How do I load balance TFTP between two servers and a client on the same subnet?

Question

Hi,
I have trawled through several documents and tried umpteen different configs, all to no avail. I have a PXE boot client trying to access a boot file via TFTP from a couple of TFTP servers on the same VLAN/subnet. For HA purposes I want to load balance the two TFTP servers.
Config is currently;
=====
probe icmp ICMP_PROBE
  description icmp probe for default gateway tracking
  interval 5
  passdetect interval 15
rserver host server1
  description Server1
  ip address 10.0.0.1
  inservice
rserver host server2
  description Server 2
  ip address 10.0.0.2
  inservice
serverfarm host serverfarm_01
  description servers used
  probe ICMP_PROBE
  rserver server1
    inservice
  rserver server2
    inservice
class-map match-all L4_VIP_TFTP
  10 match virtual-address 10.0.0.10 udp eq 69
policy-map type loadbalance first-match L7_TFTP
  class class-default
    serverfarm serverfarm_01
policy-map multi-match L4_LB_VIP_POLICY
  class L4_VIP_TFTP
    loadbalance vip inservice
    loadbalance policy L7_TFTP
    loadbalance vip icmp-reply active
nat dynamic 1 vlan 200
interface vlan 200
  ip address 10.0.0.250 255.255.255.0
  nat-pool 1 10.0.0.241 10.0.0.243 netmask 255.255.255.255 pat
  service-policy input L4_LB_VIP_POLICY
  no shutdown
ip route 0.0.0.0 0.0.0.0 10.0.0.254
=====
I have read the doco by Ivan Kovacevic amongst many others but as my clients and servers are on the same subnet, the config doesnt work.
Can anybody point me in the right direction please. The devices are ACE 4710 running A3(2.3).
Thanks

Answer 1

Try using the following configuration:
Note: Please make sure to configure also a udp probe to probe udp port 69, in case the application is down.
You need to configure a management policy on the interface when using a UDP probe.
That is because, when port 69 on the server will be unreachable, the server will send an ICMP unreachable.
ACE will consider a udp probe as "failed" only when it sees ICMP unreachable.
Without a management policy-map, the ICMP unreachable message will be dropped.
Also, add an ICMP probe to the rserver because udp probe will not be enough when the physical interface will be down.
That is because UDP is a connection-less protocol. To consider a UDP probe successfull, ACE need to see NO answer from the server in respose to the probe.
The ACE will not see any answer from the server when the interface is down and thus, will consider the probe as "sucessful".
With ICMP probe attached to the rserver, you also test the reachability of the server and not only the UDP port.
Here is the configuration (of course, you can chage the names of the of the objects to the name you are using if you want) :
access-list ALL line 10 extended permit ip any any
probe udp TFTP
  port 69
  interval 5
  passdetect interval 15
probe icmp ICMP_PROBE
  interval 5
  passdetect interval 15
rserver host TFTP_1
  ip address 10.0.0.1
  probe TFTP
  probe ICMP_PROBE
  inservice
rserver host TFTP_2
  ip address 10.0.0.2
  probe TFTP
  probe ICMP_PROBE
  inservice
serverfarm host TFTP-SFARM
  rserver TFTP_1
    inservice
  rserver TFTP_2
    inservice
sticky ip-netmask 255.255.255.255 address source TFTP-STICKY
  timeout 10
  replicate sticky
  serverfarm TFTP-SFARM
class-map type management match-any MANAGE
  2 match protocol icmp any
class-map match-all NAT
  2 match virtual-address 0.0.0.0 0.0.0.0 udp any
class-map match-all TFTP
  2 match virtual-address 10.0.0.10 udp eq 69
policy-map type management first-match MANAGE
  class MANAGE
    permit
policy-map type loadbalance first-match ROUTE
  class class-default
    forward
policy-map type loadbalance first-match TFTP-POL
  class class-default
    sticky-serverfarm TFTP-STICKY
policy-map multi-match TFTP-MULTI
  class TFTP
    loadbalance vip inservice
    loadbalance policy TFTP-POL
    nat dynamic 1 vlan 212
  class NAT
    loadbalance vip inservice
    loadbalance policy ROUTE
    nat dynamic 2 vlan 212
interface vlan 212
  ip address 10.0.0.250 255.255.255.0
  no normalization
  access-group input ALL
  nat-pool 1 10.0.0.241 10.0.0.243 netmask 255.255.255.0 pat
  nat-pool 2 10.0.0.10 10.0.0.10 netmask 255.255.255.0 pat
  service-policy input TFTP-MULTI
  service-policy input MANAGE
  no shutdown
Let me know how it goes.
Good luck!