6500 ,IP load balancing, VIPA OS/390

I have a HOST with OS/390 and three OSA Fastethernet
and I have define a VIPA. These Three OSA are conected to a 6500 (three differen ports).
VIPA is a Virtual IP Adrres, that I can reach through any OSA adapter.
How can I do if I wanted to balance IP traffic from
6500 to HOST?. Now all my IP traffic is getting
into the host only through one OSA adapter.
Thanks in advance.

Hi Miguel,
What routing protocols are you using (host/network)? The OSPF OMPROUTE server in z/OS CS IP makes use of advanced OSPF V2 techniques for improving availability and performance. For example, it can balance the connection load among up to four alternative routes if the costs of the routes are equal (equal cost multipath). It can also interact with VIPA, whether using RIP or OSPF, to ensure that an IP route is always available to host applications as long as at least one interface to the network is active.
There's also a MULTIPATH keyword in the IPCONFIG parameters of the TCPIP profile that allows enables multipath selection for outbound traffic.
I also suggest you look at the following links for more info regarding the above:
OSPF IBM OSA-E and Cisco 6500 Interoperability:
http://www1.ibm.com/servers/eserver/zseries/networking/pdf/ospf_design.pdf
Networking with z/OS and Cisco Routers: An Interoperability Guide:
http://www.redbooks.ibm.com/redpieces/pdfs/sg246297.pdf

Similar Messages

User restrication on load balance VIP

we need to implement below requirement can any one suggest how to imlement it
1.Sticky command
Once a connection is opened to a physical server, any requests coming from a particular client always go to that server, until either the timeout is reached or the user session is terminated
2.Client-assigned load balancing
All requests coming from a specific client always go to the same physical server. This is done through recognition of the clients IP address.
3.User session restrictions
User name / IP session restriction based on parameter values(ie only 1 user can login at a time).
Please find the below config
service test1
ip address 10.8.1.25
protocol tcp
keepalive type http
keepalive port 80
active
service test2
ip address 10.8.1.26
protocol tcp
keepalive type http
keepalive port 80
active
content DSS-R1
protocol tcp
vip address 10.8.1.1
port 80
advanced-balance sticky-srcip-dstport
add service test1
add service test2
active
please suggest me how to implement all three points whereas point 3 is very crucial & urgent.

1/ is done with the advanced-balance command.
I would suggest to replace the current one with 'advanced-balance sticky-srcip' since the destination port is always 80 [per config].
2/ you can force a client to go to a particular server with an acl and the prefer option.
ie:
acl 1
clause 10 permit tcp x.x.x.x destination content owener/DSS-R1 prefer test1
clause 99 permit any any destination any
apply all
acl enable
3/ we will need more details.
Not much can be done so, because the CSS only counts active connections.
So, you can restrict 1 user at a time with the command 'maxconn 1' but I'm not sure if it will help.
You should test it first and see if it does what you need.
Regards,
Gilles.

CSS11000, load balancing and OS/390 Workload Manager

Is it possible to use the OS/390 Workload Manager with the CSS11000? I have found articles for using a LocalDirector with it but nothing referencing a CSS11000.
Since I don't think the CSS11000 works with WLM is it possible to write a script on the CSS11000 so it can do a TN3270 session and verify the LPAR is up?
Thanks

If you know what TN3270 traffic looks like, you can indeed write script to do whatever you want.
The script language is easy to use
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_administration_guide_chapter09186a0080294d1c.html
Gilles.

Load Balancing on ACE Modules

hi,
Is it possible to load balance VIP hits on two ACE Modules in an active/active configuration. Or is it that only per FT group only single context could be active.
Regards.

You can have 1 context active on one ACE and the other context active on the other ACE.
If you have 2 Vip, you can have 1 vip belonging to one context and the other vip belonging to the other context.
Like this, you split the traffic between the 2 devices which allows you to handle more traffic than what 1 device could normally do.
If one device can handle all your traffic, I prefer to only have 1 active unit and 1 standby.
Easier to implement and troubleshoot.
Gilles.

OAM Webgate Ip validation problem caused by load balancer...

Hi all,
In my topology, i have 5 webgates on 5 OHS web servers running in reverse proxy mode . Those web servers are behind load balancer. Since load balancer is working in proxy mode, all requests seems to be coming from load balancer vip and this prevents ip validation at webgate side . Does anybody think that it is possible to solve this issue without changing load balancer configuration..
Regards,

Hi,
Randat, how can i reconfigure ip validation against x-forwarded-for? A custom authz plugin, or only a configuration change ? I'll keep on searching on this solution, but if you can share your solution , it'll be appriciated..
Ambarishmitra, i want to use ip validation but since all requests are coming from single ip i can't distinguish client ip's, that's my problem..
Thank you both,
Regards..

Access Manager 6 2005Q1 naming service behind load balancer

Access Manager is running on box A & box B using the Sun Web Server as its front end web server. Box A & B both have a complete install of Sun Web Server, Access Manager, and Directory Server. The Directory servers are set up to replicate changes between each other. Our Policy Agents are running on box C & box D under the Apache web servers.
Users will access applications on box C/D via https. The policy agents on box C/D should redirect the user to box A/B (via a load balancer VIP)for authentication. The redirect will be https. Once authenticated the user should be redirected back to box C/D.
All subsequent communications between the Agents on box C/D to AM on box A/B (via load balancer VIP) are http.
The load balancer VIP is setup in active/failover mode so all requests go to one server. We implemented it this way because our load balancers do not support SSL with cookies.
The data returned to the agent from a call to the naming service contains the host name of our AM hosts instead of the load balancer VIP. Subsequent calls from the agent to AM bypass the load balancer and go directly to one of the AM hosts.
We are looking to upgrade our load balancers to a version that supports cookies with ssl in order to take advantage of the second AM host.
How do we configure AM so the values returned by the naming service contain the load balancer VIP instead of the actual AM host names?

Bernhard,
We have upgraded our Web PA to version 2.1-09. One of your previous replies stated the com.iplanet.am.naming.ignoreNamingservice property was not availalbe in the PA agent properties but only in the Java SKD. Indeed we do not see such a key in the new Web PA AMAgent.properties.
Can you please explain how to configure the AMAgent.properties and/or the Access Manager server (or properties) so that subsequent calls to the services (returned by the call to the naming service) get directed thru the load balancer? Below are the setting in our AMAgent and AMConfig properties files
AMAgent.properties
com.sun.am.namingURL = https://lb-mydomain.com:443/amserver/namingservice
com.sun.am.policy.am.loginURL = https://lb-mydomain.com:443/amserver/UI/Login
AMConfig.properties
com.iplanet.am.server.protocol=https
com.iplanet.am.server.host=am.mydomain.com
com.iplanet.am.server.port=443
com.iplanet.am.console.protocol=https
com.iplanet.am.console.host=lb-mydomain.com
com.iplanet.am.console.port=443
com.iplanet.am.profile.host=lb-mydomain.com
com.iplanet.am.profile.port=443
com.iplanet.am.naming.url=https://lb-mydomain.com:443/amserver/namingservice
com.iplanet.am.notification.url=https://lb-mydomain.com:443/amserver/notifica
tionservice
If we set com.iplanet.am.server.host=lb-mydomain.com we get an exception when trying to start the AM web container. I don't know if this may be partof our issue or not. Please comment.
Thanks,
Craig

Load balancing imbalance in ACE

We are facing slowness an http application which is due to connection imbalance. This setup has one set of Load balancer and a proxy in DMZ where the connections gets terminated from the users and a load balancer inside LAN which load balances between the end point servers. All user connections terminate on the DMZ load balancer / proxy and proxy connects back to the internal load balancer VIP. (By collating a number of connections to very few - default proxy behavior) . Internal load balancer VIP does load balancing based on the number of connections in a least loaded manner and this load balancer doesn’t see how many sessions are beneath each connections and it distributes each connection to server underneath. Thus if one connection has around 100 sessions, another may have only a few and each of this gets forwarded to the end server causing the imbalance.
Is there a way that this imbalance can be tackled in this setup.
Users --> Proxy ---> Load balancer (Cisco ACE) --> Server 1
Server 2
Server 3
Least Connections predictor
HTTP Cookie insert sticky

Hi,
Persistance rebalance should solve the issue for you.
The persistent-rebalance function is required if you have proxy users and the proxy shares one TCP connection between multiple users.
With this behavior, inside a single connection you will see different cookies. Therefore, for each cookie, ACE needs to first detect the new cookie and then loadbalance to the appropriate server.
this is from the admin Guide :
The following example specifies the parameter-map type http command to enable HTTP persistence after it has been disabled:
host1/Admin(config)# parameter-map type http http_parameter_map
Host1/Admin(config-parammap-http)# persistence-rebalance
Please refer the following link for more info :
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_2_0/configuration/slb/guide/classlb.html#wp1062907
hope that helps,
Ajay Kumar

App-V 5 Publishing Server + Load Balancing (NetScaler) issue

All,
I have attempted to load balance my App-V 5.0 deployment, which includes two nodes (appv-1 and appv-2) on a Citrix NetScaler VPX appliance.
The management server is working fine, when browsing to the load balanced VIP DNS alias - pass-through authentication works great and the management console is displayed.
When I attempt to browse to the load balanced VIP DNS alias for the Publishing Server, it prompts for authentication credentials, then displays the following error:
Method not allowed. Please see the service help page for constructing valid requests to the service.
When I attempt to browse using the same internet explorer instance to http://appv-1.fqdn:8088 it displays the XML page after entering authentication credentials.
Here is my set-up & what I have done....
Appv-1 Server
Management Server installed on Port:8088
Publishing Server installed on Port:8090
SQL Cluster and Mirroring configured (tested and working)
Appv-2 Server
Management Server installed on Port:8088
Publishing Server installed on Port:8090
SQL Cluster and Mirroring configured (tested and working)
NetScaler
Management VIP: 10.1.1.148
Publishing VIP: 10.1.1.124
Both Appv-1 and Appv-2 are setup as services and bound to the corresponding Virtual Servers.
Load balance alogrith - persistence - source IP: 255.255.255.255 - Least Connection
DNS and AD Modifications
host A record - appvmgmtsrv.fqdn = 10.1.1.148
host A record - appvpubsrv.fqdn = 10.1.1.124
computer object create in same domain for appvmgmtsrv and appvpubsrv
SPN Modifications:
setspn –A http/appvmgmtsrv:8088 domain\appvmgmtsrv
setspn –A http/appvpubsrv:8089 domain\appvpubsrv
setspn –A http/appvmgmtsrv.domain.local:8088 domain\appvmgmtsrv
setspn –A http/appvpubsrv.domain.local:8090 domain\appvpubsrv
IIS Modifications:
Appv-1 and Appv-2 - ApplicationHost.config - modified with below line for both Management and Publishing Server sections:
<windowsAuthentication enabled="true" useKernelMode="true" useAppPoolCredentials="true" />
Rebooted and IIS starts correctly.
Testing
On Appv-1 if I browse to http://appvmgmtsrv.fqdn:8088/console.html it asks for authentication, when authentication is entered it fails.
On another other machine in the environment if I browse to http://appvmgmtsrv.fqdn:8088/console.html it automatically loads the console with the credentials of the logged on user.
Launching the Management Console via Load Balanced DNS name works on every other server except itself.... assume this is Kerberos modifications? (This only happens when I disable the appv-2 node on the load balancer, forcing all IIS connections to Appv-1).
The management server issue above is not a big one and can work around that easily. The major issue is with the Publishing Server. .. .
On Appv-2 if I browse to http://appvpubsrv.fqdn:8090 it will prompt for authentication, once enter it displays: Method not allowed. Please see the service help page for constructing valid requests to the service.
in a new tab if I enter http://appv-1.fqdn:8090 it will prompt for authentication, once enter its displays the XML page with App-V meta-data.
Can anyone shed some light on this issue please.... When I update the App-V client with the load balanced publishing server VIP DNS it displays the following error in the event log:
Getting server publishing data failed.
URL: http://appvpubsrv.fqdn:8090
Error code: 0x45500D27 - 0x80190195
Any help will be greatly appreciated. ....

You could read
https://blog.uvm.edu/jgm/2013/09/26/app-v-5-server-f5-load-balancers-and-kerberos/
https://blog.uvm.edu/jgm/2013/09/27/app-v-server-configuration-load-balanced-configuration/
http://social.technet.microsoft.com/Forums/en-US/2b39e2b8-aba1-4e96-b18f-c5bcb9f12687/load-balancing-two-appv-50-servers-the-publishing-service-is-not-able-to-contact-the-management?forum=mdopappv
http://www.thinclient.net/blog/?p=344
In fact I'm not sure if any of these really helps you, but they give some good advice
Falko
Twitter
@kirk_tn   |   Blog
kirxblog   |   Web
kirx.org   |   Fireside
appvbook.com

CUPS Federation Load Balancing

Hi All,
Need to setup the interdomain CUPS federation with Lync Server. From the federation guide, it says that the only way for High Availability on the CUPS side is to use a Cisco CSS (as it is the only one that supports TLS).
As the CUPS cluster has two nodes, is it supported to instead use Cisco ACE module in the 6500 for load balancing (Lync supports only a single IP)?
Thanks in advance,
Addy

Answer to my question: http://ieoc.com/forums/p/26385/218976.aspx#218976

Cisco ace Load balancer not maintaining session persistence

Hi All,
We have observed from the IIS logs on the internal webservers that loadbalancer is not maintaining session persistence for two specific request for the internal servers.
https://123.xyz.com/Webresource.axd
https://123.xyz.com/ScriptResource.axd
Error
Webresource.axd : 500
Scriptresource.axd: 404
Session persistence is maintained for all other requests hitting loadbalancer.
Issue is observerd on hits for these two specified components. WebResource.axd and ScriptResource.axd are Http Handlers used by ASP.NET and Ajax to add client-side scripting to the outgoing web page.
For e.g /WebResource.axd d=t2GXfySdqWmJ-lZSI0KVbw2&t=634868473645172160 is valid for server 1 and return 200 response but the same request is seen on few other servers where the response is 404 even though load balancer cookie is same. This means that if the request for the both the axd contains a valid decrypter and it connects to the right server then the response seen is 200.
The url passed by the user contains d and t parameters when are unique for each user session.
Solution tried:
Accessed website via another VIP without http redirect rule but could not see difference.
Tried to match machine key across all servers : Failed . Could see the ‘d’ value different for each server.
Load balancer VIP :
x.x.x.x
redirect: http > https
SSL Offload : ON
Poool:
WEB1
WEB2
WEB3
WEB4
WEB5
All servers listening on port 80
sticky config:
sticky ihttp-cookie cookie1 vip-1.1.1.1-80-stickyfarm
cookie insert browser-expire
replicate sticky
serverfarm vip-1.1.1.1_80
sticky http-cookie cookie1 vip-farm:1.1.1.1:443
cookie insert browser-expire
replicate sticky
serverfarm farm:1.1.1.1:443
Has anyone else come across similar issue?
Can you plese check if there is any config on cisco ace that will ensure that session persistence is maintained for these 2 requests.
Thank you for all the help.
regards,
Sangram

Hello Sangram,
We would need simultanous packet traces before and after the ACE to get to the root cause of this issue so I would recommend that you open a cisco tac case for more in depth troubleshooing of this issue.
Joel Lamousnery
CCIE R&S - 36768
Engineer, Customer Support
Technical Services

Having an issue with vpn load balancing certificate on the vip

Hi all,
I am setting up vpn load balancing in a lab. I have two asa's running 8.6. I created a ucc cert from our internal CA that has the vip as the CN in the cert and the two ASA's themselves as subject alternative names. I used open ssl to create the request. In each asa I am using encryption between the ASA's to encrypt the psk's. Since this is a lab and I do not have the DNS servers at my disposal I've added the hostnames and addresses of each ASA to the config in the ASA's. The problem I have is that when I connect to the vip I get a cert error saying the cert doesn't match the name on the site. See below:
"The security certificate presented by this website was issued for a different website's address."
I have a hostfile on my lab pc connected directly to the outside of the ASA that can resolve the name of the vip but when I browse to the vip I get the cert error. If I click proceed anyway the asa redirects me and the page opens without error on one of the two ASA's.
Does any one know what the CN of the cert should be for vpn load balancing. I thought the CN would be the vip but sometinhg is not right.
Any help is appreciated.
Thanks.

Issue resolved. Switched the order of the trustpoints on the outside and vpn load balance.

Interesting ACE URL Header & Load-balance & SSL on 2 VIPs

Hi There
I have an interesting situation that I am trying to solve. I have 4 websites, each one with SSL Off-Loading on the ACE on the outside. All FOUR websites run on a single server on the inside, but each website is using a different port number for differentiation. Also, they are currently only available on TWO IPs on the outside! I know.....it's a mare!
So, RSERVER = SERVER = 192.168.0.1
Each website has SSL Certs on the outside. https://website1.abc.com - https://website4.abc.com
But, DNS is only bound to 2 IPs on the outside, as that is all we have available currently, until we free up more IPs.
OUTSIDE:
website1.abc.com = 172.16.0.1:443
website2.abc.com = 172.16.0.1:443
website3.abc.com = 172.16.0.2:443
website4.abc.com = 172.16.0.2:443
On the server we have:
INSIDE: 192.168.0.1
SERVER:8001 = website1.abc.com
SERVER:8002 = website2.abc.com
SERVER:8003 = website3.abc.com
SERVER:8004 = website4.abc.com
So, in a nutshell what I need to do is:
Terminate SSL for each website, then match the HTTP header, and pass it to the SERVER on the right port. Sounds easy enough.
But, I am struggling like hell. The VIPs (Wirtual IPs on the OUTSIDE are causing me grief) My steps seem to be breaking my ruleset. Individually they all work, but once I tie them to the VIPs on the outside, it seems to stop. The first site in each CM (class-map) match in the PM (Profile-Map) works but the subsequent site just breaks.
I would post my config, but right now I have sooooooooooooo many variations, it looks like a dog's breakfast.
Can anyone give advice on the process flow to follow to get this to work. My issue is arround the VIPs mainly. To be honest, I don't really care about Load-Balancing right now. That will come later when more servers are added to mix. And then we might have to do inbound NAT too to the Server Farm, but that can wait! :-o
I have created a HEADER map for the headers, individual SERVER FARMS for each port on the RSERVER, ACLs matching the VIPs inbound on 443, CLASS-MAPs matching the HEADER and applying to SFARM, POLICY MAPS matching the CMAPs and doing Load-Balancing with SSL-PROXYs for the SSL headers. SERVICE-POLICY tieing it all together on Interface.
But .... things are going hey-wire.
So, steps are:
RSERVER
SFARMs = RSERVER:PORTs
ACLs = VIPs
CMAP = HEADER = URL
LB PMAP = HEADER CMAP & SFARM
PMAP MULITM = ACL CMAP + LB PMAP & SSL-Proxy
SVC-POL = PMAP MULTIM

Hi Surya
Thanks for the prompt reply. I'm not quite sure what you mean when you say it ca only handle 2 certs. Can you elaborate please?
It would appear to me that you can actually only bind one cert to an IP, based on using a VIP address for the server farm as per the CM in the PM. I can hack out the irrelevant bits tomorrow and post what I have done thus far. I have played with multiple lines of code and various ways of trying to do this, but the end result is that it appears once I have the CM set per VIP I can only set one SSL-Proxy, and so only one cert. If I use multiple CMs, as per the MultiMatch policy, it matches the first CM against the VIP and doesn't appear to move on as per the HTTP Header. If any of that makes sense?
regards
Sent from Cisco Technical Support iPad App

Load balancing FTP/HTTP on same VIP

Hi,
Please could someone confirm if it is possible to load balance FTP and HTTP on same VIP? Would something like this work in a one-armed design?
class-map match-any WCVS
2 match virtual-address 20.0.0.1 tcp eq www
4 match virtual-address 20.0.0.1 tcp eq ftp
policy-map multi-match int3
class WCVS
    loadbalance vip inservice
    loadbalance policy VS-l7slb
    inspect ftp
    nat dynamic 5 vlan 20
int vl20
service-policy input int3

Hello,
I assume you want to ultimately use cookie sticky, since it is in your config, but not yet used. The '80' next to the rservers within the serverfarm will keep FTP from working because that will force the ACE to always use a destination port of 80 to the rservers, which is good for HTTP, but not so good for FTP. Below is your config with some modifications. I've created a new serverfarm for FTP, created a new probe for that farm, included HTTP cookie-sticky, and created a new L7 policy-map. There is one line that I would like you to remove and see if it works. If it does not, then add this line and see if it works.
Let me know how it goes...
logging enable
logging buffered 6
access-list ALL line 8 extended permit ip any any
access-list ALL line 16 extended permit icmp any any
probe http Probe_HTTP
interval 5
passdetect interval 60
expect status 200 200
open 2
receive 2
probe tcp Probe_FTP
port 21
interval 5
passdetect interval 60
open 2
receive 2
rserver host Server1
ip address 10.10.10.10
conn-limit max 4000000 min 4000000
inservice
rserver host Server2
ip address 10.10.10.11
conn-limit max 4000000 min 4000000
inservice
serverfarm host FARM-HTTP
probe Probe_HTTP
rserver Server1 80
    conn-limit max 4000000 min 4000000
    inservice
rserver Server2 80
    conn-limit max 4000000 min 4000000
    inservice
serverfarm host FARM-FTP
probe Probe_FTP
rserver Server1
    conn-limit max 4000000 min 4000000
    inservice
rserver Server2
    conn-limit max 4000000 min 4000000
    inservice
sticky http-cookie XXX_tempCookie XXX_tempCookie
cookie insert
serverfarm FARM-HTTP
class-map type management match-any Management
201 match protocol http any
202 match protocol https any
203 match protocol icmp any
204 match protocol kalap-udp any
205 match protocol ssh any
206 match protocol telnet any
207 match protocol xml-https any
class-map match-any XXX-WCVS-WWW
2 match virtual-address 10.10.10.100 tcp eq www
class-map match-any XXX-WCVS-FTP
2 match virtual-address 10.10.10.100 tcp eq ftp
3 match virtual-address 10.10.10.100 tcp range 1023 65535   <-- try first without this, then with this
class-map match-any NAT-VIP
2 match destination-address 10.10.10.100 255.255.255.255
policy-map type management first-match Management
class Management
    permit
policy-map type loadbalance first-match XXX_VS-l7slb-WWW
class class-default
    sticky-serverfarm XXX_tempCookie
policy-map type loadbalance first-match XXX_VS-l7slb-FTP
class class-default
    Serverfarm FARM-FTP
policy-map multi-match int3
class XXX-WCVS-WWW
    loadbalance vip inservice
    loadbalance policy XXX_VS-l7slb-WWW
class XXX-WCVS-FTP
    loadbalance vip inservice
    loadbalance policy XXX_VS-l7slb-FTP
    inspect ftp
class NAT-VIP
    nat dynamic 5 vlan 12
interface vlan 12
ip address 10.10.10.1 255.255.255.0
alias 10.10.10.3 255.255.255.0
peer ip address 10.10.10.2 255.255.255.0
access-group input ALL
nat-pool 5 10.10.10.100 10.10.10.100 netmask 255.255.255.0 pat
service-policy input Management
service-policy input int3
no shutdown
ip route 0.0.0.0 0.0.0.0 10.10.10.254

ACE Load Balance setup and testing - vip

Got a new ACE 4710 and am I new to the appliance. I am testing out a senario with load balancing between two servers. In testing when I ping the VIP ip address the replies I see are from the real server ip addresses. I am just wondering if this is the correct normal behavior or should I see the ping replies coming from the VIP ip address?
Thanks

Do you use the
    loadbalance vip icmp-reply active
command?
policy-map multi-match POL45
class VStest
    loadbalance vip inservice
    loadbalance policy L7SLBPOLtest
    loadbalance vip icmp-reply active

Cisco load balancer with Real to VIP mapping ?

Hi ,
brief about the setup -
Client IP x - Virtual server IP y = Real server IP's A , B ,C
I know that by SLB we can map traffic originating from Client IP x to VIP y towards any of real server IP's (A,B,C).
I want to know how we can map traffic originating from Real server IP's(A,B,C) so that when it reaches Client IP x the source IP should be VIP y.
Please can some body help with this query !!!!

If the real server's default gateway is to the load balancer, whatever that object may be, you could be able to source NAT to the VIP address. With real load balancer I.e. F5's / ACE / netscaler, it's very easy to manipulate the packets and traffic flow

6500 ,IP load balancing, VIPA OS/390

Similar Messages

Maybe you are looking for