0.18.1
    if I telnet to the vip from my machine 172.16.6.222 it works fine. If I telnet from 10.0.18.30 it works fine. However when I telnet from a machine on the vlan 3 10.0.2.188 it does not work. I would have thought the mac-sticky option would work but it seems to be doing nothing. Any ideas with out using a NAT pool would be great so we can see the originating IP Address.

    If you are initiating traffic from serverA to a vip that load balances to serverB in that same vlan you will have an asymmetric flow. ServerA is on the same vlan as serverB. Since both servers are in the same subnet, ServerB will ARP for serverA address and send the response directly to serverA. The traffic will never make it back to the ACE. There are a few things you can do:
    1. Use NAT to ensure the return traffice makes it back to ACE.
    2. Insert HTTP header with client IP address. This only works for HTTP traffic and your application must be able to recognize this header for logging.
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/slb/guide/classlb.html#wp1040008
    3. Use Direct Server Return (DSR). This feature has been committed to ACE 2.0. This will require the servers to be L2 adjacent to the ACE module and you will need to configure the VIP address as a loopback address on the server. Here is CSM documentation that lists some of the limitations with DSR:
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/csm/4.2.x/configuration/guide/netwcsm.html#wp1065827

Maybe you are looking for