ACE 4710 SSL server LB with stickiness

I will be replacing 11500 CSS which are not doing SSL termination, just load-balancing SSL sessions terminated on servers with ACE 4710.
On their CSS config, they were doing SSL-sticky. I understand the 4710 doesn't support SSL sticky, but can perform the same function by parsing the HTTP header. Has anyone done this config before and know where/how to parse the header to look for the SSL session# and stick connections to same server?
THANKS!

In Ace 2.x code GPP (Generic protocol parsing) was introduced that enables ACE to look into the Layer 4 payload.Which is how this stickiness id achieved.
details at
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/slb/guide/sticky.html#wp1133923
I dont think its currently available on ACE appliance yet.
Syed

Similar Messages

  • ACE 4710 and load balancing with sticky cookie

    Configuring load balancing with SSL termination and stickiness for a couple of citrix xenapp servers.  I'm doing a source-NAT as the ACE resides in the DMZ and these particular servers reside on the inside arm of the firewall.  The ACE is in bridged mode to load balance web servers that reside in the DMZ.  Everything seems to work just fine, but the cookie stickiness does not seem to be working.

    Hi David,
    As you may know, using Wireshark to look at an HTTPS capture is only useful if you've installed the server SSL key.This is why I find it easier to use something like LiveHTTPHeaders or HTTPWatch.
    When using cookie-insert, the ACE will not create any dynamic cookie entries.  It will simply create one static entry for each rserver with a cookie value, such as R3911631338, and any client that gets load balanced to that rserver will receive a cookie with that value.  So what you see there is what is expected.
    You are correct in that when using location cookies that the server supplies, the ACE will create a dynamic entry when it sees the server response with the cookie.   The cookie is included in the server's response, and the ACE will look for the value as configured.  The cookie will also be sent to the client.  If the cookie is not in the server's first response, you will need enable persistence-rebalance so that it will look in subsequent server responses.  If the browser opens new connections with that cookie, then the ACE will stick to the same server.
    My suggestion would be to get sticky working with cookie-insert first.  Then if that meets your needs, go with that permanently.  If you need to use server cookies, then once cookie insert is working, migrate your sticky to cookie location.
    Sean

  • ACE Graceful Server Shutdown with Sticky

    I would like a way to gracefully shutdown a server without killing the sessions of the current users on that server.
    I know the "no inservice" command will allow the server to finish servicing existing TCP connections, but what happens to the users that are 'stuck' to that server?
    What happens with sticky sessions when you reduce the connection limit for a server below the current connection count? How about reducing the weight of the server in the farm? Will the 'stuck' sessions continue to go to the correct server in the farm?

    switch/Admin(config)# serverfarm linux1
    switch/Admin(config-sfarm-host)# rserver linux1
    switch/Admin(config-sfarm-host-rs)# inservice ?
    standby Only allow connections reassigned from failed servers
    Carriage return.
    switch/Admin(config-sfarm-host-rs)# do sho ver
    Cisco Application Control Software (ACSW)
    TAC support: http://www.cisco.com/tac
    Copyright (c) 2002-2008, Cisco Systems, Inc. All rights reserved.
    The copyrights to certain works contained herein are owned by
    other third parties and are used and distributed under license.
    Some parts of this software are covered under the GNU Public
    License. A copy of the license is available at
    http://www.gnu.org/licenses/gpl.html.
    Software
    loader: Version 12.2[121]
    system: Version A2(1.0a) [build 3.0(0)A2(1.0a) adbuild_04:14:49-2008/04/18_
    As you can see I run A2(1.0a) and the command is there.
    G.

  • ACE 4710 & SSL Offloading

    I testing the 4710 for load balancing between 2 web servers. I have the http portion working just fine but would like to get some input on the SSL portion.
    We have a section of our site that requires user login and the whole session is https from when they login and when they are browsing through our site.
    My questions are within the design aspects. Would this best be designed using SSL offloading and then using clear text from the ACE to the web servers? Also, what would the differences be with configuring ssl offloading with stickiness if configured with http server load balancing on the same server farm versus creating a new server farm just for https? Would end-to-end ssl be best in this scenario?
    Description of the web application usage:
    Users log in and their whole session is https. Users will be filling out forms, inputting data, registering for events and uploading some files.

    Okay so that makes sense to me now. When the client requests an HTTPS page and the ACE terminates the connection, the ACE uses SSL rewrite/redirect to send the request back to the client so that the client still maintains the SSL connection. Otherwise it will request an HTTP page instead of the HTTPS page.
    Am I correct?

  • [ACE 4710] accessing server on serverfarm

    hi,
    i have 2 servers in serverfarm.
    the real IP for this 2 server are 172.16.34.5 and 172.16.34.6
    the virtual IP is 172.16.33.1
    the ip for vlan on server side is 172.16.34.10. the gateway on the 2 servers is 172.16.34.10
    the network gateway for vlan 34 is 172.16.34.62
    my question is, how can we access the individual server inside the server farm if we are not from the same vlan as the server?

    Hi,
    you need to create a static route on your upstream router for the server VLAN with next-hop the ACE.
    In you case it will be something like this:
    ip route 172.16.34.0 255.255.255.0 "ACE IP address of VLAN34"
    In case you have fault tolerance configured, use the alias IP of the ACEs on VLAN34.
    Don't forget that your ACL on the ACE needs to allow this traffic.
    If you use permit any any it shouldn't be a problem.
    HTH,
    Dario

  • ACE 4710 Disable server

    Hi again!
    Some say that there is a script command, that can disable a server when we want it. It's something like "disable_real" , but i haven't found anything about it... can anyone help please?
    Thanks!

    Need help/advise regarding routing to make this method working.
    When I change server gateway to ace server vlan interface, my server cannot communicate with other vlans. From context, I can ping server vlan and other vlans.
    *Core interface -172.16.36.254 (server vlan),172.19.30.254(client vlan).
    *Lb interface - 172.16.36.70, 172.19.30.65
    *Real Server ip is using default gateway 172.16.36.70
    Routing what I have done:
    CORE- ip route 172.16.36.0 255.255.255.0 172.16.36.70
          ip route 172.19.30.0 255.255.255.0 172.19.30.65
    LB- ip route 0.0.0.0 0.0.0.0 172.19.30.254
    Can someone help me to verify this?
    Thanks

  • CSS11503/ACE 4710 - SSL session id cache

    I have a couple of questions.
    1. I'd like to know what happens when the SSL session id cache (def 10k) gets filled on a CSS11503. Do new connections get dropped or do they still work but are they less efficient?
    2. What is the cache size on an ACE4710?

    The problem was caused by an incorrect nat pool.   Correct Mask was 255.255.255.0.

  • ACE 4710 SSL connection rate

    What exactly happens when the SSL connection rate is exceeded. Is the connection dropped, queued or what ?
    Defined as the SSL TPS. In our case 1000 but upgradeable to 5000

    Hi,
    The connection will be denied once the SSL connection rate is exceeded.
    That can be identified by using the command :
    show resource usage all
    You will see something like this :
            Resource         Current       Peak        Min        Max       Denied
    ssl-connections rate        995       1000          0       1000     28975
    You will notice that the deny counter will start increasing once the rate is exceeded.
    hope that helps.
    regards,
    Ajay Kumar

  • Ace 4710 SSL Proxy TLS (Beast) Mitigation

    Has anyone heard if there is an upgrade path to mitigate this recent tls1.0 and sslv3 exploit?
    Thanks
    Darren
    Sent from Cisco Technical Support iPad App

    Hi Darren,
    I haven't seen any official cisco comment about this yet.
    Also our customers are asking for updates on this security advisory....
    Edwin

  • ACE 4710 A3(2.0) and ACS - TACACS+

    Hi.
    I am having trouble getting my ACE 4710 (A3(2.0) Build 3.0) to cooperate with my Cisco Secure ACS-server. In the same environment I have it working on my ACE Module, with the same configuration.
    ACE 4710:
    tacacs-server host 10.7.50.20 key 7 "fewhg"
    aaa group server tacacs+ tacacs_server_group
        server 10.7.50.20
        deadtime 15
    aaa authentication login default group tacacs_server_group local none
    aaa accounting default group tacacs_server_group local
    aaa authentication login error-enable
    ACS is configured correctly too. I have tried with several users, both in groups, with and without attributes and so forth. The ACS installation works with other devices and with my ACE modules running A2(3.1). I have tried this on both ACS 4.2(0).124 and 4.2(1).15.
    The strange part is what I see when I set up Wireshark on my ACS-server to look at the traffic. From what I can see, the ACE only sends a request to the AAA-server if the user exists locally. But I do not get authenticated and Failed Attempts show a line with with Message-Type: "Unknown NAS".
    It seems like others have the same problem. The problem is that the link attacked in the topic beneath only leads me back to forum and not to a topic with solution.
    https://supportforums.cisco.com/thread/132445?decorator=print&displayFullThread=true#132445
    Any help is appreciated and thanks in advance!

    are you using telnet or ssh ?
    if ssh can you try telnet, allow telent on your management policy to do this. Then if it works via telnet , then try ssh again, if it now works then you have hit CSCsu36078
    http://tools.cisco.com/squish/03240

  • Technical differences between ACE-4710-K9 & ACE-4710-BAS-SK-K9

    Hi All,
    Iam trying to find technical diff between ACE-4710-K9 with ACE-AP-01-LIC & ACE-4710-BAS-SK-K9 with ACE-AP-BAS-LIC.
    Can someone shed some light..?
    Thank you all in advance
    MS

    As per my understanding
    Both will give you same functionality
    ACE-4710-BAS-SK-K9 is a basic kit/bundle
    that Includes:
    - ACE 4710 Hardware
    - ACE Software
    - 1 Gbps Throughput License
    - 1,000 SSL TPS
    - 100Mbps Compression
    - 5 Virtual Devices
    Where as
    "ACE-4710-K9 with ACE-AP-01-LIC" is kind of La Carte option
    ACE-4710-K9 is the ACE Appliance Hardware includes(1K SSL TPS, 5 contexts, 100Mbps comp)
    With it you need to select two mandatory options
    ACE Software :ACE-AP-SW-XX Software Version XX
    Throughput License :("ACE-AP-01-LIC" 1 Gbps OR "ACE-AP-02-LIC" 2 Gbps )
    Then you can select optional licences for
    SSL TPS, Virtual Devices, compression & App acceleration...(if you need to upgrade the defaults 1K SSL TPS, 5 contexts, 100Mbps comp)
    Syed iftekhar Ahmed

  • ACE 4710 - can I dynamically sticky all traffic to 1 server based on URL?

    Hello all, I'm new to the ACE 4710 and need to know some details about stickyness.
    As background, we are a small company with a SaaS product and a pair of webservers.
    I have set up the loadbalancing default L7 Load-balancing rule to sticky based on a Cookie based Stickey Group.
    That seems to be working and session traffic is sticking to a server during the user's session.
    Based on a request from our outsourced developer they would like the Loadbalancer to not only sticky the users sessions, but also sticky a url to a server.
    I would like this to happen dynamically as each of our clients will have their own url based on our standard domain like clientname.fixeddomain.com and I don't want to have to come back to the loadbalancer every time we add a client.
    As I said, I'm new to these devices but understand the concepts, and am in the position of having to make it work little to no tranining on this hardware and no budget at this point to pay someone else for configuration and setup.
    I just need to know at this point if I can stick all requests for a specific URL to a server to avoid caching issue while those sessions are active and have new connections to other client urls balanced among the webservers.
    Hopefully this request makes sense.
    Thanks,
    Mark Steeves.

    Daniel,
    Thanks for the reply, but I cannot reach the URL you included.  It gives me a 403.
    Therfore without reading the article, I wanted to ask if the proper setup would be:
    1. Default L7 load-balancing action: Primary action: Sticky: Stickey Group using
    Type = HTTP Header: Header name = Host
    2. Server Farm: Predictor: Least Connections or Round Robin to distribute the load between the 2 web servers.
    Using this setting in testing, it looks like all the traffic keeps going to 1 server only.  Granted there is not much traffic t the servers, but I have 2 different url being tested. url1.ourdomain.com & url2.ourdomain.com
    If you have another link for the above document, please let me know.
    Thanks,
    Mark Steeves.

  • ACE 4710 Can not confirm http cookie sticky connections

    We are using a ACE 4710 with A3(2.6) software release.
    I had to change our sticky load balancing method for HTTPS to cookie based.
    However while connections appear to work if I look at the sho sticky database table I can not see or confirm sticky entries for the cookie based connections.
    Here or config snippets to show the config
    sticky http-cookie ghh-www scook-ghh
      cookie insert browser-expire
      serverfarm ghh-www-443
    class-map match-all ghh-www-443_CLASS
      2 match virtual-address 172.16.1.21 tcp eq https
    class-map type http loadbalance match-any ghh-www-443_CLASSURL
      2 match http url [.]*
    policy-map type loadbalance first-match ghh-sticky-443_POLICY
      class class-default
        sticky-serverfarm scook-ghh
    policy-map multi-match POLICY
    class ghh-www-443_CLASS
          loadbalance vip inservice
          loadbalance policy ghh-sticky-443_POLICY
          loadbalance vip icmp-reply active
          appl-parameter http advanced-options CASE_PARAM

    Another point: please check whether your servers are listening only for HTTPS traffic or also for HTTP traffic:
    in the first case the ACE will have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and then re-encrypt it and send it to the server
    in the second case the ACE would have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and send it out as it is unencrypted to the server
    the second solution would have the benefit of being easier to configure and to require less resoucerces both on the ACE (only decryption to be performed) and on the servers (no need for SSL operations at all there) but it might be that your company or business sector have requirements for which this traffic should never flow unencrypted, in which case you would have to go for the first solution.
    Here you have a config example for the first solution:
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c6f37.shtml
    I would not expect you to have to pay extra for importing the cert and kepair into the ace, it would be just a copy, however as Alex said that may still depend on the license agreement with the CA.
    Cheers,
    Francesco

  • ACE 4710 Redirect to Different Server Farm based on URL

    I have a weblogic 11 serverfarm where i want to redirect to a different serverfarm based on the URL. I am able to do it and it appears to be working however I am having issues with the cookies. I seem to be getting logged out of our App when switching between the serverfarms. Is there any way to fix this issue? My configuration is below.
    Thanks!
    -Andy
    Generating configuration....
    crypto chaingroup WWW-PROD-CHAINGROUP
      cert AddTrustExternalCARoot.crt
      cert COMODOHigh-AssuranceSecureServerCA.crt
    access-list allow line 8 extended permit ip any any 
    probe http HTTP_PROBE
      port 7001
      interval 10
      passdetect interval 5
      request method get url /login.jsp
      expect status 200 299
      connection term forced
    probe icmp PROBE_SERVICE_ICMP
      interval 5
      passdetect interval 5
      receive 5
    probe tcp TCP7001_PROBE
      port 7005
      interval 5
      passdetect interval 5
      receive 3
      connection term forced
      open 2
    rserver redirect REDIRECT-TO-HTTPS
      webhost-redirection https://%h%p 301
      inservice
    rserver host WLS11Host1
      ip address 192.168.211.250
      inservice
    rserver host WLS11Host2
      ip address 192.168.211.14
      inservice
    serverfarm redirect REDIRECT-SERVERFARM                                                                                                                                                                                                                                        
      rserver REDIRECT-TO-HTTPS                                                                                                                                                                                                                                                    
        inservice                                                                                                                                                                                                                                                                  
    serverfarm host SPEND-FARM                                                                                                                                                                                                                                                     
      probe HTTP_PROBE                                                                                                                                                                                                                                                             
      rserver WLS11Host1 7001                                                                                                                                                                                                                                                      
        inservice                                                                                                                                                                                                                                                                  
    serverfarm host WLS11FARM                                                                                                                                                                                                                                                      
      probe HTTP_PROBE                                                                                                                                                                                                                                                             
      rserver WLS11Host2 7001                                                                                                                                                                                                                                                      
        inservice                                                                                                                                                                                                                                                                  
    parameter-map type http HTTP-PARM                                                                                                                                                                                                                                              
      persistence-rebalance                                                                                                                                                                                                                                                        
      set secondary-cookie-start none                                                                                                                                                                                                                                              
    parameter-map type http PARSE                                                                                                                                                                                                                                                  
      persistence-rebalance                                                                                                                                                                                                                                                        
      set header-maxparse-length 8192                                                                                                                                                                                                                                              
      length-exceed continue                                                                                                                                                                                                                                                       
    parameter-map type ssl SSL_MAP                                                                                                                                                                                                                                                 
      cipher RSA_WITH_RC4_128_MD5                                                                                                                                                                                                                                                  
      cipher RSA_WITH_RC4_128_SHA                                                                                                                                                                                                                                                  
      cipher RSA_WITH_3DES_EDE_CBC_SHA                                                                                                                                                                                                                                             
      cipher RSA_WITH_AES_128_CBC_SHA                                                                                                                                                                                                                                              
      cipher RSA_WITH_AES_256_CBC_SHA                                                                                                                                                                                                                                              
    sticky http-cookie ACE_COOKIE-7001 7001_STICKY
      cookie insert browser-expire
      serverfarm WLS11FARM
      replicate sticky
    sticky http-cookie ACE-COOKIE-SPEND SPEND_STICKY
      cookie insert browser-expire
      serverfarm SPEND-FARM
      replicate sticky
    ssl-proxy service WWW-PROD-SSLPROXY
      key client_ssl.pem
      cert pastar.crt
      chaingroup WWW-PROD-CHAINGROUP
      ssl advanced-options SSL_MAP
    class-map type http loadbalance match-any HTTP-MARKETING
      2 match http url /index.html
    class-map type http loadbalance match-any HTTPS-SPEND
      2 match http url /spend/.*
    class-map type http loadbalance match-any L5
      2 match http url /.*
    class-map match-all WLS-7001-CLASS
      2 match virtual-address 192.168.215.28 tcp eq www
    class-map match-all WLS11-HTTPS-CLASS
      2 match virtual-address 192.168.215.28 tcp eq https
    policy-map type loadbalance first-match HTTPS
      class HTTPS-SPEND
        sticky-serverfarm SPEND_STICKY
        insert-http x-forward header-value "%is"
      class L5
        sticky-serverfarm 7001_STICKY
        insert-http x-forward header-value "%is"
    policy-map type loadbalance first-match WLS11-7001-Policy
      class HTTP-MARKETING
        sticky-serverfarm 7001_STICKY
        insert-http x-forward header-value "%is"
      class HTTPS-SPEND
        serverfarm REDIRECT-SERVERFARM
      class L5
        serverfarm REDIRECT-SERVERFARM
    policy-map multi-match WLS11-SLB
      class WLS-7001-CLASS
        loadbalance vip inservice
        loadbalance policy WLS11-7001-Policy
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 1000
        appl-parameter http advanced-options HTTP-PARM
      class WLS11-HTTPS-CLASS
        loadbalance vip inservice
        loadbalance policy HTTPS
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 1000
        appl-parameter http advanced-options PARSE
        ssl-proxy server WWW-PROD-SSLPROXY
    interface vlan 1000
      ip address 192.168.215.27 255.255.255.0
      access-group input allow
      nat-pool 1 192.168.215.28 192.168.215.28 netmask 255.255.255.255 pat
      service-policy input WLS11-SLB
      no shutdown
    ip route 0.0.0.0 0.0.0.0 192.168.215.1
    snmp-server community poweradvocaterw group Network-Monitor

    Hi,
    So when you come with " http url /index.html", you go to "sticky-serverfarm 7001_STICKY" and ACE must be inserting sticky "ACE_COOKIE-7001". Now when you get redirected because you match "HTTPS-Spend", ACE will loadbalance the request which will now come on HTTPS and insert sticky " ACE-COOKIE-SPEND".  That's why i guess you see two sticky entries. Now i guess ACE will keep the connection to servers in  "sticky-serverfarm SPEND_STICKY" or you see that ACE is not doing the same or you expected the ACE to send the requested to "sticky-serverfarm 7001_STICKY" even though it matches the HTTPS-Spend class-map condition?
    Regards,
    Kanwal

  • SIP load balancing issue with ACE 4710

    SIP Load balancing Issue with ACE 4710
    I have a Cisco ace 4710 with vesion Version A4(2.2). i configued simple SIP load balancing first without stickiness. without stikeiness we are having a problem because bye packet at the was not going to the same server all the time that left our port in used even though user hang up the phone. its happen randmly. i have a total 20 licenced ports and its fill out very quickly. so i dicided to use the stickiness with call-ID but still same issue. below is the config
    rserver host CIN-VOX-31
      ip address 172.20.130.31
      inservice
    rserver host CIN-VOX-32
      ip address 172.20.130.32
      inservice
    serverfarm host CIN-VOX
      probe SIP-5060
      rserver CIN-VOX-31
        inservice
      rserver CIN-VOX-32
        inservice
    sticky sip-header Call-ID VOX_SIP_GROUP
      timeout 1
      timeout activeconns
      replicate sticky
      serverfarm CIN-VOX
    class-map match-all CIN_VOX_L4_CLASS
      2 match virtual-address 172.22.12.30 any
    class-map match-all CIN_VOX_SIP_L4_CLASS
      2 match virtual-address 172.22.12.30 udp eq sip
    policy-map type loadbalance sip first-match CIN_VOX_LB_SIP_POLICY
      class class-default
        sticky-serverfarm VOX_SIP_GROUP
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
      class CIN_VOX_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    interface vlan 20
      description VIP_DMZ_VLAN
      ip address 172.22.12.4 255.255.255.192
      alias 172.22.12.3 255.255.255.192
      peer ip address 172.22.12.5 255.255.255.192
      access-group input PERMIT-ANY-LB
      service-policy input GLOBAL_DMZ_POLICY
    could you please help me on this...
    thanks
    Rakesh Patel

    I mean there should be one more statement-
    class-map type sip loadbalance match-any CIN_VOX_LB_SIP_POLICY 
    match sip header Call_ID header-value sip:
    and that will be called under-
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    is that missing in your config ?

Maybe you are looking for