ACE 4710 - QOS

                  I have a pair of ACE 4710 and I think I have all the failover configured correctly and it all appears to be working.  My question is regarding setting QOS on the physical interfaces that are part of my port channel.  I have qos trust cos enabled on all the interfaces in my port channel.  These interfaces are connected to a 3750 swith.  Do I need to configure QOS on the 3750 to allow the COS bit to pass through my 3750 to my peer?

Hi
No, default QoS configuration for 3750 is when QoS is disabled. In this situation 3750 simply doesn't touch packets at all and pass QoS values unchanged. However it doesn't do any prioritization either.
http://www.cisco.com/en/US/products/hw/switches/ps5023/products_tech_note09186a0080883f9e.shtml#concept11

Similar Messages

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • Cannot Telnet to ACE 4710 after upgrade to A4(2.3)

             I have a pair of ACE 4710s with 12 contexts sharing the load, running A4(2.1). Yesterday I upgraded one of them to A4(2.3)
    now I cannot telnet to the Admin context.Pings ok. I can telnet to other contexts on the box and everything seems to be working ok   
    when i do a " sh telnet"
    comes back with
    No Session Information is available
    sh telnet maxsessions
    telnet maxsessions 16
    Can anybody help?

    further this post, it was not a resource problem as had allocated 5% for the Admin context.
    I up graded IOS Saturday evening, could not Telnet in, tried again on Sunday same result,
    though this morning (Monday) Can now telnet in ok very strange
    I was connecting via the AUX line of a 2851 router to the console port.
    whe I disconnected this morning I saw the following message
    INIT: id "T0" respawning too fast : disabled for  5 minutes
    not sure if this is a 2851 message or an ACE message, but after getting that message is when I was able to Telnet in
    was it a coincidence
    anybody any ideas

  • ACE 4710: Possible to allow a user to clear counters but nothing else?

    Hello all,
    Using an ACE 4710 we have a user setup with the Network-Monitor role which allows the user to view config, interface status, etc.  We would also like to allow this user to clear the interface error counters as well, but nothing else.  Is this possible?
    Thanks!

    Hello Brandon-
    Network-Monitor only lets you browse outputs, it is a not a role that allows a user to make any changes including clearing stats.  You can create custom roles and domains to get closer to what you want, but you cannot zero in on a single command like that.
    i.e.
    ACE# conif t
    ACE(config)# role MyRole
    ACE(config-role)# rule 1 permit modify feature ?
      AAA             AAA related commands
      access-list     ACL related commands
      connection      TCP/UDP related commands
      fault-tolerant  Fault tolerance related commands
      inspect         Appln inspection related commands
      interface       Interface related commands
      loadbalance     Loadbalancing policy and class commands
      pki             PKI related commands
      probe           Health probe related commands
      rserver         Real server related commands
      serverfarm      Serverfarm related commands
      ssl             SSL related commands
      sticky          Sticky related commands
      vip             Virtual server related commands
    You can create a permit or deny rule, within that, create/debug/modify/monitor each feature seperately.
    Domains allow you to create containers for objects.  You can place specific rservers, serverfarms, etc. into it - then apply it to a role so that the user assigned to it can only touch those objects.
    Regards,
    Chris Higgins

  • ACE 4710 in bridge mode not working

    I am trying to configure ACE 4710 bridge mode and I am stuck up in physical interface configuration. I have configured gig1/2 of ACE as trunk port and on layer 2 switch I have assigned that interface (gig1/2) to VLAN 11. I tried trunk port also but it got disabled due to BPDU error.
    I am not able to ping servers as well as gateway. Below are the topology and context configuration:
    Router   (vlan 13: IP 172.16.11.254)
         |
    ACE     (int gig1/2)
         |
    L2 Switch
         |
    Servers (vlan 11: IP 172.16.11.1 and 11.2)
    Admin Context
    ===========
    resource-class rc1
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 0.20 maximum unlimited
    boot system image:c4710ace-mz.A3_2_4.bin
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      switchport trunk allowed vlan 11,13
      no shutdown
    interface gigabitEthernet 1/3
      shutdown
    interface gigabitEthernet 1/4
      shutdown
    access-list ALL line 8 extended permit ip any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    interface vlan 1000
      ip address 172.16.16.16 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.16.254
    context test
      allocate-interface vlan 11
      allocate-interface vlan 13
      member rc1
    test Context
    =========
    access-list bpdu-fixup ethertype permit bpdu
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    rserver host srv1
      ip address 172.16.11.1
      inservice
    rserver host srv2
      ip address 172.16.11.2
      inservice
    serverfarm host srv
      rserver srv1
        inservice
      rserver srv2
        inservice
    sticky ip-netmask 255.255.255.255 address both SG1
      timeout 120
      serverfarm srv
    class-map type management match-any remote-mgmt
      201 match protocol snmp any
      202 match protocol ssh any
      203 match protocol icmp any
      204 match protocol http any
      205 match protocol https any
      206 match protocol xml-https any
    class-map match-all slb-vip
      2 match virtual-address 172.16.11.10 any
    policy-map type management first-match remote-mgmt
      class remote-mgmt
        permit
    policy-map type loadbalance first-match slb
      class class-default
        sticky-serverfarm SG1
    policy-map multi-match client-vips
      class slb-vip
        loadbalance vip inservice
        loadbalance policy slb
        loadbalance vip icmp-reply
    interface vlan 11
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      no shutdown
    interface vlan 13
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      service-policy input remote-mgmt
      service-policy input client-vips
      no shutdown
    interface bvi 1
      ip address 172.16.11.9 255.255.255.0
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.11.254
    Could you pls. suggest where I am doing wrong?
    Thanks,
    Pawan

    " I tried trunk port also but it got disabled"   <----- if your L2 config is not correct, nothing will work.
    What is the setup on the switch ? Trunk or access vlan ?
    What is the status of the interface ? up ? down ?
    Do you see something in your arp table ?
    Gilles.

  • ACE 4710 - show stats connection questions

    Hi,
    I have three questions regarding the "show stats connection" command in the ACE 4710:
    1. What is the criteria for a connection to be added to the "Total Connections Failed" counter?
    2. What is the criteria for a connection to be added to the "Total Connections Timed-out" counter?
    3. Is there a command to get more information why the connection was failed or timed-out (e.g. to/from which IP, url accessed etc.)?
    Thanks in advance for your help!
    Best regards,
    Harry

    Harry,
    a connection failed if the server did not respond or resonded with a RST.
    As long as the connection gets establised, it is counted as a success.
    The connection timeout counter is incremented when the connection is idle for the configured timeout value or for L7 connections if it does not complete the 3-way handshale within the embryonic timeout interval.
    Since this is clear why those counters are incrementing, the only way to get more information is to capture a sniffer trace to verify if the conditions above are met.
    Gilles.

  • ACE 4710. Unable to clear ssh sessions

    Hi.
    Once in the CLI of an ACE 4710, using the command "clear ssh session id" I am unable to clear/kill any of the remote ssh sessions established.
    According to the administration guide, the "clear ssh .." command must clear the sessions, but it does not, or maybe I am missing something?
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/administration/guide/access.html#wp1050335
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Tabla normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    ACE/CONTEXTO_A# show ssh session-info
    Session ID     Remote Host         Active Time
    13728          222.98.54.158:50556   67:43:38
    13732          200.44.158.70:46172   67:43:36
    13735          200.44.158.70:46174   67:43:36
    13737          200.44.158.70:46177   67:43:36
    ACE/CONTEXTO_A#
    ACE/CONTEXTO_A# clear ssh 13728
    ACE/CONTEXTO_A# clear ssh 13732
    ACE/CONTEXTO_A# clear ssh 13735
    ACE/CONTEXTO_A# clear ssh 13737
    ACE/CONTEXTO_A# show ssh session-info
    Session ID     Remote Host         Active Time
    13728          222.98.54.158:50556   67:43:54
    13732          200.44.158.70:46172   67:43:52
    13735          200.44.158.70:46174   67:43:52
    13737          200.44.158.70:46177   67:43:52

    Hello,
    Seems to be working for me in my tests.  Works in the Admin context and a user context, and when clearing connections from console connection or one of the SSH sessions.
    ace-appliance-15/CTX1# sho ssh sess
    Session ID     Remote Host         Active Time
    24705          161.44.77.245:1586     0: 1:42
    25100          161.44.77.245:1589     0: 0:27
    25116          161.44.77.245:1590     0: 0:16
    ace-appliance-15/CTX1# clear ssh 25116
    ace-appliance-15/CTX1#
    ace-appliance-15/CTX1# sho ssh sess
    Session ID     Remote Host         Active Time
    24705          161.44.77.245:1586     0: 2: 5
    25100          161.44.77.245:1589     0: 0:50
    What version of software are you running on your 4710?  I am running the latest A3(2.4).  Can you try this version?
    Thanks,
    Sean

  • ACE 4710 and mangled HTTP requests

    After replacing a Cisco CSS/SSL  Accelorator and PIX firewall with an ACE 4710 to do load balancing and  SSL encryption behind an ASA firewall we started seeing mangled HTTP  requests in the Apache access logs for the servers in the server farm.  Here is one example:
    XX.XX.XXX.XXX  - - [21/Oct/2012:01:42:12 -0500]  "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    Rather  than appearing just after the timestamp, the "POST /register/LServlet"  is tacked on to header information that shouldn't even appear in the  log. Also the first letter in that header information is always missing  (heckoutFlag instead of checkoutFlag in this example). 
    The  mangled request always shows up as a 501 HTTP error and shows up late  in the Apache access logs (timestamp is out of chronogical order) and  always appears with several duplicate POSTs:
    XX.XX.XXX.XXX - - [21/Oct/2012:01:42:23 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XX.XXX  - - [21/Oct/2012:01:42:12 -0500]   "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet"  "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    This is occurring for several different URLs and not just the one above and for multiple web browsers.
    The ACE load balances to servers running Tomcat 7 with Apache HTTP server v. 2.2.14.
    A recent ACE software upgrade to A5(2.1) has not fixed the problem.
    Has anyone seen this before?
    Thanks for any insight you can provide.
    -Kari

    Hi Kari,
    Do you have a sample of the configuration which you got with the CSS?
    What is the current configuration which you got on the ACE?
    Can you shows this output: # show stats http?
    Jorge

  • Facing Issue in ACE 4710 ..Secondary ACE showing as FSM_FT_STATE_STANDBY_COLD ...

    Hi All ,
     I am facing problem with my ACE 4710 in active-standby environment . When I check Show ft group detail on my Active ACE , it shows peer state as
    FSM_FT_STATE_STANDBY_COLD for Admin context . Below is the output :
    Primary_ACE/Admin#sh ft group detail
    FT Group                     : 1
    No. of Contexts              : 1
    Context Name                 : Admin
    Context Id                   : 0
    Configured Status            : in-service
    Maintenance mode             : MAINT_MODE_OFF
    My State                     : FSM_FT_STATE_ACTIVE
    My Config Priority           : 120
    My Net Priority              : 120
    My Preempt                   : Enabled
    Peer State                   : FSM_FT_STATE_STANDBY_COLD
    Peer Config Priority         : 100
    Peer Net Priority            : 100
    Peer Preempt                 : Enabled
    Peer Id                      : 1
    Last State Change time       : Tue Jan  1 05:32:55 2002
    Running cfg sync enabled     : Enabled
    Running cfg sync status      : Peer in Cold State. Error on Standby device when
    applying configuration file replicated from active
    Startup cfg sync enabled     : Enabled
    Startup cfg sync status      : Peer in Cold State. Startup configuration sync ha
    [7m--More--[m
    s completed
    Bulk sync done for ARP: 0
    Bulk sync done for LB: 0
    Bulk sync done for ICM: 0
    FT Group                     : 2
    No. of Contexts              : 1
    Context Name                 : APP_Context
    Context Id                   : 1
    Configured Status            : in-service
    Maintenance mode             : MAINT_MODE_OFF
    My State                     : FSM_FT_STATE_ACTIVE
    My Config Priority           : 120
    My Net Priority              : 120
    My Preempt                   : Enabled
    Peer State                   : FSM_FT_STATE_STANDBY_HOT
    Peer Config Priority         : 100
    Peer Net Priority            : 100
    Peer Preempt                 : Enabled
    Peer Id                      : 1
    Last State Change time       : Tue Jan  1 05:32:56 2002
    Running cfg sync enabled     : Enabled
    [7m--More--[m
    Running cfg sync status      : Running configuration sync has completed
    Startup cfg sync enabled     : Enabled
    Startup cfg sync status      : Startup configuration sync has completed
    Bulk sync done for ARP: 0
    Bulk sync done for LB: 0
    Bulk sync done for ICM: 0
    Also when I give show ft config-errors on my secondary ACE it gives the following result .
    Secondary_ACE/Admin#sh ft config-error
    Mon Jun 10 00:04:11 IST 2002
    `no 3 match virtual-address 10.40.3.15 tcp eq https`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.15 tcp eq 8082`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.21 tcp eq www`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.21 tcp eq https`
    Error: LB action requires match vip command
    `2 match virtual-address 10.40.3.21 tcp eq https`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.21 tcp eq www`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.15 tcp eq 8082`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.15 tcp eq https`
    Error: This configuration already exists
    Error(s) while applying config.
     I am attaching the running configuration of both the ACE's . Kindly help me in resolving the issue .
    Also I noticed one thing . There is configuration difference in Primary and Secondary ACE . I guess this is causing the issue .
    Need help to fix this asap .
     Following configuration is missing on the secondary ACE .
    ======================================================================
    class-map match-all WEB_FARM_VIP-80
      3 match virtual-address 10.40.3.15 tcp eq www
    policy-map type loadbalance first-match WEB_FARM_VIP-80-l7slb
      class class-default
        serverfarm HTTP-2-HTTPS
      class WEB_FARM_VIP-80
        loadbalance vip inservice
        loadbalance policy WEB_FARM_VIP-80-l7slb
    Thanks ,
    Tushar

    Dear all,
    Pls help me out in this regard, I dont have much idea about ACE.
    Regards,
    Sashi

  • ACE 4710 Web Optimization Licnesing

    I currently have a 4710 running the 1Gbps package. We are utilizing Application Acceleration and are comg very close to hitting our 10,000 Web Optimization connection limit. I am trying to find out how to upgrade that.
    I see in our license usage an option of ACE-AP-OPT-UP1-K9 but can find no information on this part number. Does anyone know if this is even available and what it brings you connection limit to?
    ACE01/Admin# show license usage
    License                      Ins   Lic    Status   Expiry Date   Comments
                                      Count
    ACE-AP-C-UP1                  No     -    Unused                 -
    ACE-AP-C-UP2                  No     -    Unused                 -
    ACE-AP-C-UP3                  No     -    Unused                 -
    ACE-AP-01-LIC                 No     -    Unused                 -
    ACE-AP-01-UP1                 No     -    Unused                 -
    ACE-AP-02-LIC                 No     -    Unused                 -
    ACE-AP-02-UP1                 No     -    Unused                 -
    ACE-AP-04-LIC                 No     -    Unused                 -
    ACE-AP-04-UP1                 No     -    Unused                 -
    ACE-AP-04-UP2                 No     -    Unused                 -
    ACE-AP-VIRT-5                 No     -    Unused                 -
    ACE-AP-500M-LIC               No     -    Unused                 -
    ACE-AP-VIRT-020               No     -    Unused                 -
    ACE-AP-C-100-LIC              No     -    Unused                 -
    ACE-AP-C-500-LIC              Yes    1    In use   never         -
    ACE-AP-C-500-UP1              No     -    Unused                 -
    ACE-AP-OPT-50-K9              No     -    Unused                 -
    ACE-AP-C-1000-LIC             No     -    Unused                 -
    ACE-AP-C-2000-LIC             No     -    Unused                 -
    ACE-AP-OPT-LIC-K9             Yes    1    In use   never         -
    ACE-AP-OPT-UP1-K9             No     -    Unused                 -
    ACE-AP-SSL-05K-K9             Yes    1    In use   never         -
    ACE-AP-SSL-07K-K9             No     -    Unused                 -
    ACE-AP-SSL-100-K9             No     -    Unused                 -
    ACE-AP-SSL-UP1-K9             No     -    Unused                 -
    ACE-AP-SSLUP-5K-K9            No     -    Unused                 -
    ACE-AP-VIRT-020-UP            No     -    Unused                 -

    Unfortunately, ACE-AP-OPT-LIC-K9 is not available on ACE4710 and
    ACE 4710 cannot handle more than 10,000 concurrent connections..
    When you use the ACE to perform a specific set of application
    acceleration and optimization functions, and the ACE reaches the
    maximum of 10,000 concurrent connections, the appliance stops
    accepting any additional concurrent connections until the count
    drops below 10,000.
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_x/command/reference/optimize.html#wp1048813
    Regards,
    Yuji

  • ACE 4710: Config Allows all traffic except large HTTP downloads

    Hi Folks,
    Got an ACE 4710 with a basic config that seems to work for all traffic except large downloads.
    I've attached the current config
    As I mentioned I can do normal HTTP to a standard destination like google or SSH through the ACE or ICMP
    If i try to get a large file from the server side of ACE, then a trace shows that the first and subsequent 1460Byte packets dont go through ACE
    I've thought of parse lengths, but i cannot see any that seem to affect the generic L4 maps that I am trying to use
    Cheers
    Alan

    I've seen a similar fault. I suppose a lower MSS was sent in the TCP SYN handshake packets (1300 or 1380?) and the packets exceeding that value were dropped by the ACE. This is the default behavior which can be switched to a less strict mode by either
    exceed-mss allow
    or
    no normalization
    commands.
    In our case, a linux web server was whose replies wouldn't keep to the MSS limit.

  • ACE 4710 Connectivity help?

    I'm using an ACE 4710 in a new datacenter, with the following setup:
    2/4 physical ethernet interfaces port channeled into port-channel 1
    2/4 physical ethernet interfaces port channeled into port-channel 2
    I have the following vlans defined:
    1001 - admin     - interface ip: 10.53.136.70
    400 - client side - interface ip: 10.53.136.100
    500 - server side - interface ip: 192.168.128.1
    999 - fault tolerance - interface ip: 192.168.11.2
    My problem is I am trying to nat ssh and web server traffic from the client side, to the server side, but it's never getting to the server.  For example, if I ssh to 10.53.136.102, it times out.  (10.53.136.102 should get nat'd to 192.168.128.2)
    Also, I can connect to the ACE 4710 via telnet using 10.53.136.70, but cannot connect to 10.53.136.100.
    I'm thinking there is either something wrong with the port-channels, or the access lists.  On the other hand there could be something wrong with the nat'ing, but I had it working before switching over to the port-channels.
    Any thoughts?
    Thanks,
    Brent

    I've attached the two contexts which we are using.  The admin context is new_lb_config.txt and the second context where the loadbalancing occurs is in the new_lb_config_VC_WBPX.txt file.
    From the load balancer, I am able to ping the real server ips in the 192.168. ip range.  The 4710 recognizes that they are in service.
    I believe the ACL for the VLAN 400 is set to permit all traffic, but I don't know if the service policies are preventing something from happening.
    Right now, I have disconnected the two 4710s and I am only working on one of them to see if I can get the basic connectivity going.  Once I accomplish that, I will work on high availability.  I'll have to check whether it thinks it is in passive mode...not entirely sure how to do that, but I will check it out.
    Thanks,
    Brent

  • ACE 4710 HTTP Probes

    Using the ACE 4710 for loadbalancing a Sharepoint site.
    We currently have a HTTP probe setup to check the port 80 status of the rserver.
    Is there anyway to get the HTTP probe to check a DNS entry for each of the application sites? For instance http://info vs http://site are two different web sites running on the same IP. One site could have a problem but the actual port 80 for the IP may be still alive.
    Thanks for any information.

    Has anyone figure this out?  I am tring to get healthchecks/probes setup in this same fashion.  I have 2 servers with 1 IP but have many sites.  I want to probe each side and ensure I get a 200 code.  I also have to provide credentials to the site.  It seems that if i open IE I can log in just fine to the site with the credentials.  However there is an active x control box that is wanting to be installed.  When I set this up on my ACE it seems I am getting a http 401 unauthorized error.  I have done a wireshark capture while I was browsing and I see the 401 however it also reports a 200 code after that.  Do you think this is a problem because of the active x control wanting to be downloaded?  Or is this an issue with the first http code that is recieved by the probe, that being the 401 and then the 200? Below is my config (cleaned of course).
    probe http HTTP-80-OUR.DOMAIN.COM
      interval 15
      passdetect interval 60
      credentials
      request method get url http://our.domain.com/default.aspx
      expect status 200 200
      header Host header-value "our.domain.com"
      open 1
    rserver host SERVER-A
      ip address X.X.X.47
      inservice
    rserver host SERVER-B
      ip address X.X.X.48
      inservice
    serverfarm host FARM-AB
      predictor leastconns
      probe HTTP-80-OUR.DOMAIN.COM
      rserver SERVER-A
        inservice
      rserver SERVER-B
        inservice
    ACE4710# show probe HTTP-80-OUR.DOMAIN.COM detail
    probe       : HTTP-80-OUR.DOMAIN.COM
    type        : HTTP
    state       : ACTIVE
    description :
       port      : 80      address     : 0.0.0.0         addr type  : -
       interval  : 15      pass intvl  : 60              pass count : 3
       fail count: 3       recv timeout: 10
       http method      : GET
       http url         : http://our.domain.com
       conn termination : GRACEFUL
       expect offset    : 0         , open timeout     : 1
       expect regex     : -
       send data        : -
                    ------------------ probe results ------------------
       associations ip-address      port  porttype probes   failed   passed   health
       ------------ ---------------+-----+--------+--------+--------+--------+------
       serverfarm  : OUR.DOMAIN.COM-10.25.4.12-L3-FARM
         real      : SERVER-A[0]
                    X.X.X.47      80    DEFAULT  414      406      8        FAILED
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 2
       No. Probes skipped  : 0         Last status code  : 401
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err : Received invalid status code
       Last probe time     : Wed Jun  2 17:44:18 2010
       Last fail time      : Wed Jun  2 13:37:04 2010
       Last active time    : Wed Jun  2 13:34:19 2010
         real      : SERVER-B[0]
                    X.X.X.48      80    DEFAULT  414      406      8        FAILED
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 2
       No. Probes skipped  : 0         Last status code  : 401
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err : Received invalid status code
       Last probe time     : Wed Jun  2 17:44:20 2010
       Last fail time      : Wed Jun  2 13:37:06 2010
       Last active time    : Wed Jun  2 13:34:21 2010

  • ACE 4710 - Internet Explorer cannot display the webpage randomly

    We have a ACE 4710 with a basic config, (see below).
    When clicking on a tab from a window within Interent explorer we occasionally get an issue with it returning: "Internet Explorer cannot display the webpage" The details show "Access is denied" accessing a particular line of a javascript file.
    We have put one web server out of service in the farm to make sure that this isn't a result of stickyness not quite working.
    We have tested extensively by going directly to the web server directly without the load balancer and cannot reproduce the problem but we can produce the issue within a few minutes when going to the load balanced address.
    Thanks in advance for any advice.
    HOST-1/Admin# show run
    Generating configuration....
    logging enable
    logging fastpath
    logging standby
    logging timestamp
    logging trap 6
    logging history 6
    resource-class SLB_ResourceClass_T_R
      limit-resource all minimum 10.00 maximum unlimited
    resource-class sticky
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-t1k9-mz.A5_1_2.bin
    peer hostname HOST-2
    hostname HOST-1
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      description LB003
      switchport access vlan 1
      shutdown
    interface gigabitEthernet 1/4
      description LB004
      switchport access vlan 2
      shutdown
    interface port-channel 1
      port-channel load-balance src-dst-port
      no shutdown
    clock timezone standard GMT
    switch-mode
    context Admin
      description SUTLB01
      member SLB_ResourceClass_T_R
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe tcp probe_tcp_80
      port 80
    rserver host Server_S_W301
      description Server_S_W301
      ip address x.x.32.152
      inservice
    rserver host Server_S_W302
      description Server_S_W302
      ip address x.x.32.154
      inservice
    serverfarm host sfarm_T_R
      description sfarm_T_R
      predictor leastconns
      probe probe_tcp_80
      rserver Server_S_W301 80
      rserver Server_S_W302 80
        inservice
    sticky http-cookie Cookie1 T_R_sticky_cookie
      cookie insert browser-expire
      timeout 3600
      serverfarm sfarm_T_R
    class-map match-any T_R_L4Class
      2 match virtual-address x.x.33.150 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match T_R_L7policy
      class class-default
        sticky-serverfarm T_R_sticky_cookie
    policy-map multi-match T_R_L4Policy
      class T_R_L4Class
        loadbalance vip inservice
        loadbalance policy T_R_L7policy
        loadbalance vip icmp-reply active
        nat dynamic 2 vlan 1000
    interface vlan 1000
      ip address x.x.33.148 255.255.254.0
      access-group input ALL
      nat-pool 2 x.x.33.151 x.x.33.151 netmask 255.255.254.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input T_R_L4Policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 x.x.32.1
    ssh key rsa 1024 force

    +------------------------------------------+
    +-------------- HTTP statistics -----------+
    +------------------------------------------+
    LB parse result msgs sent : 421347     , TCP data msgs sent       : 2099597
    Inspect parse result msgs : 0          , SSL data msgs sent       : 0
                          sent
    TCP fin msgs sent         : 6169       , TCP rst msgs sent:       : 769
    Bounced fin msgs sent     : 5          , Bounced rst msgs sent:   : 1
    SSL fin msgs sent         : 0          , SSL rst msgs sent:       : 0
    Drain msgs sent           : 337811     , Particles read           : 5040829
    Reuse msgs sent           : 0          , HTTP requests            : 342499
    Reproxied requests        : 183422     , Headers removed          : 37475
    Headers inserted          : 342124     , HTTP redirects           : 0
    HTTP chunks               : 224859     , Pipelined requests       : 71466
    HTTP unproxy conns        : 267246     , Pipeline flushes         : 0
    Whitespace appends        : 0          , Second pass parsing      : 0
    Response entries recycled : 71302      , Analysis errors          : 0
    Header insert errors      : 22         , Max parselen errors      : 215
    Static parse errors       : 99         , Resource errors          : 0
    Invalid path errors       : 0          , Bad HTTP version errors  : 0
    Headers rewritten         : 0          , Header rewrite errors    : 0
    SSL headers inserted      : 0          , SSL header insert errors : 0
    SSL spoof headers deleted : 0         , Unproxy msgs sent         : 267246
    HTTP passthrough stat     : 0
    NOTE - We did turn on caching at one point to try and resolve the issue but it has since been turned off

  • ACE 4710 A3(2.0) and ACS - TACACS+

    Hi.
    I am having trouble getting my ACE 4710 (A3(2.0) Build 3.0) to cooperate with my Cisco Secure ACS-server. In the same environment I have it working on my ACE Module, with the same configuration.
    ACE 4710:
    tacacs-server host 10.7.50.20 key 7 "fewhg"
    aaa group server tacacs+ tacacs_server_group
        server 10.7.50.20
        deadtime 15
    aaa authentication login default group tacacs_server_group local none
    aaa accounting default group tacacs_server_group local
    aaa authentication login error-enable
    ACS is configured correctly too. I have tried with several users, both in groups, with and without attributes and so forth. The ACS installation works with other devices and with my ACE modules running A2(3.1). I have tried this on both ACS 4.2(0).124 and 4.2(1).15.
    The strange part is what I see when I set up Wireshark on my ACS-server to look at the traffic. From what I can see, the ACE only sends a request to the AAA-server if the user exists locally. But I do not get authenticated and Failed Attempts show a line with with Message-Type: "Unknown NAS".
    It seems like others have the same problem. The problem is that the link attacked in the topic beneath only leads me back to forum and not to a topic with solution.
    https://supportforums.cisco.com/thread/132445?decorator=print&displayFullThread=true#132445
    Any help is appreciated and thanks in advance!

    are you using telnet or ssh ?
    if ssh can you try telnet, allow telent on your management policy to do this. Then if it works via telnet , then try ssh again, if it now works then you have hit CSCsu36078
    http://tools.cisco.com/squish/03240

Maybe you are looking for

  • Embed font as cff error

    Is there a way to get around an embed conflict with a spark Label components and mx.Alert component? I have embedded the Arial font in to my application: @font-face {    src:url("c:/windows/fonts/arial.ttf");    fontFamily: Arial;    embedAsCFF: true

  • Why cant apple remove their java and adobe restictions if they did that it would be the best phone on the market!!!!!

    why cant they make every site viewable.. if they would just get over themselves restricting the phones from certain sites.

  • Defaulting Quantiy as 1 in the sales order item

    Dear Experts, I want to default the quanity as 1 in sales order after entering the material at the item level and pressing enter. i tried with the MV45AFZZ user exits if i make forcefully RV45A-KWMENG as '1.000' and VBAP-KWMENG as '1.000' in MOVE FIE

  • Can't connect one but I connect the other. Help!!

    I have 2 Macbooks in my household. One of them connects to the internet just fine. One of them will not. It can connect to any other router but NOT this one. Airport recognizes the router, and even shows it as available. But for whatever reason it ju

  • Java for Mac OS X 10.5 Update 5 - Problems

    Using Software Update I downloaded "Java for Mac OS X 10.5 Update 5". After the restart I got the following error message:- *"The installer could not validate the contents of the 'JavaForMacOSX10.5Update5' package. Contact software manufacturer for a