Urgent!!! Cisco ACE and asymetric routing assistance needed

I am wondering if someone can give me pointers on the cisco ACE
and asymetric routes. I've attached the diagram:
-Cisco IOS IP address is 192.168.15.4/24 and 4.1.1.4/24
-Firewall External interface is 192.168.15.1/24,
-Firewall Internal interface is 192.168.192.1/24,
-F5_BigIP External interface is 192.168.192.4/24,
-F5_BigIP Internal interface is 192.168.196.1/24 and 192.168.197.1/24,
-host_y has IP addresses of 192.168.196.10/24 and 192.168.197.10/24,
-Checkpoint has static route for 192.168.196.0/24 and 192.168.197.0/24
pointing to the F5_BigIP,
-host_y is dual-home to both VLAN_A and VLAN_B with the default
gateway on host_y pointing to VLAN_A which is 192.168.196.1,
-host_x CAN ssh/telnet/http/https to both of host_y IP addresses
of 192.168.196.10 and 192.168.197.10.
In other words, from host_x, when I try to connect to host_y
via IP address of 192.168.197.10, the traffics will go through VLAN_B
but the return traffics will go through VLAN_A. Everything
is working perfectly for me so far.
Now customer just replaces the F5_BigIP with Cisco ACE. Now,
I could not get it to work with Asymetric route with Cisco ACE. In
other words, from host_x, I can no longer ssh or telnet to host_y
via IP address of 192.168.197.10.
Anyone knows how to get asymetric route to work on Cisco ACE?
Thanks in advance.

That won't work because ACE uses the vlan id to distinguish between flows.
So when the response comes back on a different vlan, ACE can't find the flow it belongs to and it drops it.
Even if we could force it to accept the packet, ACE would then try to create a new flow for this packet and it will collide with the flow already existing on the frontend.
You would need to force your host to respond on the same vlan the traffic came in.
This could be done with client nat on ACE using different nat pool.
Gilles.

Similar Messages

  • VPC / Cisco ACE and the Nexus 2K and 5K

    Hi all,
    So we have a test environment that looks like the following. We have 2 5K's switch 1 and switch 2. Switch 1 has two 10gb connections downstream to a 2K and switch 2 has two 10Gb connections downstream to the other 2K. We have a few servers that are multi-homed with LACP and VPC via the 2Ks and it works a treat.
    We have our Cisco ACE 01, ports 1 and 2 going to one of the 2K's and we have ports 3 and 4 going to the other 2K, ACE02 ports 1 and 2 going to one of the 2K's and we have ports 3 and 4 going to the other 2K. If i enable VPC and none LACP based etherchannel i cannot get the ACE's talking to each other, but looking at the VPC status its all healthy and up.
    Has anyone managed to multi-home the ACE between two 2K's with VPC successfully? 
    If I disable the links so each ACE only has links upstream in a traditional port-channel and not cross connected, the ACE's can see each other with no issues.
    Cheers

    Doh.. so we had a cable patching issue in the end. Let this be a lesson to all networking chaps - always check the basics first! Now we have patched the cables as per design the VPC has been established and works.
    Now we  have VPC is working we are simulating link failures. When we restore a shutdown physical port within the port-channel/VPC that sits between the 2K and ACE (simulating a port failure) the ACE's lose sight of each other for about 10 seconds and causes an short outage until the port is up and up. The logs on the ACE show 'the Peer x.x.x.x is not reachable. Error: Heartbeat stopped. No alternate interface configured' but the VLAN for the FT interface is carried over all four ACE NIC's that are multi-homed to two 2K's... very strange, i would not expect this, it's like the MAC addresses for the FT interface are waiting to be timed out on the 2K until they are switched on another interface within the port-channel and VPC.
    Anyone seen this before?

  • Cisco ACE and firewall design

    Guys,
    If I have servers protected behind a firewall and I need to load balance some servers , where should I place the ACE?
    Sent from Cisco Technical Support iPad App

    Hi,
    With one-arm i believe the question is where you want to place the firwall. As long as the client is able to reach the VIP and server replies back to ACE i dont see any problem with this design.
    Firewall ---------Switch ---------------- Load Balancer ---
    As you know with one-arm requires a source NAT and might not be a good fit for application that are using the source IP address to track client usage patterns. PBR avoids this problem but adds other considerations, such as routing complexity, asymmetrical routing for non-load-balanced flows, and VRF support; PBR is not available on VRFs.
    Regards,
    Siva

  • Simple remote connection using Cisco AnyConnect and ISR router

    Hi all,
    I am just wondering what the easiest and simplest method would be to make remote PCs (running Cisco AnyConnect) establish a VPN IPsec to a Cisco ISR (881/887, 1900s,2900s series). I used to use EasyVPN method (simple and fast to configure and no need for special licences other than crypto licence) but since Cisco VPN Client is no longer supported I had to resort to WebVPN which requires a licence depending on the number of clients to support (SSL licences for 10,20 users and so forth). I've read a bit about FlexVPN but I can't find an easy example to what I want to do. The closest is this one (FlexVPN and Anyconnect IKEv2 Client Configuration Example):
    http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115941-flexvpn-ikev2-config-00.html
    But that example makes use of RADIUS. Is there a way to make use of local database (users configured on the router) instead of RADIUS?
    Basically what I am after is the following
    - Remote users install Cisco AnyConnect to establish a VPN connection to HQ
    - HQ ISR (880s, 1900s, 2900s) terminates that VPN connections and allows access to local resources (shared drives, applications...).Authentication method would be local database on the router. No need of RADIUS/ACS as this is for very small companies with no IT resources to maintain and configure a RADIUS/ACS server.
    I think what I need is this AnyConnect to IOS Headend Over IPsec with IKEv2 and Certificates Configuration Example:
    http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115014-flexvpn-guide-cert-00.html
    But the example is too highlevel for me to follow, basically I don't know how to generate such certificates and distribute it to remote clients.
    Any help as to how to create such certificates or how to configure FlexVPN to just requiring the user to enter usr/pass (using local database not RADIUS nor ACS) would be highly appreciated.
    Cheers
    Alvaro

    If you insist .. try this:
    http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116032-flexvpn-aaa-config-example-00.html
    http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115907-config-flexvpn-wcca-00.html
    http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/50282-ios-ca-ios.html

  • HT1338 my old mac cant connect to internet and my migration assistant needs an upgrade is there any way to download to my new mac and install the upgrade on my old one so i can complete the migration process?

    I just purchase a new IMac, I am trying to use migration assistant. the problem I am having is my old mac cannot connect to the internet and it needs a software update, can I download the update on my new mac and install it somehow on my old mac?

    If it's a free update, search Apple's support site for it and move the dmg as you would any file. If it's a paid upgrade, no; the Mac App Store upgrades, while downloadable, can't be downloaded from a Mac which can't use them.
    (78632)

  • Cisco ACE and license upgrades

    Hi,
    So we have a virtual ACE carved into Contexts with 0.5 Gb license.
    I'm planning on taking this up to a 1Gb license but I’m concerned regarding the resource-class allocations.      
    I currently allocate a gold class of 20% for customers that require 100mb of through put which works quite well. So 20% of 500mb is 100mb.
    When I upgrade to a 1Gb license the resource-class's will need changing right? So gold becomes 10%, with 10% of 1000Mb is a 100Mb.
    Is how you normally tackle the license upgrades in a virtualised environment.
    Any comments would be appreciated
    Cheers

    Once you upgrade the license, of course the capacity of device increases and hence you can tweak the resource allocation as per your requirement. It should be simple:)

  • Cisco ACE and IIS Virtual Directories

    Hello All,
    I have the Load Balancing between to servers working correctly except for on thing. If I enter www.domainname.com\apps into the browser it will returns a 302 page, but if I enter www.domainname.com\apps\ the page will Pull up. Is there a way for the ACE to add the \ after the Virtual Directory?

    Here is an example of the configuration:
    rserver host NET01
      ip address 10.0.20.24
      inservice
    rserver host NET02
      ip address 10.0.20.25
      inservice
    serverfarm host NET-Farm
      predictor leastconns
      rserver NET01 80
      rserver NET02 80
        inservice
    parameter-map type http HTTP_PARAMETER_MAP
      persistence-rebalance
    sticky ip-netmask 255.255.255.255 address source NET-IP
      replicate sticky
      serverfarm NET-Farm backup Maintenance
    class-map match-all NET
      2 match virtual-address 10.0.20.21 tcp eq https
    policy-map type loadbalance first-match NET
      class class-default
        sticky-serverfarm NET-IP
        insert-http x-forward header-value "%is"
    policy-map multi-match int71
    class NET
        loadbalance vip inservice
        loadbalance policy NET
        loadbalance vip icmp-reply active
        nat dynamic 6 vlan 71
        appl-parameter http advanced-options HTTP_PARAMETER_MAP
    interface vlan 71
    no icmp-guard
      nat-pool 6 10.0.20.21 10.0.20.21 netmask 255.255.255.255 pat

  • Cisco Ace asymetric routing - DNS traffic

    Hi,
    I am wondering if Ace supports asymetric routing.
    In my setup Ace is connected to router with two transit L3 interface. Interface on the router side belongs to different VRFs (e.g. VRF-A & VRF-B). Router is running MPLS in order to connect to internet-border gateway router then to internet.
    Now issue is Ace got the default route with the next hop as the router's interface in VRF-A. However the server's subnet (SVI on Ace) is advertised on router in VRF-B.
    So the outbound traffic(DNS query) from servers to internet takes the default route with next hop of router's int in VRF-A and inbound traffic (DNS response) comes back via MPLS using the VRF-B. That is because server's subnet is just advertised in VRF-B so remote internet broder-gateway will see the server's subnet with route-target applied to it in VRF-B.
    When I enabled the reverse-path forwarding on the transit interface I could clearly see in the Ace logs that DNS response is getting dropped on the ace. I have evn removed the reverse-path forwarding(nothing in the logs - but DNS response from internet still cant reach the servers). I think logically its still asymetrical routing from Ace's point of view but not sure.
    Please can anyone confirm the solution to this issue. I am thinking if I advertise server's subnet in VRF-A as well then it will be symterical routing but not 100% sure if it will fix it.
    So just wondering if there are any other options advisable ?
    Thanks

    Is it not possible to have a host route added to the destination server ? This would allow the traffic to be routed back the same way it came and thus the connection work ?
    Try adding a static route onto the destination server along the lines of ...
    route add [source address of server] mask 255.255.255.255 [IP address of ACE interface]
    This would cause the traffic to be routed between the two hosts via the ACE module which is good because the ACE is acting as a router between the two network segments.
    That's just what I would do but I understand that it may not be the option you want.
    Good luck

  • Slow connection in one server if accessing through Cisco ACE

    Hi,
    Good day, Can someone help me on my problem? I have 3 servers, server1, server2 and server3. When one pc accessing the server 3 application via Cisco ACE, it experienced a slow connection but when direct access without Cisco Ace, it's fast. The connection of this PC through cisco ace and direct access have no issue.
    What need to do in my configuration? Below is my configuration
    logging enable
    logging timestamp
    logging trap 7
    logging buffered 7
    logging monitor 7
    logging host 167.81.126.5 udp/514
    logging host 137.55.152.147 udp/514
    resource-class SG_01
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 10.00 maximum equal-to-min
    boot system image:c4710ace-mz.A3_2_0.bin
    login timeout 30
    peer hostname singapore-ace2
    hostname singapore-ace1
    interface gigabitEthernet 1/1
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/2
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/3
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/4
      channel-group 14
      no shutdown
    interface port-channel 14
      description ISOLAN-ACE-TRUNK
      ft-port vlan 99
      switchport trunk native vlan 1
      switchport trunk allowed vlan 12,14,112
      no shutdown
    clock timezone SGT 8 0
    ntp server 137.55.152.1
    context Admin
      member SG_01
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 9 extended permit icmp any any
    ip domain-name ysn.psg.philips.com
    probe http singapore_01
      description This probe used to monitor application url-app-script
      interval 5
      passdetect interval 5
      request method get url /insiteserverstatus/insiteserverstatus.aspx
      expect status 200 200
      open 1
    probe http singapore_02
      description This probe used to monitor IIS-login-page
      interval 5
      passdetect interval 5
      request method get url /InSiteLumiledsApplication/
      expect status 200 200
      open 1
    probe icmp uplink
      description This probe used in conjunction with ft track host
      interval 2
      faildetect 2
      passdetect interval 3
    parameter-map type connection PARAM_L4STICKY-IP
      exceed-mss allow
    rserver host sggysnysn1ms013
      ip address 137.55.152.135
      inservice
    rserver host sggysnysn1ms014
      ip address 137.55.152.136
      inservice
    rserver host sggysnysn1ms018
      ip address 137.55.152.145
      inservice
    serverfarm host PLI9058
      probe singapore_01
      probe singapore_02
      rserver sggysnysn1ms013
        inservice
      rserver sggysnysn1ms014
        inservice
      rserver sggysnysn1ms018
        inservice
    sticky ip-netmask 255.255.255.255 address both SG_GROUP_01
      timeout 720
      replicate sticky
      serverfarm PLI9058
    class-map type management match-any HTTPS-ALLOW_CLASS
    class-map match-all L4STICKY-IP_141:ANY_CLASS
      2 match virtual-address 137.55.152.141 any
    class-map type http loadbalance match-any NO_MS018
      50 match source-address 137.55.155.31 255.255.254.0
    class-map type management match-any SSH-ALLOW_CLASS
      2 match protocol ssh source-address 167.81.124.0 255.255.255.192
      3 match protocol ssh source-address 167.81.126.0 255.255.255.192
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match L7PLBSF_STICKY-NETMASK_POLICY
      class class-default
        sticky-serverfarm SG_GROUP_01
        insert-http X-Forwarded-For header-value "%is"
    policy-map multi-match PLI9058-VIPs_POLICY
      class L4STICKY-IP_141:ANY_CLASS
        loadbalance vip inservice
        loadbalance policy L7PLBSF_STICKY-NETMASK_POLICY
        loadbalance vip icmp-reply
        connection advanced-options PARAM_L4STICKY-IP
    interface vlan 12
      description Client-side vlan
      bridge-group 1
      no normalization
      mac-sticky enable
      access-group input ALL
      access-group output ALL
      service-policy input PLI9058-VIPs_POLICY
      no shutdown
    interface vlan 14
      ip address 137.55.152.236 255.255.255.248
      peer ip address 137.55.152.237 255.255.255.248
      service-policy input remote_mgmt_allow_policy
      no shutdown
    interface vlan 112
      description Server-side vlan
      bridge-group 1
      no normalization
      access-group input ALL
      access-group output ALL
      nat-pool 1 137.55.152.141 137.55.152.141 netmask 255.255.255.192 pat
      no shutdown
    interface bvi 1
      ip address 137.55.152.189 255.255.255.192
      alias 137.55.152.188 255.255.255.192
      peer ip address 137.55.152.190 255.255.255.192
      description Bridge-Group 1 Virtual Interface
      no shutdown
    ft interface vlan 99
      ip address 192.168.1.1 255.255.255.252
      peer ip address 192.168.1.2 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 100
      heartbeat count 10
      ft-interface vlan 99
    ft group 1
      peer 1
      priority 150
      peer priority 50
      associate-context Admin
      inservice
    ft track host test1
      track-host 137.55.152.234
      peer track-host 137.55.152.235
      peer probe uplink priority 50
      probe uplink priority 50
    ip route 0.0.0.0 0.0.0.0 137.55.152.233

    Hi Earsdale,
    All the three servers are using the same configuration, so, I'm afraid it's not possible to give you a simple answer. You will need more troubleshooting.
    I would recommend you to start by checking the differences between the servers because one of those differences is certainly causing the failure.
    Also, it would be helpful to get traffic captures on the TenGig interface of the ACE to compare the behavior of the connection when going to the different servers, as well as the differences when being load-balanced vs accessing the server directly.
    If you need help with this troubleshooting, you can always open a TAC service request
    Regards
    Daniel

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • My BB9810 refuse to load OS7.1 software on my phone after the download has completed. My phone has freezed/stucked since morning. Pls urgent help/assistant needed as I can not access/use my phone for over 24hrs now.

    My BB9810 refuse to load OS7.1 software on my phone after the download has completed. My phone has freezed/stucked since morning. Pls  urgent help/assistant needed as I can not access/use my phone for over 24hrs now.

    Hi there,
    Use the method described in the link below to get back up and running:
    http://supportforums.blackberry.com/t5/Device-software-for-BlackBerry/How-To-Reload-Your-Operating-S...
    I hope this info helps!
    If you want to thank someone for their comment, do so by clicking the Thumbs Up icon.
    If your issue is resolved, don't forget to click the Solution button on the resolution!

  • Assistance Needed: Inter-VRF Routing with MP-BGP

    hello everyone,
    I've been trying to solve a problem for over a day regarding inter-vrf routing using MP-BGP and I can't seem to figure a few things out.
    I have Cisco 1921 which has VRF-JLAN and VRF-JGLOBE with 3 interfaces configured as (g0/0 = vrf JLAN, g0/1=no vrf, g0/2 = dot1q trunk to 2960S). vrf JLAN is a restricted network for users access, dns server, e.t.c. vrf JGLOBE is for Video server and global routing table belongs to Wifi Access. I've been able to seperate all the network and I can route traffic out to the Internet from vrf JLAN and the global route table but where I'm having issues is getting vrf JGLOBE to route traffic using the Global route table.
    For example: vrf JLAN should not be accessed by either Global or vrf JGLOBE. JGLOBE should be able to access vrf JLAN dns server but it should route its internet traffic via Global route table (g0/1). Last JLAN should be able to access 2 networks from the Global route table.
    I've attached my config and diagram so you can better understand what I'm trying to achieve. More light to solving this problem would be much appreciated.
    ip vrf JGLOBE
     rd 65001:2
     export map WIFI
     route-target export 65001:2
    ip vrf JLAN
     rd 65001:1
     import ipv4 unicast map C-GLOBAL
     route-target export 65001:1
     route-target import 65001:1
     route-target import 65001:2
    interface GigabitEthernet0/0
     description LAN-ACCESS-INTERNET [TO Nexthop FIREWALL]
     ip vrf forwarding JLAN
     ip address 192.168.4.3 255.255.255.248
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     ip flow ingress
     ip flow egress
     ip inspect INTERNET-FW out
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    interface GigabitEthernet0/1
     description GLOBAL-Wifi-INTERNET [TO Nexthop - FIREWALL]
     ip address 192.168.5.3 255.255.255.248
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     ip flow ingress
     ip flow egress
     ip inspect GLOBAL-FW in
     ip inspect GLOBAL-FW out
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    interface GigabitEthernet0/2
     no ip address
     duplex auto
     speed auto
    interface GigabitEthernet0/2.3
     description Users LAN
     encapsulation dot1Q 3
     ip vrf forwarding JLAN
     ip address 192.168.30.1 255.255.255.240
    interface GigabitEthernet0/2.4
     description Video Server
     encapsulation dot1Q 4
     ip vrf forwarding JGLOBE
     ip address 10.6.40.1 255.255.255.0
    router ospf 1 vrf JLAN
     router-id 10.6.6.10
     redistribute bgp 65001 subnets
     network 0.0.0.0 255.255.255.255 area 0
    router ospf 2 vrf JGLOBE
     router-id 10.5.7.10
     redistribute bgp 65001 subnets
     network 0.0.0.0 255.255.255.255 area 0
    router bgp 65001
     bgp router-id 10.4.6.4
     bgp log-neighbor-changes
     bgp graceful-restart restart-time 120
     bgp graceful-restart stalepath-time 360
     bgp graceful-restart
     address-family ipv4
      redistribute connected
     exit-address-family
     address-family ipv4 vrf JGLOBE
      redistribute connected
      redistribute ospf 2
     exit-address-family
     address-family ipv4 vrf JLAN
      redistribute connected
      redistribute ospf 1
     exit-address-family
    ip dns view vrf JGLOBE default
    ip dns view vrf JLAN default
    ip route 0.0.0.0 0.0.0.0 192.168.5.1
    ip route vrf JGLOBE 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.5.1
    ip route vrf JLAN 0.0.0.0 0.0.0.0 192.168.4.1 name LAN_INET
    ip prefix-list GLOBAL-INET seq 5 permit 0.0.0.0/0
    ip prefix-list SERVER-NET seq 5 permit 10.6.40.2/32
    ip prefix-list WIFI-NET seq 5 permit 10.254.0.0/22 le 32

    Hi Matt
    Yes the X/32 routes needs to be present in the VRF Routing-Table and if they are to be learnt statically then the MP-iBGP config for that particular VRF address-family has to redistribute static routes as well.
    Regards
    Varma

  • Cisco CSS and ACE study guide

    Hi,
    Im ready to kick start Cisco CSS and ACE load balancers. I found that 642-972 DCASD and 642-975 DCASI are the relevant exams for that. But, they are expired now. And, I couldn't even find the old materials for those. Could you please anyone assist me in getting started with this?

    Hi Kanwal,
    Thanks for your reply. BTW, wasn't there any specific study guides for 642-972 DCASD and 642-975 DCASI from Cisco? The reason behind this question is, I want to go step by step starting from how load balancing works, the basics and terminologies of load balancing and its various options and operations etc. I have been working with Network Security and just stepping in to DC operations.

  • I have two facetime users, both connecting to our enterprise wireless network (Cisco WCS) and they can't make a facetime connection from IPAD to IPAD.  Are there any apple protocols or other settings that need to be enabled on WCS?  No firewall involved.

    I have two facetime users, both connecting to our enterprise wireless network (Cisco WCS) and they can't make a facetime connection from IPAD to IPAD.  Are there any apple protocols or other settings that need to be enabled on WCS?  There is no firewall inbetween the two connections, as this is all on our internal network. 
    Both devices can connect to the network, but when they try to talk to each other they can't make the connection.
    Thanks.

    If anyone ever comes across this and has the same issue, here's what I did to fix it:
    My Linksys router has a Network Mode setting, and I had to change it from "Mixed" to "Wireless-G only".  (I would've used N but one of the NICs in my house is too old to support it.)  Anyway, after making this change, Facetime works fine on the phone.  Hope this helps someone else!

  • Cisco ACE Module with Bluecoat Cache Proxy, Transparent and spoofing client IP

    Hello Dears,
    I'm trying to implement Cache loadbalancing through Cisco ACE Module.
    I have 2 Bluecoat cache proxies, when i do configure transparent proxy without spoofing client IP, everything work properly, but when I enable spoofing client IP (reflect client IP address), clients are not able to access internet, although they are going to cache servers, I can see their sessions.
    I'm afraid that I have a problem in the returned traffic PBR.
    can anyone help please.
    Thanks

    Hi Ibrahim
    I ahve reviewed the config. The ACE config is all god but I do see some issue with the switch side. If you are doing ip spoofing, then "match ip address" in pbr should be the client ip address. However, what you did is ip address between the ACE and MSFC. Try to configure the test client ip address into the below access-list.
    msfc---vlan 265---ACE--vlan 264----CE farm
    interface vlan 265
      description Interface_With_MSFC_SUBS_2_INTERNET
      ip address 168.168.1.52 255.255.255.248
      access-group input PERMIT_ALL
      service-policy input L3L4_PM
      no shutdown
    ip route 0.0.0.0 0.0.0.0 168.168.1.50
    ip access-list extended HSDPA_2_CACHE
    permit tcp 168.168.0.0 0.0.255.255 any eq www   <<<-- wrong
    ip access-list extended Internet_2_CACHE
    permit tcp any eq www 168.168.0.0 0.0.255.255   <<<---wrong
    interface Vlan 265
    description Interface_With_ACE
    ip address 168.168.1.50 255.255.255.248
    route-map INTERNET_2_HSDPA permit 10
    description "PBR for Response HTTP Traffic"
    match ip address Internet_2_CACHE
    set ip next-hop 168.168.1.52
    route-map HSDPA_2_INTERNET permit 10
    match ip address HSDPA_2_CACHE
    set ip next-hop 168.168.1.52
    regards
    Andrew

Maybe you are looking for

  • Sharing one iTunes account

    We have one computer at home.  My kids and I share one iTunes account.  I would like to separate them out of my account and give them each their own account, and move their music out of my library and in to theirs.  How do I do this?

  • Looking for LP7

    hi there I'm looking for a "used LP7". My partner should have it installed on his older G4 (a bit to slow to work with LP8 or LP9, but still fine with LP7, as i tested). I have to exchange files with him over the net, so we can't "share" my dongle. I

  • Still have blinking amber light

    I've followed the instructions. I've searched the support board, and I still can't get my airport express to work. I've reset it to factory settings, I've unplugged the cable modem and left it off for 15 minutes then replugged everything. My Macbook

  • How to open Elements 8?

    I have just downloaded the free trial version of Photoshop elements 8. The download seem to have gone well. I have the folder on my desk but I can't get it to work. I have tried to right click on a photo and click on open in... but elements 8 doesn't

  • External drive is not viewable in time capsule

    Hi, I am a new mac user. I have macbook pro 2012.  Also bought time capsule 2TB.  I have an older WD 1TB USB external drive that I have connected to the time capsule.  I cannot view the WD drive in finder.  I can see the contents of the time capsule.