Cisco Ace GSS Vs Bind

I have a client that implements its data center redundancy via BIND using its DNS features. I´m trying to sell cisco Gss to that customer. What are the improvements that I could get with Cisco GSS? Just the DOS protection and interconection with ACE for health checking?

Mario-
The GSS itself is meant to be an intelligent DNS server.  What it provides:
1.) Probing for the answers it sends back to clients, dynamic removal of answers if probes fail.
2.) Failback clauses - if a primary set of answers are all unavailable, multiple other groups can be configured. This allows multiple levels of failure mitigation.
3.) Load based answering - using Kal-AP, the GSS can probe a CSS, CSM, or ACE device to determine which site is most/least loaded and send answers for a site accordingly.
4.) Proximity based answering.  The GSS uses DRP agents to find which GSS is local to the client D-proxy and pull answers for that specific site.
5.) DOS attack prevention.
6.) CNR (full DNS server - a stand alone GSS only responds to A queries or forwards requests to an NS server.)
GSS Admin Guide
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/gss4400series/v3.1.1/administration/guide/gssadmg.html
GSS Configuration Guide
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/gss4400series/v3.1.1/configuration/cli/gslb/guide/cli_gslb.html
GSS - CNR Installation
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/gss4400series/v2.0/administration/guide/Man_CLI.html#wp1059313
CNR configurations
http://www.cisco.com/en/US/docs/net_mgmt/network_registrar/6.0/administration/guide/02GStart.html#wp1069420
http://cco.cisco.com/en/US/docs/net_mgmt/network_registrar/6.0/command/reference/cliref.html

Similar Messages

  • Cisco ACE compatiblity with F5 GTM

    Hi,
    We have cisco ace 30 modules installed in cisco 6500 switches. For application availability purpose from the internet, we need to have some global site selector/3rd party devices with similar feature set that of cisco gss.
    My question is: whether cisco ace is compatible to ge tintegrated with other 3rd party devices like F5 GTM?
    kindly sugegst..

    Good afternoon,
    I'm not familiar with the GTM solution, but, as long as it's DNS-based like the GSS, it should be perfectly compatible. Bear in mind that the ACE is not aware on how clients are getting the IP address, it just replies to whatever connections it gets.
    Regards
    Daniel

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • Urgent!!! Cisco ACE and asymetric routing assistance needed

    I am wondering if someone can give me pointers on the cisco ACE
    and asymetric routes. I've attached the diagram:
    -Cisco IOS IP address is 192.168.15.4/24 and 4.1.1.4/24
    -Firewall External interface is 192.168.15.1/24,
    -Firewall Internal interface is 192.168.192.1/24,
    -F5_BigIP External interface is 192.168.192.4/24,
    -F5_BigIP Internal interface is 192.168.196.1/24 and 192.168.197.1/24,
    -host_y has IP addresses of 192.168.196.10/24 and 192.168.197.10/24,
    -Checkpoint has static route for 192.168.196.0/24 and 192.168.197.0/24
    pointing to the F5_BigIP,
    -host_y is dual-home to both VLAN_A and VLAN_B with the default
    gateway on host_y pointing to VLAN_A which is 192.168.196.1,
    -host_x CAN ssh/telnet/http/https to both of host_y IP addresses
    of 192.168.196.10 and 192.168.197.10.
    In other words, from host_x, when I try to connect to host_y
    via IP address of 192.168.197.10, the traffics will go through VLAN_B
    but the return traffics will go through VLAN_A. Everything
    is working perfectly for me so far.
    Now customer just replaces the F5_BigIP with Cisco ACE. Now,
    I could not get it to work with Asymetric route with Cisco ACE. In
    other words, from host_x, I can no longer ssh or telnet to host_y
    via IP address of 192.168.197.10.
    Anyone knows how to get asymetric route to work on Cisco ACE?
    Thanks in advance.

    That won't work because ACE uses the vlan id to distinguish between flows.
    So when the response comes back on a different vlan, ACE can't find the flow it belongs to and it drops it.
    Even if we could force it to accept the packet, ACE would then try to create a new flow for this packet and it will collide with the flow already existing on the frontend.
    You would need to force your host to respond on the same vlan the traffic came in.
    This could be done with client nat on ACE using different nat pool.
    Gilles.

  • Cisco ACE loadbalancing matching more than one header in L7 class map

    Dear All,
    This is regarding Cisco ACE loadbalancing matching more than one header in L7 class map. I have a small setup with ACE 30 module in Cisco6500. I have got three webservers. Presently I have following configuration where I am mathing one url header.
    class-map type http loadbalance match-all L7_WEB_HEADER_MATCH
    description MATCH THE HOST HEADER OF HTTP REQUEST
    2 match http header Host header-value ".*abhisar.com*"
    So for above configuration, when traffic is coming for abhisar.com, it is working fine.
    Now, I have following headers and DNS entry is pointing to same virtual IP for all http url header same as abhisar.com
    abhisarindia.com
    indiaabhi.com
    So new configuration will be
    class-map type http loadbalance match-any L7_WEB_HEADER_MATCH
    description MATCH THE HOST HEADER OF HTTP REQUEST
    2 match http header Host header-value ".*abhisar.com*"
    4 match http header Host header-value ".*abhisarindia.com*"
    6 match http header Host header-value ".*indiaabhi.com*"
    So just want to confirm if this is fine.
    Thank You,
    Abhisar.

    Dear Rajesh,
    Thank you for reply. I will let you know once I carry out this activity.
    Thank You,
    Abhisar.

  • Slow connection in one server if accessing through Cisco ACE

    Hi,
    Good day, Can someone help me on my problem? I have 3 servers, server1, server2 and server3. When one pc accessing the server 3 application via Cisco ACE, it experienced a slow connection but when direct access without Cisco Ace, it's fast. The connection of this PC through cisco ace and direct access have no issue.
    What need to do in my configuration? Below is my configuration
    logging enable
    logging timestamp
    logging trap 7
    logging buffered 7
    logging monitor 7
    logging host 167.81.126.5 udp/514
    logging host 137.55.152.147 udp/514
    resource-class SG_01
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 10.00 maximum equal-to-min
    boot system image:c4710ace-mz.A3_2_0.bin
    login timeout 30
    peer hostname singapore-ace2
    hostname singapore-ace1
    interface gigabitEthernet 1/1
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/2
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/3
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/4
      channel-group 14
      no shutdown
    interface port-channel 14
      description ISOLAN-ACE-TRUNK
      ft-port vlan 99
      switchport trunk native vlan 1
      switchport trunk allowed vlan 12,14,112
      no shutdown
    clock timezone SGT 8 0
    ntp server 137.55.152.1
    context Admin
      member SG_01
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 9 extended permit icmp any any
    ip domain-name ysn.psg.philips.com
    probe http singapore_01
      description This probe used to monitor application url-app-script
      interval 5
      passdetect interval 5
      request method get url /insiteserverstatus/insiteserverstatus.aspx
      expect status 200 200
      open 1
    probe http singapore_02
      description This probe used to monitor IIS-login-page
      interval 5
      passdetect interval 5
      request method get url /InSiteLumiledsApplication/
      expect status 200 200
      open 1
    probe icmp uplink
      description This probe used in conjunction with ft track host
      interval 2
      faildetect 2
      passdetect interval 3
    parameter-map type connection PARAM_L4STICKY-IP
      exceed-mss allow
    rserver host sggysnysn1ms013
      ip address 137.55.152.135
      inservice
    rserver host sggysnysn1ms014
      ip address 137.55.152.136
      inservice
    rserver host sggysnysn1ms018
      ip address 137.55.152.145
      inservice
    serverfarm host PLI9058
      probe singapore_01
      probe singapore_02
      rserver sggysnysn1ms013
        inservice
      rserver sggysnysn1ms014
        inservice
      rserver sggysnysn1ms018
        inservice
    sticky ip-netmask 255.255.255.255 address both SG_GROUP_01
      timeout 720
      replicate sticky
      serverfarm PLI9058
    class-map type management match-any HTTPS-ALLOW_CLASS
    class-map match-all L4STICKY-IP_141:ANY_CLASS
      2 match virtual-address 137.55.152.141 any
    class-map type http loadbalance match-any NO_MS018
      50 match source-address 137.55.155.31 255.255.254.0
    class-map type management match-any SSH-ALLOW_CLASS
      2 match protocol ssh source-address 167.81.124.0 255.255.255.192
      3 match protocol ssh source-address 167.81.126.0 255.255.255.192
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match L7PLBSF_STICKY-NETMASK_POLICY
      class class-default
        sticky-serverfarm SG_GROUP_01
        insert-http X-Forwarded-For header-value "%is"
    policy-map multi-match PLI9058-VIPs_POLICY
      class L4STICKY-IP_141:ANY_CLASS
        loadbalance vip inservice
        loadbalance policy L7PLBSF_STICKY-NETMASK_POLICY
        loadbalance vip icmp-reply
        connection advanced-options PARAM_L4STICKY-IP
    interface vlan 12
      description Client-side vlan
      bridge-group 1
      no normalization
      mac-sticky enable
      access-group input ALL
      access-group output ALL
      service-policy input PLI9058-VIPs_POLICY
      no shutdown
    interface vlan 14
      ip address 137.55.152.236 255.255.255.248
      peer ip address 137.55.152.237 255.255.255.248
      service-policy input remote_mgmt_allow_policy
      no shutdown
    interface vlan 112
      description Server-side vlan
      bridge-group 1
      no normalization
      access-group input ALL
      access-group output ALL
      nat-pool 1 137.55.152.141 137.55.152.141 netmask 255.255.255.192 pat
      no shutdown
    interface bvi 1
      ip address 137.55.152.189 255.255.255.192
      alias 137.55.152.188 255.255.255.192
      peer ip address 137.55.152.190 255.255.255.192
      description Bridge-Group 1 Virtual Interface
      no shutdown
    ft interface vlan 99
      ip address 192.168.1.1 255.255.255.252
      peer ip address 192.168.1.2 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 100
      heartbeat count 10
      ft-interface vlan 99
    ft group 1
      peer 1
      priority 150
      peer priority 50
      associate-context Admin
      inservice
    ft track host test1
      track-host 137.55.152.234
      peer track-host 137.55.152.235
      peer probe uplink priority 50
      probe uplink priority 50
    ip route 0.0.0.0 0.0.0.0 137.55.152.233

    Hi Earsdale,
    All the three servers are using the same configuration, so, I'm afraid it's not possible to give you a simple answer. You will need more troubleshooting.
    I would recommend you to start by checking the differences between the servers because one of those differences is certainly causing the failure.
    Also, it would be helpful to get traffic captures on the TenGig interface of the ACE to compare the behavior of the connection when going to the different servers, as well as the differences when being load-balanced vs accessing the server directly.
    If you need help with this troubleshooting, you can always open a TAC service request
    Regards
    Daniel

  • Cisco ACE A2(2.0) - webhost-redirection

    Hello,
    We are currently running the version ACE A2(2.0), pretty old one on Cisco ACE Module.  We have applied webhost-redirection https://%h%p 302 but it doesn't seem to take effect and always go back to the host header value.
    Is it a bug or a missing feature within A2(2.0) build ?
    Please assist.
    Thanks.

    Also is there a way to check in ACE logs as to what are the redirects taking place to identify any issues etc.
    Thanks.

  • Cisco ACE dynamic rerouting (dc to dc failover)

    Good day,
    We currtenly have two dc's (site A and site B)
    We are using netapps as our SAN and we ar booting our server directly from the SAN
    SAN A and SAN B are insync and the network between site A and site B is routed.
    The challange:
    When a server is failover from site A to B it still has an ip adress that is routed to site A.(due to the SAN boot)
    We have a cold - hot design in regards to the servers (so no clustering of ESX)
    I have been reading about cisoc ACE and i think that it would solve the challange by dynamily updateing OSPF.
    Can any one please confirm that cisco ACE will solve this challlange (whitout the need for any other additional hardware)
    Thanks a lot,
    Regards,
    joli-coeur Wouter
    (CCIE Security 23078)

    It's more related to disaster recovery planning than ACE configuration
    The cleanest way is to use L2 extension.
    Otherwise you can use VMWare SRM to change the ip addresses of your VMs, or run an OSPF process and replicate all the subnets and put it in the "shutdown state" (or announcing it with a very high cost, proximity routing will do the rest - ACE module can do this for the VIPs with OSPF route health injection, ACE4710 doesn't support RHI but on the upstream router you can define an IP SLA probe and perform conditionnal redistribution), or use a dummy VRF with all your subnets and when enabling DRP, perform route leaking... use NAT with DNS-based failover etc...
    There is no generic answer to your problem.

  • How can ftp service on non-standard port be load balanced using Cisco ACE.

    How can ftp service on non-standard port be load balanced using Cisco ACE.For example ftp service required on tcp 2000 port

    Hi Samarjit,
    you can do this by specifying the port number in the class map that you create . Please find the below mentioend config guide where you can specify the tcp/udp port , range or ports or even the wild card to match the port.
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/administration/guide/mapolcy.html#wp1318826
    Regards
    Abijith

  • Logging user commands in Cisco ACE appliance

    Good afternoon gentlemen
    I need to configure the same as shown below in Cisco ACE Appliance. The requirement is logging all user access login (whether failed or succeeded) and also logging all commands that users issue.
    #IOS commands
    no logging console
    logging buffered 307200 informational
    service timestamps log datetime localtime show-timezone
    logging trap debugging
    login on-failure log
    login on-success log
    archive
       log config
          logging enable
          logging size 500
          hidekeys
          notify syslog contenttype plaintext
    If you guys have an idea please answear
    Regards
    Christian

    Hello Arun,
    we saw before the message you report, it's probably a symptom of:
    CSCtx03563
    or
    CSCue38032
    I would suggest opening a TAC case to get this properly investigated.
    Kind Regards,
    Francesco

  • Monitoring the Cisco ACE module with SNMP

    We use 2 redundant Cisco ACE loadbalancer in our datacenter
    The models are ACE20-MOD-K9 with software A2(2.0)
    Does anybod know how to monitor the environment (cpu, memory) of such a module with snmp?
    We were not able to find an applicable MIB for that module.
    The CISCO-PROCESS-MIB.oid (ftp://ftp.cisco.com/pub/mibs/oid/CISCO-PROCESS-MIB.oid) seems not to reflect the correct oid's.
    What are the correct oid's for cpu and memory?
    Where can I find a detailed documentation for snmp-monitoring the cisco ace module?
    thanks

    Hi Patrik,
    to monitor the ACE I use these two MIB's:
    ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SLB-MIB.my
    ftp://ftp.cisco.com/pub/mibs/v2/CISCO-ENHANCED-SLB-MIB.my
    Example for CPU:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Normale Tabelle";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    cpmCPUTotalEntry 1.3.6.1.4.1.9.9.109.1.1.1.1
    The resource usage and other interesting things you will find with a MIB browser.
    Achim

  • Cisco ACE Inspecting RTSP Wowza Service?

    Did somebody knows if Cisco ACE in some of their HW and SW versions support Inspect for RTSP of Wowza Service running in the serverfarm? We intend to setup the service in routing mode and without a Firewall or a Web APP Firewall avoiding BW consumption in ASA/FWSM.

    Hi Samuel,
    ACE does support RTSP inspection but specific server support is not mentioned. Please see more details about RTSP inspection at below:
    http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/security/guide/securgd/appinsp.html#wp1318637
    Regards,
    Kanwal
    Note: Please mark answers if they are helpful.

  • Cisco ACE - "show conn" command queries

    Hi all,
    i have some queries regarding the "show conn" command in Cisco ACE.
    Working Scenario:
    VIP : 10.10.10.1
    Server 1 : 10.10.20.1
    Server 2 : 10.10.20.2
    Client: 30.30.30.1
    When a client 30.30.30.1 initiates a connection to the VIP on 10.10.10.1, the ACE load balances it to Server 1, 10.10.20.1. Looking at the "show conn" table, it shows that Server 1 is replying back to the Client 30.30.30.1 through the ACE.
    Now, my question is when the ACE returns the traffic to the Client, should the Client be seeing the source IP coming from the VIP or Server 1? My understanding is that the Client should be seeing traffic returning from the VIP. But the show conn table does not seem to suggest so.
    show conn table
    conn-id    np dir proto vlan source                destination           state
    ----------+--+---+-----+----+---------------------+---------------------+------+
    1768       1  in  TCP   10   30.30.30.1:9221   10.10.10.1:80       ESTAB
    41         1  out TCP   52    10.10.20.1:80    30.30.30.1:9221   CLOSED

    Daniel,
    The client is expecting a response from the VIP otherwise there would be an asymmetrical routing problem and conns will never complete.
    The fact that you're seeing 30.30.30.1 as the destination address is just that the server is able to see client's IP address on the request, when your backend servers sends the reply back to the client this response is forced to go through the ACE, when the ACE looks at the packet it matches with a previously conn created on the flow table so it "NATs"  the reply so now the source of the packet is the VIP and destination is 30.30.30.1.
    This is a expected behavior as you're not using S-NAT on your network.
    HTH.
    Pablo

  • Cisco ace mibs for concurrent connection on real and virtual servers

    i have loaded cisco provided mibs for cisco ace into nms but i am not able to fetch the details from ace appliance 4710.where can i find IODs for this.
    would really appreciate if anyone can help me regarding this

    Hi Manohar,
    you need two MIBs:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Normale Tabelle";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SLB-MIB.my
    ftp://ftp.cisco.com/pub/mibs/v2/CISCO-ENHANCED-SLB-MIB.my
    The current connection you will find in the section:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Normale Tabelle";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    slbVServerInfoTableEntry .1.3.6.1.4.1.9.9.161.1.4.2.1
    Example:
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Normale Tabelle";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    slbVServerNumberOfConnections  .1.3.6.1.4.1.9.9.161.1.4.2.1.6.1.44
    Use a MIB-Browser to find out the OID for each server.
    Best Regards,
    Achim

  • Integrate Cisco ACE into AAA TACACS+

    Dear Community!
    I would like to configure Cisco ACE 4710 CLI and WebAmin to use ACS v4.2 TACACS+ authentication and accounting feature. After found a Cisco document, which describes ACE AAA features (http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/security/guide/aaa.html), I have setup all configuration parameters mentioned in this document, everything seems to be OK.
    But...
    I have a TACACS+ group named "Network Administrators", which has privilege level 15 option enabled, so admins do not have to type enable password when authenticating. After setting up ACE AAA, the prvilege level 15 option stops working, while logging in Cisco routers: after authentication, the user remains in privilege level 1.
    Logging in Cisco switches seems to be OK, stepping immediately to level 15 as usual.
    I tried upgrading IOS in a router, but no luck...
    Does anybody have any experiance about this "bug"?
    Thanks in advance!
    Regards,
    Belabacsi
    @ Budapest, Hungary

    Hello Bela
    In ACE on every context (including Admin and other) you should have following strings:
    tacacs-server host x.x.x.x key 7 "xxx"
    tacacs-server host x.x.x.x key 7 "xxx"
    aaa group server tacacs+ MYTACACS
      server x.x.x.x
      server x.x.x.x
    aaa authentication login default group MYTACACS local
    aaa authentication login console group MYTACACS local
    aaa accounting default group x.x.x.x
    On ACS side for group named "Network Administrators" you should configure in TACACS settting:
    1. Shell (exec) enable
    2. Privilege level 15
    3. Custom attributes:
              shell:Admin*Admin default-domain
        if you have additional context add next line
              shell:mycontext*Admin default-domain
    After loging to ACE and issuing sh users command you should see following
    User            Context                                                                 Line     Login Time   (Location)        Role   Domain(s)   
    *adm-x       Admin                                                                   pts/0   Sep 21 12:24  (x.x.x.x)    Admin   default-domain
    Regards,
    Stas

Maybe you are looking for