ACE 4710 like Proxy Log?

Hi guys!
I have one question to the ACE.
We using the ACE as Proxy.
Can write the ACE a proxy log? (GET, Post requests)
Like so
192.168.0.1 - - [09/Oct/2010:02:12:40 +0200] "GET / HTTP/1.1" 302 304 "http://www.cisco.com" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.10) Gecko/20100914 AskTbCDS/3.9.0.12758 Firefox/3.6.10"
192.168.0.1 - - [09/Oct/2010:06:17:14 +0200] "GET /oks/app HTTP/1.1" 200 3861 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)"
192.168.0.1 - - [09/Oct/2010:06:17:15 +0200] "GET /css/default.css HTTP/1.1" 304 - "https://blablbla.at/oks/app" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C
did anybody know that the ACE can do this.
He can also forward the events to a sys Server. Is it posible?
Thanks
regards Markus

Hi Markus,
The short answer is no.
This kind of logging you are looking for is more common in HTTP caching devices. However, the ACE will only proxy connections in order to get enough information to make a load-balancing decision.
Regards
Daniel

Similar Messages

  • ACE 4710 A3(5) Logging new connections

    We have recently transitioned one of our Ecommerce products to a new data center, at which we now use a one-armed load balancing approach rather then the routed load balancing approach we used previously. This is casuing us some issues as we generally log the source IP address a user comes in on when he fills out an application. Now the logs only show the natted ip address recieved by the load balancer, which does us no good. What I was hoping is that someone knew a way to log the source IP address when a new connection is created to a particular vip? Any ideas?

    If this is http traffic you can have the ace insert a header such as X-Forwarded-For and insert the original client ip.
    So your saying something like....
    header insert request X-Forwarded-For %is
    and insert this parameter map to the virtual server? Will this work for HTTPS?
    The you would have your server log this ip from the header (do google search on X-forwarded-for for server details )
    see:
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1131842
    for how to do header insert.
    IF the connection is not http the only way to preserve client ip would be to use policy-based routing to get the server return traffic back to the ace instead of using source nat.

  • ACE 4710, reverse proxy?

    Hello All,
    Please forgive my ignorance but can the ACE appliance behave as a reverse proxy for http and ssl traffic? I would assume it can given how it does SLB but SLB is not a requirement at this time. Thanks for your input.

    Hi Mate,
    The reverse proxy servers can perform many tasks, like:
    Note: this info from Wikipedia: http://en.wikipedia.org/wiki/Reverse_proxy
    Reverse proxies can hide the existence and characteristics of the origin server(s), The ACE will do that.
    Application firewall features can protect against common web-based attacks. Without a reverse proxy, removing malware or initiating takedowns, for example, can become difficult, The ACE has some built-in security features, you can refer to this document for full detail:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/security/guide/securgd.html
    In the case of secure websites, the SSL encryption is sometimes not performed by the web server itself, but is instead offloaded to a reverse proxy that may be equipped with SSL acceleration hardware. The ACE can do this:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/ssl/guide/sslgd.html
    A reverse proxy can distribute the load from incoming requests to several servers, with each server serving its own application area. In the case of reverse proxying in the neighborhood of web servers, the reverse proxy may have to rewrite the URL in each incoming request in order to match the relevant internal location of the requested resource. The ACE can do that perfectly.
    A reverse proxy can reduce load on its origin servers by caching static content, as well as dynamic content. Proxy caches of this sort can often satisfy a considerable amount of website requests, greatly reducing the load on the origin server(s). Another term for this is web accelerator. A reverse proxy can optimize content by compressing it in order to speed up loading times. Please check this link for more detail about ACE Application Acceleration and Optimization:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/app_acc_and_opt/guide/appaccoptgd.html
    Best regards,
    Ahmad

  • ACE 4710 - 'reverse proxy' infront of serverfarm - fail-over/sorry server design issue

    Hi All,
    I'm working on a specific config and have an issue in the backup farm/fail-over/sorry server area.
    The customer wants the following:
    They have an existing serverfarm with X web servers, they want a single server to act as a reverse-proxy in front of the farm.
    So that all traffic goes trough that server, that server then forwards the request to the original serverfarm.
    The problem in my design is in the fail-over, if i configure the reverse-proxy server in a new serverfarm and use the original (web servers) farm as backup it has fail-over, but if the reverse-proxy AND the original serverfarm fail, there is no nice way to get the users on a sorry server.
    I could give the original serverfarms rservers a 'backup standby' server but that won't give the desired effect either.
    For maintance they first take 50% of the servers offline and switch to the other 50% after that, so then users would see a sorry page even if there where operational servers in the farm left.
    The 4710's are running routed mode, and the farms use Sticky Cookie, and also some http URL & Cookie matching is done.
    Anyone have an idea how to build this?

    Hi,
    It need additional testing but as per my understanding if you put the back up in this order then the last backup server will be choosen first.
    In your case it will be like " RSERVER1 >> backup sorry server >> backup web content
    As per the below example:
    I put test 2 as first backup server and test1 as second backup server but if you look at the first part it took rserver test1 as first backup.
    serverfarm host 1313-GIN-GWAP-SDC-80
      rserver RSERVER1
        backup-rserver test1
        inservice
      rserver test1
        inservice standby
      rserver test2
        inservice standby
    regards,
    Ajay Kumar

  • Ace 4710 SSL Proxy TLS (Beast) Mitigation

    Has anyone heard if there is an upgrade path to mitigate this recent tls1.0 and sslv3 exploit?
    Thanks
    Darren
    Sent from Cisco Technical Support iPad App

    Hi Darren,
    I haven't seen any official cisco comment about this yet.
    Also our customers are asking for updates on this security advisory....
    Edwin

  • Can the 4710 reverse proxy like the Apache rerwite rule

    We currently have web servers configured with Apache that act as reverse proxies using an Apache rewrite rule. The end user connects to the Apache web server and it proxies that connection to the backend app server. Is the 4710 capable of acting as a reverse proxy like Apache which would eliminate the need for a web server?
    Thanks

    Hi,
    Although this is not the most common scenario it is doable. What you will need is to NAT the client source IP to the ACE VIP and send the request to the web server. If there is a web farm then you can use another context of ACE to loadbalance the request to the web farm.Actually i have setup ACE as a reverse proxy in replacement of an ISA server by using the one-arm mode for the implementation. Beware though that you will need to use Policy Based Routing or NAT so as for the return traffic to go though ACE. Also you will need to insert the client IP in the x-forwarded-for HTTP header for proper analysis (as you would do with Apache).
    See below link for routed mode (it is for the c6500 / ACE module but same applies for the ACE 4710 appliance
    http://supportwiki.cisco.com/ViewWiki/index.php/Configure_ACE_with_Source_NAT_and_Client_IP_Header_Insert
    Hope it helps,
    ./G

  • ACE 4710 Pls need help

    Hi,
    Pls can you help me find out where is my error in the below:
    I have an ACE 4710. Also I have 2 Bluecoat Proxy SG working in proxy mode. I want the ACE to be the Load Balancer for these 2 Proxy SG. I configure the ACE as below and put the vip-address in the Internet Explorer LAN Settings but it did not work. Also I configure Policy-based Routing on the Core Switch (for any http or https traffic going through core apply set ip next-hop vip-address).
    Core SW SVI:
    interface Vlan56
    description BC Proxy
    ip address 10.0.1.33 255.255.255.224
    interface Vlan57
    description ACE-LB-Alias
    ip address 10.0.1.65 255.255.255.224
    ACE 4710:
    hostname VSS-ACE-BC-01
    interface gigabitEthernet 1/1
      description Management
      speed 1000M
      duplex FULL
      switchport access vlan 101
      no shutdown
    interface gigabitEthernet 1/2
      description User Side
      speed 1000M
      duplex FULL
      switchport access vlan 56
      no shutdown
    interface gigabitEthernet 1/3
      description BC Proxy Side
      speed 1000M
      duplex FULL
      switchport access vlan 57
      no shutdown
    interface gigabitEthernet 1/4
      description Failover
      speed 1000M
      duplex FULL
      ft-port vlan 900
      no shutdown
    context Admin
      member sticky
    access-list external line 10 extended permit ip any any
    access-list external line 20 extended permit icmp any any
    access-list external line 30 extended permit tcp any any
    access-list external line 40 extended permit udp any any
    access-list internal line 10 extended permit ip any any
    access-list internal line 20 extended permit icmp any any
    access-list internal line 30 extended permit tcp any any
    access-list internal line 40 extended permit udp any any
    probe tcp web443
      port 443
      interval 30
      faildetect 1
      passdetect interval 30
      passdetect count 1
      open 1
    probe tcp web8080
      port 8080
      interval 30
      faildetect 1
      passdetect interval 30
      passdetect count 1
      open 1
    rserver host BC01
      ip address 10.0.1.41
      inservice
    rserver host BC02
      ip address 10.0.1.42
      inservice
    serverfarm host web443
      probe web443
      rserver BC01
        inservice
      rserver BC02
        inservice
    serverfarm host web8080
      probe web8080
      rserver BC01
        inservice
      rserver BC02
        inservice
    sticky ip-netmask 255.255.255.255 address source group1
      replicate sticky
      serverfarm web8080
    sticky ip-netmask 255.255.255.255 address source group2
      replicate sticky
      serverfarm web443
    class-map type management match-any REMOTE_ACCESS
      2 match protocol telnet any
      3 match protocol ssh any
      4 match protocol icmp any
      5 match protocol http any
      6 match protocol snmp any
    class-map match-all external-web
      2 match virtual-address 10.0.1.70 any
    class-map match-all external-web443
      2 match virtual-address 10.0.1.70 any
    class-map match-any nat-class
      2 match access-list external
    policy-map type management first-match REMOTE_MGMT
      class REMOTE_ACCESS
        permit
    policy-map type loadbalance http first-match slb
      class class-default
        sticky-serverfarm group1
    policy-map type loadbalance http first-match slb443
      class class-default
        sticky-serverfarm group2
    policy-map multi-match external-access
      class nat-class
        nat dynamic 1 vlan 57
      class external-web
        loadbalance vip inservice
        loadbalance policy slb
      class external-web443
        loadbalance vip inservice
        loadbalance policy slb443
    timeout xlate 120
    interface vlan 56
      description Server-Side
      ip address 10.0.1.43 255.255.255.224
      ip verify reverse-path
      alias 10.0.1.40 255.255.255.224
      peer ip address 10.0.1.44 255.255.255.224
      mac-address autogenerate
      access-group input internal
      service-policy input REMOTE_MGMT
      no shutdown
    interface vlan 57
      description VIP-Interface
      ip address 10.0.1.67 255.255.255.224
      alias 10.0.1.66 255.255.255.224
      peer ip address 10.0.1.68 255.255.255.224
      mac-address autogenerate
      access-group input external
      service-policy input external-access
      service-policy input REMOTE_MGMT
      no shutdown
    interface vlan 101
      description Management
      ip address 10.220.1.131 255.255.255.0
      alias 10.220.1.133 255.255.255.0
      peer ip address 10.220.1.132 255.255.255.0
      mac-address autogenerate
      service-policy input REMOTE_MGMT
      no shutdown
    ft interface vlan 900
      ip address 172.20.100.1 255.255.255.252
      peer ip address 172.20.100.2 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 20
      ft-interface vlan 900
    ft group 1
      peer 1
      priority 200
      peer priority 150
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 10.0.1.65

    I see that you used:
      nat dynamic 1 vlan 57
    Where is the nat pool on Vlan 57 ?
    May be you can try to assign that and that should help.
    Something like below:
    Interface vlan 57
    nat-pool 1 10.0.1.93 10.0.1.93 netmask 255.255.255.224 pat
    regards,
    Ajay Kumar

  • Access Server through VIP (ACE 4710) but very slow

    Re:  Access Server through VIP (ACE 4710) but very slow
    Hi Shiva
    Kindly  Help .....Accessing the server very slow.., Plz check my real  configuration... this configuration is for application server and after  this i have to configure more serverfarm for different server like  webmail etc. in this ACE 4710. I have only one ACE 4710 .
    ACE Version A4(2.0) = is there supports Probe with this version.???  without probe server will work but very slow. And plz guide Nat-pool is required
    VIP :-- 172.16.15.8
    LB/Admin# sh run
    Generating configuration....
    no ft auto-sync startup-config
    logging enable
    logging host 172.29.91.112 udp/514
    resource-class RC1
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-mz.A4_2_0.bin
    hostname LB
    interface gigabitEthernet 1/1
      description Management
      speed 1000M
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      description clientside
      switchport access vlan 30
      no shutdown
    interface gigabitEthernet 1/3
      description serverside
      switchport access vlan 31
      no shutdown
    interface gigabitEthernet 1/4
      no shutdown
    context Admin
      description Management
      member RC1
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe http probe1
      description health check
      interval 5
      passdetect interval 10
      request method head
      expect status 200 200
      open 1
    rserver redirect https_redirect
      description redirect traffic to https
      webhost-redirection / 302
      inservice
    rserver redirect maintenance_page
      description maintenance page displayed
      webhost-redirection /sry.html 301
      inservice
    rserver host web1
      ip address 192.168.10.3
      inservice
    rserver host web2
      ip address 192.168.10.4
      inservice
    rserver host web3
      ip address 192.168.10.5
      inservice
    serverfarm host http
      rserver web1
        inservice
      rserver web2
        inservice
      rserver web3
        inservice
    serverfarm redirect https_redirect_farm
      description Redirect traffic to https
    serverfarm redirect maintenance_farm
      description send user to maintenance page
    parameter-map type connection paramap_http
      description parameter connection tcp
      exceed-mss allow
    sticky ip-netmask 255.255.255.0 address source Sticky_http
      timeout activeconns
      serverfarm http
    class-map match-all REMOTE-ACCESS
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    class-map match-all slb-vip
      2 match virtual-address 172.16.15.8 tcp eq www
    policy-map type management first-match remote_access
      class class-default
        permit
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match slb
      class class-default
        serverfarm http
    policy-map type inspect http all-match slb-vip-http
      class class-default
        permit
    policy-map multi-match client-vips
      class slb-vip
        loadbalance vip inservice
        loadbalance policy slb
        loadbalance vip icmp-reply active
        inspect http policy slb-vip-http
        connection advanced-options paramap_http
    interface vlan 30
      description "Client Side"
      ip address 172.16.15.24 255.255.255.0
      access-group input everyone
      service-policy input client-vips
      no shutdown
    interface vlan 31
      description "Server Side"
      ip address 192.168.10.1 255.255.255.0
      service-policy input remote_access
      no shutdown
    interface vlan 1000
      description managment
      ip address 172.29.91.110 255.255.255.0
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.15.1
    snmp-server contact "PHQ"
    snmp-server community phq group Network-Monitor
    snmp-server trap-source vlan 1000
    username admin password 5 $1$b2txbc5U$TA74D920oSdd2eOZ4hSFe/  role Admin domain
    default-domain
    username www password 5 $1$.GuWwQEK$r8Ub4OcE3l190d5GA4kvR.  role Admin domain de
    fault-domain
    username prem password 5 $1$8C7eRKrI$it3UV4URZ26X4S/Bh6OEr0  role Admin domain d
    efault-domain
    ssh key rsa 1024 force
    banner motd # "ro" #
    Regards,
    Prem

    Hi Shiva,
    plz guide i'm new with ACE LB, also find my n/w design for connected ace to server. but server accessing very very slow, but when i connect through my old server software LB (with two interface)then accessing very fast. I just replace my old serverLB(with two interface) to ACE4710 and connect the same scenario then why not server accessing smoothly with VIP .Reply soon only I connect ACE's two interface with switch.....
    Regards,
    Prem

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • Proxy Log On failed(Error Code 12154)

    Hello There!
    Can someone P'se help on this
    Installation
    WIN2K-Pro
    Oracle8iEE-1.7..
    Oracle9iAS
    Two different Oracle homes
    Problem
    I am trying to test for the first time my portal but i am receiving the following error messages
    1)when I type in <http://mysever/pls/dad> this is the result:
    Proxy log On failed.
    Please verify that you have specified correct connectivity information i.e.username, password & connect-string in the Database Access Descriptor
    Error-Code:12640
    Error TimeStamp:Mon, 06 Aug 2001 04:25:15 GMT
    Database Log In Failed
    TNS is unable to connect to destination. Invalid TNS address supplied or destination is not listening. This error can also occur because of underlying network transport problems.
    Verify that the TNS name in the connectstring entry of the DAD for this URL is valid and the database listener is running.
    2)Also when I try this <http://myserver/pls/admin/gateway.htm>the result is as follows:
    Mon, 06 Aug 2001 20:01:28 GMT
    No DAD configuration Found
    DAD name:
    PROCEDURE : gateway.htm
    URL : http://nt2kserver.learning.local:80/pls/admin/gateway.htm
    PARAMETERS :
    ===========
    ENVIRONMENT:
    ============
    PLSQL_GATEWAY=WebDb
    GATEWAY_IVERSION=2
    SERVER_SOFTWARE=Oracle HTTP Server Powered by Apache/1.3.12 (Win32) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.24
    GATEWAY_INTERFACE=CGI/1.1
    SERVER_PORT=80
    SERVER_NAME=nt2kserver.learning.local
    REQUEST_METHOD=GET
    QUERY_STRING=
    PATH_INFO=/admin/gateway.htm
    SCRIPT_NAME=/pls
    REMOTE_HOST=
    REMOTE_ADDR=127.0.0.1
    SERVER_PROTOCOL=HTTP/1.1
    REQUEST_PROTOCOL=HTTP
    REMOTE_USER=
    HTTP_CONTENT_LENGTH=
    HTTP_CONTENT_TYPE=
    HTTP_USER_AGENT=Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
    HTTP_HOST=nt2kserver.learning.local
    HTTP_ACCEPT=*/*
    HTTP_ACCEPT_ENCODING=gzip, deflate
    HTTP_ACCEPT_LANGUAGE=en-us
    HTTP_ACCEPT_CHARSET=
    HTTP_COOKIE=
    Authorization=
    HTTP_IF_MODIFIED_SINCE=
    HTTP_REFERER=

    Hello Teijo
    sorry about this, but I have checked on both of my two standalone servers(Running similar softwares and settings(host name...etc) independently) I can't see any service registerd by APACHE LISTENER.The only listener service available is for ORACLE8i under the oracle8iHome.
    The only running service under the 9iASHome is HTTPServer.During both installations I didn't encounter any problems,everything ended succefully.Can you p'se let me know if this sounds Ok to you?
    Hashim
    <BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Teijo Lallukka ([email protected]):
    This looks like a tnsnames.ora issue. I copied a reply from a similar post:
    Since you have multiple Oracle homes, you are probably looking at the wrong tnsnames.ora. The reason why SQL*Plus is working is because it is being picked up from an Oracle Home where the correct tnsnames.ora resides. Here is a quick way to confirm this
    - Stop the Apache Listener service
    - Open a "Console prompt window"
    - Go to $IAS_HOME/Apache/Apache
    - Set TNS_ADMIN=Directory_with_correct_tnsnames.ora
    - Issue "tnsping your_dbalias_name" to verify that you can ping the database. If this does not work, then your tnsnames.ora is incorrect
    - If it works, startup Apache by issuing "start Apache -k start"
    - Try connecting to Portal thru your browser
    - This should work.
    - Post a reply if this does not work<HR></BLOCKQUOTE>
    null

  • ACE 4710: Possible to allow a user to clear counters but nothing else?

    Hello all,
    Using an ACE 4710 we have a user setup with the Network-Monitor role which allows the user to view config, interface status, etc.  We would also like to allow this user to clear the interface error counters as well, but nothing else.  Is this possible?
    Thanks!

    Hello Brandon-
    Network-Monitor only lets you browse outputs, it is a not a role that allows a user to make any changes including clearing stats.  You can create custom roles and domains to get closer to what you want, but you cannot zero in on a single command like that.
    i.e.
    ACE# conif t
    ACE(config)# role MyRole
    ACE(config-role)# rule 1 permit modify feature ?
      AAA             AAA related commands
      access-list     ACL related commands
      connection      TCP/UDP related commands
      fault-tolerant  Fault tolerance related commands
      inspect         Appln inspection related commands
      interface       Interface related commands
      loadbalance     Loadbalancing policy and class commands
      pki             PKI related commands
      probe           Health probe related commands
      rserver         Real server related commands
      serverfarm      Serverfarm related commands
      ssl             SSL related commands
      sticky          Sticky related commands
      vip             Virtual server related commands
    You can create a permit or deny rule, within that, create/debug/modify/monitor each feature seperately.
    Domains allow you to create containers for objects.  You can place specific rservers, serverfarms, etc. into it - then apply it to a role so that the user assigned to it can only touch those objects.
    Regards,
    Chris Higgins

  • ACE 4710 and mangled HTTP requests

    After replacing a Cisco CSS/SSL  Accelorator and PIX firewall with an ACE 4710 to do load balancing and  SSL encryption behind an ASA firewall we started seeing mangled HTTP  requests in the Apache access logs for the servers in the server farm.  Here is one example:
    XX.XX.XXX.XXX  - - [21/Oct/2012:01:42:12 -0500]  "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    Rather  than appearing just after the timestamp, the "POST /register/LServlet"  is tacked on to header information that shouldn't even appear in the  log. Also the first letter in that header information is always missing  (heckoutFlag instead of checkoutFlag in this example). 
    The  mangled request always shows up as a 501 HTTP error and shows up late  in the Apache access logs (timestamp is out of chronogical order) and  always appears with several duplicate POSTs:
    XX.XX.XXX.XXX - - [21/Oct/2012:01:42:23 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XX.XXX  - - [21/Oct/2012:01:42:12 -0500]   "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet"  "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    This is occurring for several different URLs and not just the one above and for multiple web browsers.
    The ACE load balances to servers running Tomcat 7 with Apache HTTP server v. 2.2.14.
    A recent ACE software upgrade to A5(2.1) has not fixed the problem.
    Has anyone seen this before?
    Thanks for any insight you can provide.
    -Kari

    Hi Kari,
    Do you have a sample of the configuration which you got with the CSS?
    What is the current configuration which you got on the ACE?
    Can you shows this output: # show stats http?
    Jorge

  • ACE 4710: Config Allows all traffic except large HTTP downloads

    Hi Folks,
    Got an ACE 4710 with a basic config that seems to work for all traffic except large downloads.
    I've attached the current config
    As I mentioned I can do normal HTTP to a standard destination like google or SSH through the ACE or ICMP
    If i try to get a large file from the server side of ACE, then a trace shows that the first and subsequent 1460Byte packets dont go through ACE
    I've thought of parse lengths, but i cannot see any that seem to affect the generic L4 maps that I am trying to use
    Cheers
    Alan

    I've seen a similar fault. I suppose a lower MSS was sent in the TCP SYN handshake packets (1300 or 1380?) and the packets exceeding that value were dropped by the ACE. This is the default behavior which can be switched to a less strict mode by either
    exceed-mss allow
    or
    no normalization
    commands.
    In our case, a linux web server was whose replies wouldn't keep to the MSS limit.

  • ACE 4710 HTTP Probes

    Using the ACE 4710 for loadbalancing a Sharepoint site.
    We currently have a HTTP probe setup to check the port 80 status of the rserver.
    Is there anyway to get the HTTP probe to check a DNS entry for each of the application sites? For instance http://info vs http://site are two different web sites running on the same IP. One site could have a problem but the actual port 80 for the IP may be still alive.
    Thanks for any information.

    Has anyone figure this out?  I am tring to get healthchecks/probes setup in this same fashion.  I have 2 servers with 1 IP but have many sites.  I want to probe each side and ensure I get a 200 code.  I also have to provide credentials to the site.  It seems that if i open IE I can log in just fine to the site with the credentials.  However there is an active x control box that is wanting to be installed.  When I set this up on my ACE it seems I am getting a http 401 unauthorized error.  I have done a wireshark capture while I was browsing and I see the 401 however it also reports a 200 code after that.  Do you think this is a problem because of the active x control wanting to be downloaded?  Or is this an issue with the first http code that is recieved by the probe, that being the 401 and then the 200? Below is my config (cleaned of course).
    probe http HTTP-80-OUR.DOMAIN.COM
      interval 15
      passdetect interval 60
      credentials
      request method get url http://our.domain.com/default.aspx
      expect status 200 200
      header Host header-value "our.domain.com"
      open 1
    rserver host SERVER-A
      ip address X.X.X.47
      inservice
    rserver host SERVER-B
      ip address X.X.X.48
      inservice
    serverfarm host FARM-AB
      predictor leastconns
      probe HTTP-80-OUR.DOMAIN.COM
      rserver SERVER-A
        inservice
      rserver SERVER-B
        inservice
    ACE4710# show probe HTTP-80-OUR.DOMAIN.COM detail
    probe       : HTTP-80-OUR.DOMAIN.COM
    type        : HTTP
    state       : ACTIVE
    description :
       port      : 80      address     : 0.0.0.0         addr type  : -
       interval  : 15      pass intvl  : 60              pass count : 3
       fail count: 3       recv timeout: 10
       http method      : GET
       http url         : http://our.domain.com
       conn termination : GRACEFUL
       expect offset    : 0         , open timeout     : 1
       expect regex     : -
       send data        : -
                    ------------------ probe results ------------------
       associations ip-address      port  porttype probes   failed   passed   health
       ------------ ---------------+-----+--------+--------+--------+--------+------
       serverfarm  : OUR.DOMAIN.COM-10.25.4.12-L3-FARM
         real      : SERVER-A[0]
                    X.X.X.47      80    DEFAULT  414      406      8        FAILED
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 2
       No. Probes skipped  : 0         Last status code  : 401
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err : Received invalid status code
       Last probe time     : Wed Jun  2 17:44:18 2010
       Last fail time      : Wed Jun  2 13:37:04 2010
       Last active time    : Wed Jun  2 13:34:19 2010
         real      : SERVER-B[0]
                    X.X.X.48      80    DEFAULT  414      406      8        FAILED
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 2
       No. Probes skipped  : 0         Last status code  : 401
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err : Received invalid status code
       Last probe time     : Wed Jun  2 17:44:20 2010
       Last fail time      : Wed Jun  2 13:37:06 2010
       Last active time    : Wed Jun  2 13:34:21 2010

  • ACE 4710 - Internet Explorer cannot display the webpage randomly

    We have a ACE 4710 with a basic config, (see below).
    When clicking on a tab from a window within Interent explorer we occasionally get an issue with it returning: "Internet Explorer cannot display the webpage" The details show "Access is denied" accessing a particular line of a javascript file.
    We have put one web server out of service in the farm to make sure that this isn't a result of stickyness not quite working.
    We have tested extensively by going directly to the web server directly without the load balancer and cannot reproduce the problem but we can produce the issue within a few minutes when going to the load balanced address.
    Thanks in advance for any advice.
    HOST-1/Admin# show run
    Generating configuration....
    logging enable
    logging fastpath
    logging standby
    logging timestamp
    logging trap 6
    logging history 6
    resource-class SLB_ResourceClass_T_R
      limit-resource all minimum 10.00 maximum unlimited
    resource-class sticky
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-t1k9-mz.A5_1_2.bin
    peer hostname HOST-2
    hostname HOST-1
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      description LB003
      switchport access vlan 1
      shutdown
    interface gigabitEthernet 1/4
      description LB004
      switchport access vlan 2
      shutdown
    interface port-channel 1
      port-channel load-balance src-dst-port
      no shutdown
    clock timezone standard GMT
    switch-mode
    context Admin
      description SUTLB01
      member SLB_ResourceClass_T_R
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe tcp probe_tcp_80
      port 80
    rserver host Server_S_W301
      description Server_S_W301
      ip address x.x.32.152
      inservice
    rserver host Server_S_W302
      description Server_S_W302
      ip address x.x.32.154
      inservice
    serverfarm host sfarm_T_R
      description sfarm_T_R
      predictor leastconns
      probe probe_tcp_80
      rserver Server_S_W301 80
      rserver Server_S_W302 80
        inservice
    sticky http-cookie Cookie1 T_R_sticky_cookie
      cookie insert browser-expire
      timeout 3600
      serverfarm sfarm_T_R
    class-map match-any T_R_L4Class
      2 match virtual-address x.x.33.150 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match T_R_L7policy
      class class-default
        sticky-serverfarm T_R_sticky_cookie
    policy-map multi-match T_R_L4Policy
      class T_R_L4Class
        loadbalance vip inservice
        loadbalance policy T_R_L7policy
        loadbalance vip icmp-reply active
        nat dynamic 2 vlan 1000
    interface vlan 1000
      ip address x.x.33.148 255.255.254.0
      access-group input ALL
      nat-pool 2 x.x.33.151 x.x.33.151 netmask 255.255.254.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input T_R_L4Policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 x.x.32.1
    ssh key rsa 1024 force

    +------------------------------------------+
    +-------------- HTTP statistics -----------+
    +------------------------------------------+
    LB parse result msgs sent : 421347     , TCP data msgs sent       : 2099597
    Inspect parse result msgs : 0          , SSL data msgs sent       : 0
                          sent
    TCP fin msgs sent         : 6169       , TCP rst msgs sent:       : 769
    Bounced fin msgs sent     : 5          , Bounced rst msgs sent:   : 1
    SSL fin msgs sent         : 0          , SSL rst msgs sent:       : 0
    Drain msgs sent           : 337811     , Particles read           : 5040829
    Reuse msgs sent           : 0          , HTTP requests            : 342499
    Reproxied requests        : 183422     , Headers removed          : 37475
    Headers inserted          : 342124     , HTTP redirects           : 0
    HTTP chunks               : 224859     , Pipelined requests       : 71466
    HTTP unproxy conns        : 267246     , Pipeline flushes         : 0
    Whitespace appends        : 0          , Second pass parsing      : 0
    Response entries recycled : 71302      , Analysis errors          : 0
    Header insert errors      : 22         , Max parselen errors      : 215
    Static parse errors       : 99         , Resource errors          : 0
    Invalid path errors       : 0          , Bad HTTP version errors  : 0
    Headers rewritten         : 0          , Header rewrite errors    : 0
    SSL headers inserted      : 0          , SSL header insert errors : 0
    SSL spoof headers deleted : 0         , Unproxy msgs sent         : 267246
    HTTP passthrough stat     : 0
    NOTE - We did turn on caching at one point to try and resolve the issue but it has since been turned off

Maybe you are looking for