ACE 4700 Module and SNMP

I am trying to monitor my ACE module via SNMP and am having trouble finding out how to get a couple of items.
I can't find the memory utilization/free memory, either for the system as a whole or per context. Thus far I can only find the per process utilization which would require me to try to add up all of the processes.
I would also like to try to get some of the hit counters and byte counters that are available from "show service-policy". Are these available via SNMP?
Thanks,
Mark

The MIB for the 4710 can be found at http://www.cisco.com/cgi-bin/tablebuild.pl/ace4710. You will need CCO download access to get this and should include what you are looking for.

Similar Messages

Monitoring the Cisco ACE module with SNMP

We use 2 redundant Cisco ACE loadbalancer in our datacenter
The models are ACE20-MOD-K9 with software A2(2.0)
Does anybod know how to monitor the environment (cpu, memory) of such a module with snmp?
We were not able to find an applicable MIB for that module.
The CISCO-PROCESS-MIB.oid (ftp://ftp.cisco.com/pub/mibs/oid/CISCO-PROCESS-MIB.oid) seems not to reflect the correct oid's.
What are the correct oid's for cpu and memory?
Where can I find a detailed documentation for snmp-monitoring the cisco ace module?
thanks

Hi Patrik,
to monitor the ACE I use these two MIB's:
ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SLB-MIB.my
ftp://ftp.cisco.com/pub/mibs/v2/CISCO-ENHANCED-SLB-MIB.my
Example for CPU:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Normale Tabelle";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
cpmCPUTotalEntry 1.3.6.1.4.1.9.9.109.1.1.1.1
The resource usage and other interesting things you will find with a MIB browser.
Achim

SNMP Trap modules and env

Hi,
I would like to know what the equivalent command to enable snmp traps module and env in IOS XR.
The IOS command is like below :
snmp-server enable traps module
snmp-server enable traps envmon fan shutdown supply temperature status
i could not find similar command in IOS XR. is it the same with "snmp-server traps system" in IOS XR ?

Hey,
You will need to configure "snmp-server traps sensor" to enable the traps under the CISCO-ENTITY-SENSOR-MIB. You can use the following docs to check whether these are supported on your XR platform.
For ASR9k, (table 3-2 lists the supported Traps on the ASR9k),
http://www.cisco.com/en/US/docs/routers/asr9000/mib/guide/asr9kmib3.html#wp1602338
For the GSR XR,
ftp://ftp.cisco.com/pub/mibs/supportlists/xr12000/xr12000-supportlist.html
For the CRS-1,
ftp://ftp.cisco.com/pub/mibs/supportlists/crs1/crs1-supportlist.html
Thanks and regards,
Rahul.

ACE and ANM, Syslog and SNMP Traps

Hi guys.. another ACE/ANM question.
I configured the ACE devices to send Syslog and SNMP messages to the ANM server. But i got a couple of questions:
Whats the difference between using the:
logging history 4 (this would send logging messages as SNMP traps according to doc)
And:
snmp-server host x.x.x.x traps version 2c public
snmp-server trap-source vlan 1000
This of course I think should do the same..
The funny and weird thing, in the ANM Event viewer, I can only see syslog messages, not one snmp event.
Thanks!
Omar
PS: ACE ver A2.4
ANM Ver 4.2

Hi Omar,
Let's see if I can clarify your questions.
As you mentioned, the "logging history 4" command specifies that, syslog messages of severity 4 and higher will be sent as SNMP traps. After you configure it, you need the "snmp-server host x.x.x.x traps version 2c public" command to specify what will be the destination IP and SNMP community for these traps.
It would only make sense to use the "logging history 4" command if your monitoring application doesn't support receiving syslog messages. However, since ANM is able to get syslog messages from the ACE without issues, I would just configure a destination for syslog message instead (with "logging host x.x.x.x")
I hope this makes this point more clear.
Now, moving on to why you are not seeing any SNMP traps in your ANM, the first things you would need to check are:
-- Did you enable traps? You would use the "ACE(config)# snmp-server enable traps" command for this
-- Are traps being sent? You can use the "show snmp" command and check if the "Trap PDUs" counter increases
-- Is ANM getting these traps? This is the most complicated step. For this, I would recommend getting a traffic capture on the ANM server (if it's installed on linux) or as close as possible to it if it's a ANM appliance
I hope this helps
Daniel

Can ACE module and 4710 appliance work redundant together

Hi.
I am setting up a testlab for ACE loadbalancing and need to test functionality on both the ACE module and the 4710 appliance.
Can one of each of these two be set up redundant together with full functionality? Or do I have to test redundancy for 2x ACE modules and 2x 4710 appliances seperate?
Thanks in advance for any help!

It won't work.
The code checks if the devices are the same during the HA negotiation.
If you do a 'show ft peer detail' you should see at the end :
SRG Compatibility : WARM_COMPATIBLE
License Compatibility : INCOMPATIBLE
These 2 entries indicate if the box are compatible to run HA between each other.
The version is checked and the license.
Both would be different between an ACE module and ACE appliance.
Gilles

Difference between ACE module and ACE appliance

Hi All,
Can someone help to understand the difference between ACE module and ACE appliance, as i am observing ACE module is providing more throughput when compared the ACE appliance, Is the only advantage we getting with contexts ....
thanks inadvance,
Narayana Mallidi

Hi Narayan,
Apart from providing throughput, ACE module has more to offer ,
http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Troubleshooting_Guide_--_ACE_Resource_Limits
The above link will provide a comparision of ACE module and Ace appliance interms of scalability. Apart from that legacy modules wont support compression, but ACE 30 module can support compression.
The major advantage of ACE 30 module is with resepct to SSL throughput, SSL TPS, L4 & L7 CPS, & Concurent Connections per second, apart from the increased contexts
ACE 4710 Data Sheet :
http://www.cisco.com/en/US/prod/collateral/contnetw/ps5719/ps7027/Data_Sheet_Cisco_ACE_4710.html
ACE20 Data Sheet
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/product_data_sheet0900aecd8045861b.html
ACE 30 Data Sheet
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/data_sheet_c78_632383.html
Regards
Abijith

ACE 4700 load balancing Issue

Hi,
I am new in ACE 4700. I have configured ACE 4700 for load balancing the FAX servers. Probe, ServerFarm, Real server, Virtual server, VIP state every thing is up and in service. But I am not able to access the real server using VIP IP address.
Below is the running configuration. Please help me to troubleshot the problem.
HOB-ACE-1/Admin# sh run
Generating configuration....
no ft auto-sync startup-config
boot system image:c4710ace-mz.A3_2_0.bin
hostname HOB-ACE-1
interface gigabitEthernet 1/1
description Man_HOB_1
switchport access vlan 1000
no shutdown
interface gigabitEthernet 1/2
description VIP_HOB_1
switchport access vlan 24
no shutdown
interface gigabitEthernet 1/3
description HA_HOB_1
switchport access vlan 180
no shutdown
interface gigabitEthernet 1/4
shutdown
[7m--More-- [m
access-list ALL line 8 extended permit ip any any
probe icmp ICMP_PROBE1
interval 15
faildetect 4
passdetect interval 60
passdetect count 5
receive 5
rserver host MFREFSAS497
description MAAFAXSERVER
ip address 10.16.12.148
conn-limit max 4000000 min 4000000
inservice
rserver host MSHOFCFS489
description HOBFAXSERVER
ip address 10.26.12.130
conn-limit max 4000000 min 4000000
inservice
[7m--More-- [m
[K
serverfarm host SFHOBACE-1
description SFHOBACE-1
predictor hash header Accept
probe ICMP_PROBE1
rserver MFREFSAS497 80
    conn-limit max 4000000 min 4000000
    inservice
rserver MSHOFCFS489 80
    conn-limit max 4000000 min 4000000
    inservice
class-map match-all VSHOBACE-1
2 match virtual-address 10.26.24.242 any
class-map type management match-any remote_access
201 match protocol xml-https any
202 match protocol icmp any
203 match protocol telnet any
204 match protocol ssh any
205 match protocol http any
206 match protocol https any
207 match protocol snmp any
[7m--More-- [m
[K
policy-map type management first-match remote_mgmt_allow_policy
class remote_access
    permit
policy-map type loadbalance first-match VSHOBACE-1-l7slb
class class-default
    serverfarm SFHOBACE-1
policy-map multi-match global
class VSHOBACE-1
    loadbalance vip inservice
    loadbalance policy VSHOBACE-1-l7slb
    loadbalance vip icmp-reply
    nat dynamic 1 vlan 24
    nat dynamic 1 vlan 1000
service-policy input global
interface vlan 24
description "Client VLAN"
ip address 10.26.24.243 255.255.255.0
[7m--More-- [m
access-group input ALL
no shutdown
interface vlan 1000
ip address 10.26.12.132 255.255.255.0
peer ip address 10.26.12.133 255.255.255.0
access-group input ALL
service-policy input remote_mgmt_allow_policy
no shutdown
ft interface vlan 180
ip address 192.168.180.2 255.255.255.248
peer ip address 192.168.180.3 255.255.255.248
no shutdown
ft peer 1
heartbeat interval 300
heartbeat count 10
ft-interface vlan 180
ft group 1
peer 1
priority 140
associate-context Admin
[7m--More-- [m
inservice
ip route 0.0.0.0 0.0.0.0 10.26.12.1
snmp-server contact "HOB_ACE"
snmp-server location "HOB"
snmp-server community FAXSERVER group Network-Monitor
snmp-server user administrator Network-Monitor
snmp-server trap-source vlan 1000
username admin password 5 $1$GtO1e504$eGuyxxDcXck7SkxqBfRkI. role Admin domain
default-domain
username www password 5 $1$N5ClX7jy$kDhGgN.uukWQKvQMd3pY.1 role Admin domain de
fault-domain
ssh key rsa 1024 force
Thanks and Regards,
Ashfaque

Hello Hossain,
Applying the policy globally on the box is commonly not the prefered way to go, you can use instead a single multi-match policy per SVI for easier managent; this will also also help to narrow down problems to a specific policy and VIP while T-Shooting.
Use the
ACE/Admin(config)# no service-policy input global
ACE/Admin(config)# interface vlan 24
ACE/Admin(config-if)# service-policy input global
Also you want to remove the NAT from the multi-match policy, you're running in routed mode so NAT should not be required; if it was required then you don't have any natpool configured or as Ahmad mentioned it was truncated from the configuration.
Something that caught up my attention is that your default route is pointing to the server VLAN that happens to be also your management VLAN, I'll have to lab it up but my first impression is that either the traffic coming to the VIP on vlan 24 should be always NAT'd to an IP of 10.26.24.X/24 before it gets to the ACE or else there will be a routing loop that will not allow the flow to complete correctly.
Do you happen to have a quick logical diagram of this piece of the network?
Thnx
Pablo

ACE 4700 configuring SSL termination weblogic server 10.3.6

Hello,
Im trying to configure an ACE 4700 so that SSL termination is done on the ACE and HTTP reaches the weblogic server instance.
I have a working setup of a Apache reverse proxy doing SSL offloading and using a weblogic module and that works fine
Was reading http://docs.oracle.com/cd/E23943_01/web.1111/e13709/load_balancing.htm#i1045186
Can anyone point me to a working config example for doing this with the ACE4700 or give me some directions here?
Kind regards,
Laurens

Hi Laurens,
Here is a basic configuration for SSL termination:
rserver host test
ip address 10.198.16.98
inservice
rserver host test2
ip address 10.198.16.93
inservice
serverfarm host test
rserver test 80
    inservice
rserver test2 80
    inservice
ssl-proxy service TEST
key cert
cert cert
class-map match-all VIPSSL
2 match virtual-address 10.198.16.122 tcp eq https
policy-map type loadbalance first-match test
class class-default
    serverfarm test
policy-map multi-match clients
class VIPSSL
    loadbalance vip inservice
    loadbalance policy test
    loadbalance vip icmp-reply active
    nat dynamic 1 vlan 112
    ssl-proxy server TEST
interface vlan 112
ip address 10.198.16.91 255.255.255.192
access-group input Allow_Access
nat-pool 1 10.198.16.122 10.198.16.122 netmask 255.255.255.192 pat
service-policy input NSS_MGMT
service-policy input clients
no shutdown
Cesar R
ANS Team

ACE Dup ACK and TCP Out-of-order

Hi,
I have a pair of FT ACE 4710 offloading https traffic to a couple of webservers. We are seeing very high network utilisation when I capture the client facing port of the active ACE. There appears to alot of duplicate ACKs and TCP out-of-order packets (as shown by wireshark). Does anyone know if this is a problem with the ACE or "normal"
Thanks

I've seen some similar behaviour with the ACE Module and Apache webservers. To mitigate this I've configured the following which seems to work.
On the ACE Module
parameter-map type http ALL-HEADERS
persistence-rebalance
parameter-map type connection TCP-OPTIONS
set tcp syn-retry 5
tcp-options timestamp allow
policy-map multi-match test-policy
class http-vip
    loadbalance vip inservice
    loadbalance policy http-test-pm
    loadbalance vip icmp-reply active
    appl-parameter http advanced-options ALL-HEADERS
    connection advanced-options TCP-OPTIONS
On Apache here are the two test results with keepalive on and off
httpd.conf
KeepAlive Off
MaxKeepAliveRequests 1024
KeepAliveTimeout 30
MK-ACE01/001# show serverfarm MK-FARM-sf
serverfarm     : MK-FARM-sf, type: HOST
total rservers : 8
                                                ----------connections-----------
       real                  weight state        current    total      failures
   ---+---------------------+------+------------+----------+----------+---------
   rserver: MK-HOST10
       10.10.1.10:0          8      OPERATIONAL 321        510863     16442
   rserver: MK-HOST11
       10.10.1.11:0          8      OPERATIONAL 304        512718     16276
   rserver: MK-HOST12
       10.10.1.12:0          8      OPERATIONAL 286        524207     17257
   rserver: MK-HOST13
       10.10.1.13:0          8      OPERATIONAL 291        516987     16626
   rserver: MK-HOST14
       10.10.1.14:0          8      OPERATIONAL 291        513016     16594
   rserver: MK-HOST15
       10.10.1.15:0          8      OPERATIONAL 311        510177     16434
   rserver: MK-HOST16
       10.10.1.16:0          8      OPERATIONAL 345        516340     16708
   rserver: MK-HOST17
       10.10.1.17:0          8      OPERATIONAL 282        513046     16418
httpd.conf
KeepAlive On
MaxKeepAliveRequests 1024
KeepAliveTimeout 30
MK-ACE01/001# show serverfarm MK-FARM-sf
serverfarm     : MK-FARM-sf, type: HOST
total rservers : 8
                                                ----------connections-----------
       real                  weight state        current    total      failures
   ---+---------------------+------+------------+----------+----------+---------
   rserver: MK-HOST10
       10.10.1.10:0          8      OPERATIONAL 0          553        0
   rserver: MK-HOST11
       10.10.1.11:0          8      OPERATIONAL 0          551        0
   rserver: MK-HOST12
       10.10.1.12:0          8      OPERATIONAL 0          552        0
   rserver: MK-HOST13
       10.10.1.13:0          8      OPERATIONAL 0          555        0
   rserver: MK-HOST14
       10.10.1.14:0          8      OPERATIONAL 0          554        0
   rserver: MK-HOST15
       10.10.1.15:0          8      OPERATIONAL 0          551        0
   rserver: MK-HOST16
       10.10.1.16:0          8      OPERATIONAL 0          550        0
   rserver: MK-HOST17
       10.10.1.17:0          8      OPERATIONAL 0          550        0
This seems to of reduced the large number or re-transmits and dup-acks.

ACE 4700 one-arm design with SSL termination

Hi,
We are evaluating the one-arm design for the ACE 4700 and need some clarifications:
1. Are there any limitations in the one-arm design and the SSL offloading
2. Can the ACE be configured with an IN and an OUT vlan to the router
CLIENT -> Router -> ACE IN -> ACE OUT -> Router -> Server Vlan
so that the SSL and the clear text traffic is in a separate Vlan?
3. In some sample configuration i saw SNAT configuration on the ACE to modify the client IP. This i assume is for instructing the return traffic from the server to go through ACE? Using SNAT we eliminate the requirement for NAT or PBR on the router? Will i still be able to insert the client IP address after the SSL offload?
I would appreciate if you can share some sample configs
Regards,
George Georgiou

There are two ways to implement One Arm topology.
1. One Arm with PBR & 2.One Arm with SRC NAT
PBR/Source Nat is needed to ensure that the return traffic from Real Servers should not bypass ACE.
1. Are there any limitations in the one-arm design and the SSL offloading
The limitations/config issues I can think of are following
One ARM with PBR:
Direct access to Servers require the enabling of Assymtric routing (by turning off Normalization). If direct server access is not required then you dont need to enable assymtric routing. Now for these assymetric connection (Direct Server Access return traffic) its required to purge idle connections more frequently (default being one hour).
One ARM with SRC NAT:
You will loose the client information. Server logs will show the connections initiated from NAT IP Pool configured on ACE.
2. Can the ACE be configured with an IN and an OUT vlan to the router
CLIENT -> Router -> ACE IN -> ACE OUT -> Router -> Server Vlan
so that the SSL and the clear text traffic is in a separate Vlan?
Yes you can do that but wouldnt it make it routed mode topology?
3. In some sample configuration i saw SNAT configuration on the ACE to modify the client IP. This i assume is for instructing the return traffic from the server to go through ACE? Using SNAT we eliminate the requirement for NAT or PBR on the router? Will i still be able to insert the client IP address after the SSL offload?
As I said earlier you loose the Source IP address with SRC NAT. But with ACE you have an option to use header-insert and insert this source ip as an HTTP Header.
Details at
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/slb/guide/classlb.html#wp1040008
HTH
Syed Iftekhar Ahmed

SNAT on ACE 4700 in bridging mode

Hi,
I would like to implement Source-NAT for some traffic, but not all traffic for the ACE 4700. The ACE 4700 will be configured as a bridge.
Can I configure Source-NAT using an extended access-list when the ACE 4700 is used as a bridge? I need Source-NAT for servers that need to access the VIPs on the ACE. All VIPs and real servers are on the same IP subnet. I was going to configure the ACE as a bridge so that IP addresses don't have to change.
Let me know how Source-NAT will work in this bridging scenario. If not, what examples or options do I have?
Thank you.

Thanks, Gilles!
So, does it mean I can just use a standard access-list to identify traffic for Source-NAT? Meaning, I can just Source-NAT based on source IP addresses instead of using an extended access-list to specify both source address and destination VIP?

ACE 4700

How many maximum SSL Concurrent sessions can be achieved on ACE 4700 Appliance?
Can ACE 4700 allows SSL and clear text sessions simultaneously to establish the connection to the same server farm?
If I have to run two ACE 4700 Appliance to achieve redundancy, what would be the best mode to achieve max redundancy?

Hi,
>How many maximum SSL Concurrent sessions can be achieved on ACE 4700 Appliance?
Depends on software-license.
>Can ACE 4700 allows SSL and clear text sessions simultaneously to establish the connection to the same server farm?
do you mean serverfarm or server?
If you don't terminate ssl on ACE then you need 2 serverfarms. One for http and one for https.
>If I have to run two ACE 4700 Appliance to achieve redundancy, what would be the best mode to achieve max redundancy?
We use active/standby. Failover-time 1-2 seconds.
Regards, Celio

ACE 30 Module Active-Active configuration

Hi,
We have two ACE 30 module in two Cat 6k with multiple contexts. And our requirement is to have both the boxes active for some context. We have configured the ft vlan, ft peer and ft group for each context on ACE level. And on Cat 6k, L2 vlan is created for ft and mapped with ACE service module with svlvc command. The interface on switch used for ft is configured as Access port with ft vlan. But when we try to do Failover testing by shutting down the upstream link of ACE2, the active context on the ACE2 is not failing over to ACE1. Let me know whether we need to do any additional configuration to achieve this.? . The running configuration is as below,
@ Cat 6K,
Vlan 999
name ft_vlan
svclc multiple-vlan-interfaces
svclc module 2 vlan-group 100
svclc vlan-group 100 201,203, 999
int gi 1/3
switchport
switchport mode access
switchport access vlan 999
@ ACE 30,
ft interface vlan 999
ip address 2.1.1.1 255.255.255.252
peer ip address 2.1.1.2 255.255.255.252
no shutdown
ft peer 1
heartbeat interval 100
heartbeat count 10
ft-interface vlan 999
ft group 1
peer 1
priority 105
peer priority 90
associate-context Admin
inservice
ft track interface INT-VLAN-203
track-interface vlan 203
priority 100
peer priority 50
ft group 2
peer 1
priority 105
peer priority 90
associate-context Context1
inservice
ft group 3
peer 1
priority 90
peer priority 105
associate-context Context2
inservice
ft group 4
peer 1
priority 105
peer priority 90
associate-context Context3
inservice
Thanks in advance,
Divya

Hello Divya!
It should work assuming the following:
1.) You have a trunk/portchannel between the ACE's will all vlans each context is using including 999 for FT)
2.) You are using bridged mode on ACE or one-armed with on alias. OR you are using routed mode with an alias IP that is used as the server gateway.
Can you login to the admin context on each ACE and issue "show ft group detail" and send it back to the alias? Also, "show run interface"/"show run rserver" from each context would be useful to see the way you have the configuration setup.

Memory modules and hard drive not recognized

I removed and reinserted the factory installed Satellite L505D-LS5007 laptop hard drive and memory modules just as practice for installing a hard drive upgrade and an 8GB memory upgrade. The problem is obviously with the memory and not with the hard drive.
After the first practice try, one memory module was recognized. Also for a few seconds after the first practice try, I ran the PC with the battery installed, but no memory installed. I did not look in the User's Guide first to see that I should have removed the battery before removing the memory.
Now the System Indicator Lights for the HDD Activity and Memory Card Reader do not light up. The PC turns on and the display is solid black with no messages.
Before buying new memory modules, what possible ways might there be to get the PC to recognize the factory installed memory modules and hard drive again?
Solved!
Go to Solution.

When troubleshooting, I always change one variable at a time. I would hate to miss a solution by being in a hurry. In this case, you may have damaged either the RAM or the RAM slot. I would stick with the Toshiba specifications for the RAM, making sure it is the correct size, speed and type recommended. I also recommend that when you replace the RAM that both modules be from the same manufacturer, size, and specification. Try one RAM module in one slot and then the other. And then try both RAM modules in both slots. After the testing you should be able to figure if this is a RAM problem or a RAM slot problem.
In the case of hard drives, the real test is whether or not the Bios sees the hard drive. If the Bios doesn't see the hard drive, it's not going to work. The Bios should see the hard drive whether or not the hard drive is partitioned, formatted or has data on it. My experience has been that many Toshiba laptops will work fine with larger capacity hard drives provided they are the same speed in RPMs, have the same interfacing connection and physically the same size.
Again, prior to doing any work on your computer, make sure that both the AC power has been disconnected and the battery has been removed. Be careful out there. A blown repair job by a non-Toshiba tech is NOT covered under warranty.

Who worked with ICS' Model 4896 GPIB? I can not count the data from the module. Can prompt as it to make. It is desirable with examples (data read-out from the module and data transmission between channels. It is in advance grateful.

I can not count the data from the module. Can prompt as it to make. It is desirable with examples (data read-out from the module and data transmission between channels. It is in advance grateful.

Hello. Most of the engineers in developer exchange are more familiar
with NI products. Contacting ICS for technical support is a better
course of action.

ACE 4700 Module and SNMP

Similar Messages

Maybe you are looking for