ACE 4710 icmp/routing behavior

Hello,
I'm using an ACE4710 as load balancer.
I have 3 Interface
INTERNET 10.47.100.249 255.255.255.0
INTRANET 10.47.99.240 255.255.255.0
PROXY 10.47.98.240 255.255.255.0
Traffic coming from INTRANET is balanced on interface PROXY if is HTTP.
Routing table is
0.0.0.0 10.47.100.190
10.44.0.0/14 10.47.99.254
When I issue a tracert to i.e www.cisco.com
tracert www.cisco.com
www.cisco.com [198.133.219.25]
my.router.com [10.47.2.234]
www.cisco.com [198.133.219.25]
www.cisco.com [198.133.219.25]
www.cisco.com [198.133.219.25]
www.cisco.com [198.133.219.25]
etc ...
It seams that once the ICMP ECHO TTL Exceeded reply pass through the ACE the ACE instead to Send the ECHO TTL Exceeded with IP source is IP is sending back the SOurce IP of the requested destinatin in this case www.cisco.com. Is that correct ?

I tried that but is not working ..
access-list icmp_traffic line 10 extended permit icmp any any
class-map match-any ICMP_traffic
description ip inspect ICMP
2 match access-list icmp_traffic
policy-map multi-match L4_SLB_POLICY
class L4_WEB_TRAFFIC
loadbalance vip inservice
loadbalance policy HTTP_SLB_POLICY
class ICMP_traffic
inspect icmp error
and I also did
interface vlan 950
no normalization
no icmp-guard
interface vlan 953
no normalization
no icmp-guard
interface vlan 954
no normalization
no icmp-guard
the ACE seams always replace the IP header addres of the error packet ..

Similar Messages

  • Ace 4710 - same context routed and load-sharing

    Hi All
    Can an ACE 4710 have , in the same context - servers which are
    a. just being routed to
    b. a set of load-shared servers
    I have been told you may not be able to do this on this version
    Does anyone know if this is correct
    Thanks
    Steve

    Hi Boris
    I have been on the ACE course and before we install the 4700 box i have been
    asked to set up a test setup.
    This would involve have a context which would have one ip address range and
    a few pcs (pretending to be servers ) and one which would be just routed.
    A colleague of mine seemed to think that something had been said on the course
    to the effect that if the ACE was deployed  in line the you couldnt have some
    of your servers in load-sharing and some just routed on the same subnet and
    in the same context.
    Steve

  • Can ACE 4710 send ICMP-dest-unreachable?

    Dear Community!
    We have previously configured an ACE context for implementing redundant corporate DNS service and now testing a transparent ACE context and HA configuration.One virtual-IP is configured for UDP/53, listening for DNS requests. Behind the VIP, there are 3 DNS server. The next step of our testing process, we have shut down all real-server instance behind the virtual-IP while inspecting DNS clients behaviour. Besides the DNS clients requesting the virtual-IP DNS service need ICMP-destination-unreachable packet to switchover the secondary DNS server.
    Can ACE 4710 send ICMP-dest-unreachable?
    Thanks in advance!
    Regards,
    Belabacsi
    from Hungary

    Unfortunately the 4710 does not send icmp unreachable when a vserver is down.
    If you have backup dns service, you can configure it on ace itself.
    Gilles.

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • ACE 4710 in bridge mode not working

    I am trying to configure ACE 4710 bridge mode and I am stuck up in physical interface configuration. I have configured gig1/2 of ACE as trunk port and on layer 2 switch I have assigned that interface (gig1/2) to VLAN 11. I tried trunk port also but it got disabled due to BPDU error.
    I am not able to ping servers as well as gateway. Below are the topology and context configuration:
    Router   (vlan 13: IP 172.16.11.254)
         |
    ACE     (int gig1/2)
         |
    L2 Switch
         |
    Servers (vlan 11: IP 172.16.11.1 and 11.2)
    Admin Context
    ===========
    resource-class rc1
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 0.20 maximum unlimited
    boot system image:c4710ace-mz.A3_2_4.bin
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      switchport trunk allowed vlan 11,13
      no shutdown
    interface gigabitEthernet 1/3
      shutdown
    interface gigabitEthernet 1/4
      shutdown
    access-list ALL line 8 extended permit ip any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    interface vlan 1000
      ip address 172.16.16.16 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.16.254
    context test
      allocate-interface vlan 11
      allocate-interface vlan 13
      member rc1
    test Context
    =========
    access-list bpdu-fixup ethertype permit bpdu
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    rserver host srv1
      ip address 172.16.11.1
      inservice
    rserver host srv2
      ip address 172.16.11.2
      inservice
    serverfarm host srv
      rserver srv1
        inservice
      rserver srv2
        inservice
    sticky ip-netmask 255.255.255.255 address both SG1
      timeout 120
      serverfarm srv
    class-map type management match-any remote-mgmt
      201 match protocol snmp any
      202 match protocol ssh any
      203 match protocol icmp any
      204 match protocol http any
      205 match protocol https any
      206 match protocol xml-https any
    class-map match-all slb-vip
      2 match virtual-address 172.16.11.10 any
    policy-map type management first-match remote-mgmt
      class remote-mgmt
        permit
    policy-map type loadbalance first-match slb
      class class-default
        sticky-serverfarm SG1
    policy-map multi-match client-vips
      class slb-vip
        loadbalance vip inservice
        loadbalance policy slb
        loadbalance vip icmp-reply
    interface vlan 11
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      no shutdown
    interface vlan 13
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      service-policy input remote-mgmt
      service-policy input client-vips
      no shutdown
    interface bvi 1
      ip address 172.16.11.9 255.255.255.0
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.11.254
    Could you pls. suggest where I am doing wrong?
    Thanks,
    Pawan

    " I tried trunk port also but it got disabled"   <----- if your L2 config is not correct, nothing will work.
    What is the setup on the switch ? Trunk or access vlan ?
    What is the status of the interface ? up ? down ?
    Do you see something in your arp table ?
    Gilles.

  • ACE 4710: Config Allows all traffic except large HTTP downloads

    Hi Folks,
    Got an ACE 4710 with a basic config that seems to work for all traffic except large downloads.
    I've attached the current config
    As I mentioned I can do normal HTTP to a standard destination like google or SSH through the ACE or ICMP
    If i try to get a large file from the server side of ACE, then a trace shows that the first and subsequent 1460Byte packets dont go through ACE
    I've thought of parse lengths, but i cannot see any that seem to affect the generic L4 maps that I am trying to use
    Cheers
    Alan

    I've seen a similar fault. I suppose a lower MSS was sent in the TCP SYN handshake packets (1300 or 1380?) and the packets exceeding that value were dropped by the ACE. This is the default behavior which can be switched to a less strict mode by either
    exceed-mss allow
    or
    no normalization
    commands.
    In our case, a linux web server was whose replies wouldn't keep to the MSS limit.

  • ACE 4710 - Internet Explorer cannot display the webpage randomly

    We have a ACE 4710 with a basic config, (see below).
    When clicking on a tab from a window within Interent explorer we occasionally get an issue with it returning: "Internet Explorer cannot display the webpage" The details show "Access is denied" accessing a particular line of a javascript file.
    We have put one web server out of service in the farm to make sure that this isn't a result of stickyness not quite working.
    We have tested extensively by going directly to the web server directly without the load balancer and cannot reproduce the problem but we can produce the issue within a few minutes when going to the load balanced address.
    Thanks in advance for any advice.
    HOST-1/Admin# show run
    Generating configuration....
    logging enable
    logging fastpath
    logging standby
    logging timestamp
    logging trap 6
    logging history 6
    resource-class SLB_ResourceClass_T_R
      limit-resource all minimum 10.00 maximum unlimited
    resource-class sticky
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-t1k9-mz.A5_1_2.bin
    peer hostname HOST-2
    hostname HOST-1
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      description LB003
      switchport access vlan 1
      shutdown
    interface gigabitEthernet 1/4
      description LB004
      switchport access vlan 2
      shutdown
    interface port-channel 1
      port-channel load-balance src-dst-port
      no shutdown
    clock timezone standard GMT
    switch-mode
    context Admin
      description SUTLB01
      member SLB_ResourceClass_T_R
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe tcp probe_tcp_80
      port 80
    rserver host Server_S_W301
      description Server_S_W301
      ip address x.x.32.152
      inservice
    rserver host Server_S_W302
      description Server_S_W302
      ip address x.x.32.154
      inservice
    serverfarm host sfarm_T_R
      description sfarm_T_R
      predictor leastconns
      probe probe_tcp_80
      rserver Server_S_W301 80
      rserver Server_S_W302 80
        inservice
    sticky http-cookie Cookie1 T_R_sticky_cookie
      cookie insert browser-expire
      timeout 3600
      serverfarm sfarm_T_R
    class-map match-any T_R_L4Class
      2 match virtual-address x.x.33.150 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match T_R_L7policy
      class class-default
        sticky-serverfarm T_R_sticky_cookie
    policy-map multi-match T_R_L4Policy
      class T_R_L4Class
        loadbalance vip inservice
        loadbalance policy T_R_L7policy
        loadbalance vip icmp-reply active
        nat dynamic 2 vlan 1000
    interface vlan 1000
      ip address x.x.33.148 255.255.254.0
      access-group input ALL
      nat-pool 2 x.x.33.151 x.x.33.151 netmask 255.255.254.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input T_R_L4Policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 x.x.32.1
    ssh key rsa 1024 force

    +------------------------------------------+
    +-------------- HTTP statistics -----------+
    +------------------------------------------+
    LB parse result msgs sent : 421347     , TCP data msgs sent       : 2099597
    Inspect parse result msgs : 0          , SSL data msgs sent       : 0
                          sent
    TCP fin msgs sent         : 6169       , TCP rst msgs sent:       : 769
    Bounced fin msgs sent     : 5          , Bounced rst msgs sent:   : 1
    SSL fin msgs sent         : 0          , SSL rst msgs sent:       : 0
    Drain msgs sent           : 337811     , Particles read           : 5040829
    Reuse msgs sent           : 0          , HTTP requests            : 342499
    Reproxied requests        : 183422     , Headers removed          : 37475
    Headers inserted          : 342124     , HTTP redirects           : 0
    HTTP chunks               : 224859     , Pipelined requests       : 71466
    HTTP unproxy conns        : 267246     , Pipeline flushes         : 0
    Whitespace appends        : 0          , Second pass parsing      : 0
    Response entries recycled : 71302      , Analysis errors          : 0
    Header insert errors      : 22         , Max parselen errors      : 215
    Static parse errors       : 99         , Resource errors          : 0
    Invalid path errors       : 0          , Bad HTTP version errors  : 0
    Headers rewritten         : 0          , Header rewrite errors    : 0
    SSL headers inserted      : 0          , SSL header insert errors : 0
    SSL spoof headers deleted : 0         , Unproxy msgs sent         : 267246
    HTTP passthrough stat     : 0
    NOTE - We did turn on caching at one point to try and resolve the issue but it has since been turned off

  • ACE 4710 transparent LB with two Caches and two routers.

    Hello,
    I have ACE 4710 that load balance two cach flows (bluecoat), i am doing pbr on the routers to send the traffic destined to port 80 to ACE then Cach farm. After that the Cach flow will get the page from the internet via two routers. The return traffic will match another pbr on the routers with source port 80 that will send it to the ACE then CachFlow again .....then to the users.
    I am not using ip-spoofing on the CachFlow for now. In the figure attached i created a VIP 0.0.0.0 0.0.0.0 port 80 on the interface on the ACE facing the routers, but the question is do i have to create another VIP 0.0.0.0 0.0.0.0 port 80 on the interface on ACE facing the Cach Flow? or just forward the traffic on the default route? What might be the default route since i have to use two routers and i cannot use hsrp?
    Kindly I need some assistance
    Thank you and regards,
    George
    access-list PERMIT_ALL line 8 extended permit ip any any
    access-list CFLOW line 8 extended permit ip any any
    ip name-server 8.8.8.8
    ip name-server 4.2.2.2
    ##################################Config for Cache Cache Servers###################
    probe http CISCO_WWW_PROBE
      ip address 72.163.4.161
      interval 2
      faildetect 2
      passdetect interval 2
      passdetect count 5
      request method head url /index.html
      expect status 200 200
      exit
    probe http YAHOO_WWW_PROBE
      ip address 87.248.112.181
      interval 2
      faildetect 2
      passdetect interval 2
      passdetect count 5
      request method head url /index.html
      expect status 200 200
      exit
    serverfarm host TRANSPARENT_PROXY_SF
      description Transparent Proxy Farm
      transparent
      predictor hash url
      probe CISCO_WWW_PROBE
      probe YAHOO_WWW_PROBE
      rserver CFLOW01
        inservice
      rserver CFLOW02
        inservice
      exit
      exit
    ############################################# Router Cache Farm ############################
    probe icmp ICMP_PROBE
      description *** Probe for icmp health monitoring ***
      interval 5
      faildetect 2
      passdetect interval 60
      passdetect count 2
      exit
    rserver host Router01
      description Connection to Sodetel Router
      ip address 192.168.14.4
      probe ICMP_PROBE
      inservice
    rserver host Router02
      description Connection to IDM Router
      ip address 192.168.14.5
      probe ICMP_PROBE
      inservice
    serverfarm host Routers
      description Transparent Proxy Farm
      transparent
      predictor hash url
      probe ICMP_PROBE
      rserver Router01
        inservice
      rserver Router02
        inservice
      exit
      exit
    ################################# Management################################
    class-map type management match-any REMOTE_MGMT
      description Allow Remote management for below protocols
      8 match protocol icmp any
      9 match protocol ssh source-address 172.31.13.31 255.255.255.255
      10 match protocol ssh source-address 172.31.31.21 255.255.255.255
    policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
      class REMOTE_MGMT
        permit
    class-map match-all CFLO2Internet
      2 match virtual-address 0.0.0.0 0.0.0.0 any
    class-map match-all TRANSPARENT_VIP_CM
      2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq www
    policy-map type loadbalance first-match TRANSPARENT_LB_PM
      class class-default
        serverfarm TRANSPARENT_PROXY_SF backup Routers
    policy-map type loadbalance first-match CFLO2Internet_LB
      class class-default
        serverfarm Routers
    policy-map multi-match CFLO2Internet_PM
      class CFLO2Internet
        loadbalance vip inservice
        loadbalance policy CFLO2Internet_LB
        loadbalance vip icmp-reply active
        connection advanced-options TCP
    policy-map multi-match L3L4_PM
      class TRANSPARENT_VIP_CM
        loadbalance vip inservice
        loadbalance policy TRANSPARENT_LB_PM
        loadbalance vip icmp-reply active
        connection advanced-options TCP
    ====Interfaces======
    interface vlan 11
      description Interface between Routers and ACE
      ip address 192.168.14.2 255.255.255.224
      alias 192.168.14.1 255.255.255.224
      peer ip address 192.168.14.3 255.255.255.224
      no icmp-guard
      access-group input PERMIT_ALL
      service-policy input REMOTE_MGMT_ALLOW_POLICY
      service-policy input L3L4_PM
      no shutdown
    interface vlan 21
      description Connection to CFlow ServerFarm
      ip address 192.168.12.2 255.255.255.224
      alias 192.168.12.1 255.255.255.224
      peer ip address 192.168.12.3 255.255.255.224
      no icmp-guard
      access-group input CFLOW
      service-policy input CFLO2Internet_PM ------>>>> Is this necessary???
      no shutdown

    Hi George,
    In the topology you described, only the service-policy in the interface towards the routers is necessary. For the traffic from the caches, the ACE will just forward to the default gateway.
    The only problem is, as you mentioned, that you cannot use HSRP. In that case, you can still configure two default gateways, but there is no way to predict which one the ACE will use at a given time (the way it does to select the one it will use is sending an ARP request to both gateways and using the one that replies first until the ARP entry expires)
    If you need to load-balance the traffic between both routers, then yes, you would need to configure a new VIP on the cache side and load-balanced to a transparent serverfarm composed of both routers.
    Regards
    Daniel

  • ACE 4710 Pls need help

    Hi,
    Pls can you help me find out where is my error in the below:
    I have an ACE 4710. Also I have 2 Bluecoat Proxy SG working in proxy mode. I want the ACE to be the Load Balancer for these 2 Proxy SG. I configure the ACE as below and put the vip-address in the Internet Explorer LAN Settings but it did not work. Also I configure Policy-based Routing on the Core Switch (for any http or https traffic going through core apply set ip next-hop vip-address).
    Core SW SVI:
    interface Vlan56
    description BC Proxy
    ip address 10.0.1.33 255.255.255.224
    interface Vlan57
    description ACE-LB-Alias
    ip address 10.0.1.65 255.255.255.224
    ACE 4710:
    hostname VSS-ACE-BC-01
    interface gigabitEthernet 1/1
      description Management
      speed 1000M
      duplex FULL
      switchport access vlan 101
      no shutdown
    interface gigabitEthernet 1/2
      description User Side
      speed 1000M
      duplex FULL
      switchport access vlan 56
      no shutdown
    interface gigabitEthernet 1/3
      description BC Proxy Side
      speed 1000M
      duplex FULL
      switchport access vlan 57
      no shutdown
    interface gigabitEthernet 1/4
      description Failover
      speed 1000M
      duplex FULL
      ft-port vlan 900
      no shutdown
    context Admin
      member sticky
    access-list external line 10 extended permit ip any any
    access-list external line 20 extended permit icmp any any
    access-list external line 30 extended permit tcp any any
    access-list external line 40 extended permit udp any any
    access-list internal line 10 extended permit ip any any
    access-list internal line 20 extended permit icmp any any
    access-list internal line 30 extended permit tcp any any
    access-list internal line 40 extended permit udp any any
    probe tcp web443
      port 443
      interval 30
      faildetect 1
      passdetect interval 30
      passdetect count 1
      open 1
    probe tcp web8080
      port 8080
      interval 30
      faildetect 1
      passdetect interval 30
      passdetect count 1
      open 1
    rserver host BC01
      ip address 10.0.1.41
      inservice
    rserver host BC02
      ip address 10.0.1.42
      inservice
    serverfarm host web443
      probe web443
      rserver BC01
        inservice
      rserver BC02
        inservice
    serverfarm host web8080
      probe web8080
      rserver BC01
        inservice
      rserver BC02
        inservice
    sticky ip-netmask 255.255.255.255 address source group1
      replicate sticky
      serverfarm web8080
    sticky ip-netmask 255.255.255.255 address source group2
      replicate sticky
      serverfarm web443
    class-map type management match-any REMOTE_ACCESS
      2 match protocol telnet any
      3 match protocol ssh any
      4 match protocol icmp any
      5 match protocol http any
      6 match protocol snmp any
    class-map match-all external-web
      2 match virtual-address 10.0.1.70 any
    class-map match-all external-web443
      2 match virtual-address 10.0.1.70 any
    class-map match-any nat-class
      2 match access-list external
    policy-map type management first-match REMOTE_MGMT
      class REMOTE_ACCESS
        permit
    policy-map type loadbalance http first-match slb
      class class-default
        sticky-serverfarm group1
    policy-map type loadbalance http first-match slb443
      class class-default
        sticky-serverfarm group2
    policy-map multi-match external-access
      class nat-class
        nat dynamic 1 vlan 57
      class external-web
        loadbalance vip inservice
        loadbalance policy slb
      class external-web443
        loadbalance vip inservice
        loadbalance policy slb443
    timeout xlate 120
    interface vlan 56
      description Server-Side
      ip address 10.0.1.43 255.255.255.224
      ip verify reverse-path
      alias 10.0.1.40 255.255.255.224
      peer ip address 10.0.1.44 255.255.255.224
      mac-address autogenerate
      access-group input internal
      service-policy input REMOTE_MGMT
      no shutdown
    interface vlan 57
      description VIP-Interface
      ip address 10.0.1.67 255.255.255.224
      alias 10.0.1.66 255.255.255.224
      peer ip address 10.0.1.68 255.255.255.224
      mac-address autogenerate
      access-group input external
      service-policy input external-access
      service-policy input REMOTE_MGMT
      no shutdown
    interface vlan 101
      description Management
      ip address 10.220.1.131 255.255.255.0
      alias 10.220.1.133 255.255.255.0
      peer ip address 10.220.1.132 255.255.255.0
      mac-address autogenerate
      service-policy input REMOTE_MGMT
      no shutdown
    ft interface vlan 900
      ip address 172.20.100.1 255.255.255.252
      peer ip address 172.20.100.2 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 20
      ft-interface vlan 900
    ft group 1
      peer 1
      priority 200
      peer priority 150
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 10.0.1.65

    I see that you used:
      nat dynamic 1 vlan 57
    Where is the nat pool on Vlan 57 ?
    May be you can try to assign that and that should help.
    Something like below:
    Interface vlan 57
    nat-pool 1 10.0.1.93 10.0.1.93 netmask 255.255.255.224 pat
    regards,
    Ajay Kumar

  • VIP not reachable on ACE 4710

    Hi All,
    I am not able to connect to a virtual IP address of ACE 4710 and either i am able to ping it. Kindly let me know if anything wrong here.
    Regards,
    Neha.

    Hi Yahb/Neha,
    Please try and confirm this:-
    1) See if you have permited the traffic:-
    access-list ALL line 8 extended permit ip any any
    class-map match-all L4_VIP_ADDRESS_CLASS
    2 match virtual-address 1.1.1.1 any
    class-map type management match-any REMOTE_ACCESS
    201 match protocol ssh any
    202 match protocol icmp any
    policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
    class REMOTE_ACCESS
    permit
    policy-map type loadbalance first-match L7_VIP_LB_ORDER_POLICY
    class class-default
    serverfarm SFARM1
    policy-map multi-match L4_LB_VIP_POLICY
    class L4_VIP_ADDRESS_CLASS
    loadbalance vip inservice
    loadbalance policy L7_VIP_LB_ORDER_POLICY
    loadbalance vip icmp-reply
    2)
    Apply the ACL on to the correct vlan:-
    interface vlan 20
    description Server-side Interface
    ip address 2.2.2.2 255.255.255.0
    access-group input ALL --->make sure you have applied the ACL.
    service-policy input L4_LB_VIP_POLICY
    service-policy input REMOTE_MGMT_ALLOW_POLICY
    no shutdown
    interface vlan 30
    description Client side connectivity
    ip address 3.3.3.3. 255.255.255.0
    access-group input ALL
    service-policy input L4_LB_VIP_POLICY
    service-policy input REMOTE_MGMT_ALLOW_POLICY
    no shutdown
    ip route 0.0.0.0 0.0.0.0 x.x.x.x
    Let us know if you have done this.
    Regards
    Shariff

  • ACE 4710 is not working

    Hi. I'm working on the Cisco ACE 4710 to be able to load balance web Traffic between several web servers. but despite following the steps mentioned on the Cisco configuration guide (specially this link and related docs: http://docwiki.cisco.com/wiki/Cisco_ACE_4700_Series_Appliance_Quick_Start_Guide,_Release_A3(1.0)_--_Creating_a_Virtual_Context) we did not managed to make it. we tested both the "bridged scenario" and "routed scenario" but none of them is working. specifically "configuring Nat" in the above link is very confusing and is not clear; because it's not the same as Cisco IOS, which we used to implement it that way. 
    Routed Scenario:
    ==========================================
    probe http Http_Probe
      description Server Healty Check
      port 80
      request method head url /index.htm
    probe icmp ICMP_Check
      interval 10
      passdetect interval 5
    rserver host NetCad_Server_1
      ip address 172.16.1.100
      probe ICMP_Check
      inservice
    rserver host NetCad_Server_2
      ip address 172.16.1.101
      probe ICMP_Check
      inservice
    rserver host NetCad_Server_3
      ip address 172.16.1.102
      probe ICMP_Check
      inservice
    serverfarm host NetCad_Servers
      probe Http_Probe
      rserver NetCad_Server_1 80
        inservice
      rserver NetCad_Server_2 80
        inservice
      rserver NetCad_Server_3 80
        inservice
    sticky http-cookie Cookie1 1
      serverfarm NetCad_Servers
    class-map match-all VS_NetCad
      2 match virtual-address 192.168.13.162 255.255.252.0 tcp any
    policy-map type management first-match mgmt-pm
      class class-default
        permit
    policy-map type loadbalance first-match VS_NetCad-l7slb
      class class-default
        serverfarm NetCad_Servers
    policy-map multi-match int40
      class VS_NetCad
        loadbalance vip inservice
        loadbalance policy VS_NetCad-l7slb
        loadbalance vip icmp-reply
    interface vlan 40
      description Client Side
      ip address 192.168.13.161 255.255.252.0
      ip options allow
      no normalization
      no icmp-guard
      access-group input Permit_ALL
      service-policy input mgmt-pm
      service-policy input int40
      no shutdown
    interface vlan 41
      description Server Side
      ip address 172.16.1.1 255.255.255.0
      ip options allow
      no normalization
      no icmp-guard
      access-group input Permit_ALL
      nat-pool 1 172.16.1.110 172.16.1.110 netmask 255.255.255.255 pat
      service-policy input mgmt-pm
      no shutdown
    ip route 0.0.0.0 0.0.0.0 192.168.12.1
    ==========================================

    Hi,
    Let me explain you.
    Assuming client IP as 1.1.1.1, VIP as 2.2.2.2 and Real Server as 3.3.3.3
    Consider the simple situation where client needs to access an application hosted on 3.3.3.3. Client sends a request which comes to VIP.
    src 1.1.1.1----->dst------->2.2.2.2. ACE after matching conditions and taking LB decision decides to send  it to 3.3.3.3 real server. Performs destination NAT and forwards the client request to 3.3.3.3. So the above packet L3 header will now look like:
    src 1.1.1.1       dst 3.3.3.3. When reply comes from server, ACE will change src 3.3.3.3 back to 2.2.2.2 and forwards the request to client 1.1.1.1. SIMPLE LB.
    Now comes a situation where let's say you want to hide the client IP from server or let's say server's default GW is not ACE or client and server are in same subnet but need to communicate through VIP on ACE etc.
    Src 1.1.1.1 dst 2.2.2.2
    After LB ace decides to send it to 3.3.3.3 but also policy multi match has nat rule (nat dynamic 1 vlan x). But packet would be forwarded from server vlan where you have NAT pool defined. So let's say pool IP is 3.3.3.4. So ACE will perform both destination as well as src NAT here before forwarding the packet to server and packet L3 header will look like:
    src 3.3.3.4 ----->dst 3.3.3.3
    Now when 3.3.3.3 has to send packet back, ACE will answer ARP for 3.3.3.3 and hence packet will come back to ACE which will again change the L3 header IP's and send it out the client VLAN towards client.
    So NAT is always applied to server side vlan and  that's why pool is  chosen from server side subnet.
    Let me know if you have any questions.
    Regards,
    Kanwal

  • Access Server through VIP (ACE 4710) but very slow

    Re:  Access Server through VIP (ACE 4710) but very slow
    Hi Shiva
    Kindly  Help .....Accessing the server very slow.., Plz check my real  configuration... this configuration is for application server and after  this i have to configure more serverfarm for different server like  webmail etc. in this ACE 4710. I have only one ACE 4710 .
    ACE Version A4(2.0) = is there supports Probe with this version.???  without probe server will work but very slow. And plz guide Nat-pool is required
    VIP :-- 172.16.15.8
    LB/Admin# sh run
    Generating configuration....
    no ft auto-sync startup-config
    logging enable
    logging host 172.29.91.112 udp/514
    resource-class RC1
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-mz.A4_2_0.bin
    hostname LB
    interface gigabitEthernet 1/1
      description Management
      speed 1000M
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      description clientside
      switchport access vlan 30
      no shutdown
    interface gigabitEthernet 1/3
      description serverside
      switchport access vlan 31
      no shutdown
    interface gigabitEthernet 1/4
      no shutdown
    context Admin
      description Management
      member RC1
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe http probe1
      description health check
      interval 5
      passdetect interval 10
      request method head
      expect status 200 200
      open 1
    rserver redirect https_redirect
      description redirect traffic to https
      webhost-redirection / 302
      inservice
    rserver redirect maintenance_page
      description maintenance page displayed
      webhost-redirection /sry.html 301
      inservice
    rserver host web1
      ip address 192.168.10.3
      inservice
    rserver host web2
      ip address 192.168.10.4
      inservice
    rserver host web3
      ip address 192.168.10.5
      inservice
    serverfarm host http
      rserver web1
        inservice
      rserver web2
        inservice
      rserver web3
        inservice
    serverfarm redirect https_redirect_farm
      description Redirect traffic to https
    serverfarm redirect maintenance_farm
      description send user to maintenance page
    parameter-map type connection paramap_http
      description parameter connection tcp
      exceed-mss allow
    sticky ip-netmask 255.255.255.0 address source Sticky_http
      timeout activeconns
      serverfarm http
    class-map match-all REMOTE-ACCESS
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    class-map match-all slb-vip
      2 match virtual-address 172.16.15.8 tcp eq www
    policy-map type management first-match remote_access
      class class-default
        permit
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match slb
      class class-default
        serverfarm http
    policy-map type inspect http all-match slb-vip-http
      class class-default
        permit
    policy-map multi-match client-vips
      class slb-vip
        loadbalance vip inservice
        loadbalance policy slb
        loadbalance vip icmp-reply active
        inspect http policy slb-vip-http
        connection advanced-options paramap_http
    interface vlan 30
      description "Client Side"
      ip address 172.16.15.24 255.255.255.0
      access-group input everyone
      service-policy input client-vips
      no shutdown
    interface vlan 31
      description "Server Side"
      ip address 192.168.10.1 255.255.255.0
      service-policy input remote_access
      no shutdown
    interface vlan 1000
      description managment
      ip address 172.29.91.110 255.255.255.0
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.15.1
    snmp-server contact "PHQ"
    snmp-server community phq group Network-Monitor
    snmp-server trap-source vlan 1000
    username admin password 5 $1$b2txbc5U$TA74D920oSdd2eOZ4hSFe/  role Admin domain
    default-domain
    username www password 5 $1$.GuWwQEK$r8Ub4OcE3l190d5GA4kvR.  role Admin domain de
    fault-domain
    username prem password 5 $1$8C7eRKrI$it3UV4URZ26X4S/Bh6OEr0  role Admin domain d
    efault-domain
    ssh key rsa 1024 force
    banner motd # "ro" #
    Regards,
    Prem

    Hi Shiva,
    plz guide i'm new with ACE LB, also find my n/w design for connected ace to server. but server accessing very very slow, but when i connect through my old server software LB (with two interface)then accessing very fast. I just replace my old serverLB(with two interface) to ACE4710 and connect the same scenario then why not server accessing smoothly with VIP .Reply soon only I connect ACE's two interface with switch.....
    Regards,
    Prem

  • ACE 4710 in bridge mode

    Hi,
    We got new ACE 4710 device and i am trying to configure that in Bridging mode.
    I am trying to loadbalance between two servers which is connected as shown below:
    Servers -> Switch -> Router (with subinterface).
    Servers IP: 172.16.11.1 and 172.16.11.2
    Router IP: 172.16.11.254
    Default route is router IP address for servers.
    I am new to ACE and I am confused about how to assign interface on ACE so that ACE can bridge the traffic between router and servers VLAN.
    We have some more servers which are on different VLAN but can connect to these servers as router is doing inter-vlan routing too.
    I want inter-vlan routing and load balancing between above two servers concurrently. Pls. help in this regard.
    Also attaching the ACE config file.

    Here is the config, hope this will help.
    Admin Context
    =============
    resource-class ngmp_rc1
    limit-resource all minimum 0.00 maximum unlimited
    limit-resource sticky minimum 0.20 maximum unlimited
    interface gigabitEthernet 1/1
    switchport access vlan 1000
    no shutdown
    interface gigabitEthernet 1/2
    switchport trunk allowed vlan 10,13
    no shutdown
    interface gigabitEthernet 1/3
    no shutdown
    interface gigabitEthernet 1/4
    shutdown
    access-list ALL line 8 extended permit ip any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    class-map type management match-any remote_access
    2 match protocol xml-https any
    3 match protocol icmp any
    4 match protocol telnet any
    5 match protocol ssh any
    6 match protocol http any
    7 match protocol https any
    8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
    class remote_access
    permit
    interface vlan 1000
    ip address 192.168.16.16 255.255.255.0
    access-group input ALL
    service-policy input remote_mgmt_allow_policy
    no shutdown
    ip route 0.0.0.0 0.0.0.0 192.168.16.254
    context apps
    allocate-interface vlan 10
    allocate-interface vlan 13
    member apps_rc1
    APPS Context
    ============
    rserver host srv1
    ip address 192.168.10.1
    inservice
    rserver host srv2
    ip address 192.168.10.2
    inservice
    rserver host srv3
    ip address 192.168.10.3
    inservice
    serverfarm host apps_srv
    rserver srv1
    inservice
    rserver srv2
    inservice
    rserver srv3
    inservice
    class-map match-all ftp-vip
    2 match virtual-address 172.16.10.10 tcp eq ftp
    class-map match-all http-vip
    2 match virtual-address 172.16.10.11 tcp eq 8080
    class-map type management match-any remote-mgmt
    201 match protocol snmp any
    202 match protocol ssh any
    203 match protocol icmp any
    204 match protocol http any
    205 match protocol https any
    206 match protocol xml-https any
    policy-map type management first-match remote-mgmt
    class remote-mgmt
    permit
    policy-map type loadbalance first-match slb
    class class-default
    serverfarm apps_srv
    policy-map multi-match client-vips
    class ftp-vip
    loadbalance vip inservice
    loadbalance policy slb
    loadbalance vip icmp-reply
    inspect ftp
    class http-vip
    loadbalance vip inservice
    loadbalance policy slb
    loadbalance vip icmp-reply
    interface vlan 10
    bridge-group 1
    access-group input bpdu-fixup
    access-group input ALL
    access-group output ALL
    no shutdown
    interface vlan 13
    bridge-group 1
    access-group input bpdu-fixup
    access-group input ALL
    access-group output ALL
    service-policy input remote-mgmt
    service-policy input client-vips
    no shutdown
    interface bvi 1
    ip address 192.168.10.9 255.255.255.0
    no shutdown
    ip route 0.0.0.0 0.0.0.0 192.168.10.254
    Thanks,
    Pawan

  • Cannot Telnet to ACE 4710 after upgrade to A4(2.3)

             I have a pair of ACE 4710s with 12 contexts sharing the load, running A4(2.1). Yesterday I upgraded one of them to A4(2.3)
    now I cannot telnet to the Admin context.Pings ok. I can telnet to other contexts on the box and everything seems to be working ok   
    when i do a " sh telnet"
    comes back with
    No Session Information is available
    sh telnet maxsessions
    telnet maxsessions 16
    Can anybody help?

    further this post, it was not a resource problem as had allocated 5% for the Admin context.
    I up graded IOS Saturday evening, could not Telnet in, tried again on Sunday same result,
    though this morning (Monday) Can now telnet in ok very strange
    I was connecting via the AUX line of a 2851 router to the console port.
    whe I disconnected this morning I saw the following message
    INIT: id "T0" respawning too fast : disabled for  5 minutes
    not sure if this is a 2851 message or an ACE message, but after getting that message is when I was able to Telnet in
    was it a coincidence
    anybody any ideas

  • Configuring ACE 4710 for Load Balancing Speech servers

    Hello, I'm configuring ACE 4710's for the first time and I want to load balance my Nuance speech servers on port 554. Here's my configuration on ACE01:
    hostname ace471001
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      shutdown
    interface gigabitEthernet 1/4
      shutdown
    access-list ALL line 8 extended permit ip any any
    rserver host nss01
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    interface vlan 1000
      ip address 10.20.17.21 255.255.248.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    How would I configure my speech server to isten on 554?
    Thanks in advance

    Hello Reginald
    Currently you have only basic network configuration, there is no loadbalancing config
    I'm not sure what exactly you're asking about , but basically you need to have
    - real servers configured on ACE (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/rsfarms.html#wp999495)
    - serverfarm configured on ACE (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/rsfarms.html#wp1014522)
    - L7 policy map (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1171109 ,
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1027248 )
    - L4 policy map , class-map (
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1027819)
    And then apply it on necessary interface.
    This is a general configuration, in your specific case you may need to configure some additinal features (e.g. I think you will need to have stickiness enabled
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/sticky.html but it depends on your application)
    links are for old config guids , but basic is pretty much the same for all versions.
    Please check them and try to narrow down your question a bit.

Maybe you are looking for