ACE 4710 is not working

Question

Hi. I'm working on the Cisco ACE 4710 to be able to load balance web Traffic between several web servers. but despite following the steps mentioned on the Cisco configuration guide (specially this link and related docs: http://docwiki.cisco.com/wiki/Cisco_ACE_4700_Series_Appliance_Quick_Start_Guide,_Release_A3(1.0)_--_Creating_a_Virtual_Context) we did not managed to make it. we tested both the "bridged scenario" and "routed scenario" but none of them is working. specifically "configuring Nat" in the above link is very confusing and is not clear; because it's not the same as Cisco IOS, which we used to implement it that way. 
Routed Scenario:
==========================================
probe http Http_Probe
  description Server Healty Check
  port 80
  request method head url /index.htm
probe icmp ICMP_Check
  interval 10
  passdetect interval 5
rserver host NetCad_Server_1
  ip address 172.16.1.100
  probe ICMP_Check
  inservice
rserver host NetCad_Server_2
  ip address 172.16.1.101
  probe ICMP_Check
  inservice
rserver host NetCad_Server_3
  ip address 172.16.1.102
  probe ICMP_Check
  inservice
serverfarm host NetCad_Servers
  probe Http_Probe
  rserver NetCad_Server_1 80
    inservice
  rserver NetCad_Server_2 80
    inservice
  rserver NetCad_Server_3 80
    inservice
sticky http-cookie Cookie1 1
  serverfarm NetCad_Servers
class-map match-all VS_NetCad
  2 match virtual-address 192.168.13.162 255.255.252.0 tcp any
policy-map type management first-match mgmt-pm
  class class-default
    permit
policy-map type loadbalance first-match VS_NetCad-l7slb
  class class-default
    serverfarm NetCad_Servers
policy-map multi-match int40
  class VS_NetCad
    loadbalance vip inservice
    loadbalance policy VS_NetCad-l7slb
    loadbalance vip icmp-reply
interface vlan 40
  description Client Side
  ip address 192.168.13.161 255.255.252.0
  ip options allow
  no normalization
  no icmp-guard
  access-group input Permit_ALL
  service-policy input mgmt-pm
  service-policy input int40
  no shutdown
interface vlan 41
  description Server Side
  ip address 172.16.1.1 255.255.255.0
  ip options allow
  no normalization
  no icmp-guard
  access-group input Permit_ALL
  nat-pool 1 172.16.1.110 172.16.1.110 netmask 255.255.255.255 pat
  service-policy input mgmt-pm
  no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.12.1
==========================================

Answer 1

Hi,
Let me explain you.
Assuming client IP as 1.1.1.1, VIP as 2.2.2.2 and Real Server as 3.3.3.3
Consider the simple situation where client needs to access an application hosted on 3.3.3.3. Client sends a request which comes to VIP.
src 1.1.1.1----->dst------->2.2.2.2. ACE after matching conditions and taking LB decision decides to send  it to 3.3.3.3 real server. Performs destination NAT and forwards the client request to 3.3.3.3. So the above packet L3 header will now look like:
src 1.1.1.1       dst 3.3.3.3. When reply comes from server, ACE will change src 3.3.3.3 back to 2.2.2.2 and forwards the request to client 1.1.1.1. SIMPLE LB.
Now comes a situation where let's say you want to hide the client IP from server or let's say server's default GW is not ACE or client and server are in same subnet but need to communicate through VIP on ACE etc.
Src 1.1.1.1 dst 2.2.2.2
After LB ace decides to send it to 3.3.3.3 but also policy multi match has nat rule (nat dynamic 1 vlan x). But packet would be forwarded from server vlan where you have NAT pool defined. So let's say pool IP is 3.3.3.4. So ACE will perform both destination as well as src NAT here before forwarding the packet to server and packet L3 header will look like:
src 3.3.3.4 ----->dst 3.3.3.3
Now when 3.3.3.3 has to send packet back, ACE will answer ARP for 3.3.3.3 and hence packet will come back to ACE which will again change the L3 header IP's and send it out the client VLAN towards client.
So NAT is always applied to server side vlan and  that's why pool is  chosen from server side subnet.
Let me know if you have any questions.
Regards,
Kanwal