ACE ft peer X ??

Hi All,
We have 2 ACE's in two different 6513 chassis.
We are trying to configure redundancy on the, but one think
it not clear to me. Shouls ft peer X be different on second
ACE blade? It's really not clear to me and cisco documentation
makes it even worse :( So to my understanding failover should be
configured like this:
ACE 01
ft interface vlan 2000
ip address 192.168.1.1 255.255.255.248
peer ip address 192.168.1.2 255.255.255.248
no shutdown
ft peer 1 <<< ===
heartbeat interval 200
heartbeat count 20
ft-interface vlan 2000
ft group 10
peer 1
no preempt
peer priority 200
associate-context CTX1
inservice
ACE 02
ft interface vlan 2000
ip address 192.168.1.2 255.255.255.248
peer ip address 192.168.1.1 255.255.255.248
no shutdown
ft peer 2 <<< ====
heartbeat interval 2000
heartbeat count 20
ft-interface vlan 2000
ft group 10
peer 2
no preempt
peer priority 100
associate-context CTX1
inservice
but in all examples and in all forums i can see that ft peer is configured
with the same number on both ACE's. To my understanding it should uniquely identify devices/peer's but i guess my understanding is wrong.
Thanks,
Darius

switch/Admin(config)# ft peer ?
<1-1> Please enter FT Peer ID
switch/Admin(config)# ft peer
It has a local meaning only.
So we can reuse the same value on each blade.
Gilles.

Similar Messages

  • ACE 4710 Peer IP's

    Do I need to have a peer IP address for every interface on a contest for fault tolerance, or merely for the management vlan interface?

    you need one for every interface.
    You will need them to send probes from the standby.
    Gilles.

  • ACE - peer probes

    Hi,
    We have a scenario where we PBR certain certain source IP`s back into the ACE to perform server NAT`ing. This is routed into the ACE via a alias IP.
    Problem we have is this breaks probes on the back up ACE as we health check the same IP`s for a inbound VIP ( when the FT pairs are flipped the problem is reversed ) as I assume the Alias interface has no record of the flow and bins the traffic ( as it originated from the backup ACE interface not the alias )
    So my quick question would be is their any way a backup peers probes can be disabled as it creates a lot of half open connections on the servers ?
    I dont want to change the PBR to use real IP`s as could break some failover scenarios and adding a more complex ACL to the PBR creates issues with the NAT we`re doing
    Thanks

    The short answer is no the back up probes cannot be disabled.  In fact you want the probes to be working in the case of a  failover.  I am not sure how you have your pbr working, but the probes are sourced from the interface ip addresss on the vlan (not the alias).  The ACTIVE and the STANDBY have unique ip addresses, so as long as you account for this in your pbr you should be fine. 
    Chris

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • ACE load balancing servers on different subnets...

    Hello,
    I have the following issue.... need to load balance traffic between two servers already working in two different subnets (vlans), at this point is highly desirable to avoid changing IP addresses. Is it possible to accomplish this goal using ACE? routed or bridged mode? is it strictly necessary to have all servers belonging to a serverfarm in the same subnet?
    Thanks in advanced for your support.

    Hi,
    You can do this, but you have to use client-NAT (Source-NAT) to force the return traffic to pass back through the ACE. You also then need static routes in the ACE context to point at each server. PBR is an alternative approach but I have not implemented that in a live network. The important thing is that the ACE sees both sides of the conversation.
    The following extract from a configuration shows the basic principle:
    rserver host master
    ip address 10.199.95.2
    inservice
    rserver host slave
    ip address 10.199.38.68
    inservice
    serverfarm host FARM-web2-Master
    description Serverfarm Master
    probe PROBE-web2
    rserver master
    inservice
    serverfarm host FARM-web2-Slave
    description Serverfarm Slave
    probe PROBE-web2
    rserver slave
    inservice
    class-map match-any L4VIPCLASS
    2 match virtual-address 10.199.80.12 tcp eq www
    3 match virtual-address 10.199.80.12 tcp eq https
    policy-map type management first-match REMOTE-MGMT-ALLOW-POLICY
    class REMOTE-ACCESS
    permit
    policy-map type loadbalance first-match LB-POLICY
    class class-default
    serverfarm FARM-web2-Master backup FARM-web2-Slave
    policy-map multi-match L4POLICY
    class L4VIPCLASS
    loadbalance vip inservice
    loadbalance policy LB-POLICY
    loadbalance vip icmp-reply active
    loadbalance vip advertise
    nat dynamic 1 vlan 384
    service-policy input L4POLICY
    interface vlan 383
    description ACE-web2-Clientside
    ip address 10.199.80.13 255.255.255.248
    alias 10.199.80.12 255.255.255.248
    peer ip address 10.199.80.14 255.255.255.248
    access-group input ACL-IN
    access-group output PERMIT-ALL
    no shutdown
    interface vlan 384
    description ACE-web2-Serverside
    ip address 10.199.80.18 255.255.255.240
    alias 10.199.80.17 255.255.255.240
    peer ip address 10.199.80.19 255.255.255.240
    access-group input PERMIT-ALL
    access-group output PERMIT-ALL
    nat-pool 1 10.199.80.20 10.199.80.20 netmask 255.255.255.240 pat
    no shutdown
    ip route 0.0.0.0 0.0.0.0 10.199.80.9
    ip route 10.199.95.2 255.255.255.255 10.199.80.21
    ip route 10.199.38.68 255.255.255.255 10.199.80.21
    HTH
    Cathy

  • ACE- From one real server to another VIP

    Hi,
    I have a problem with ACE;
    We have multiple serverfarms configured in the ACE module based on the application and different VIPs related to it. We are running the ACE in bridging mode. Now the requirement is from one serverfarm real server wants communicate to the VIP of the second serverfarm...Is this possible..???? Wil some NATing help in this situation. Below is the configuration.
    ======================
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin:0in;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;
    mso-bidi-font-family:"Times New Roman";
    mso-bidi-theme-font:minor-bidi;}
    access-list LAN_Traffic remark For all IP Traffic
    access-list LAN_Traffic line 10 extended permit ip any any
    access-list LAN_Traffic line 20 extended permit icmp any any
    probe http PORTAL_HTTP
      passdetect interval 20
      passdetect count 2
      request method get url http://portal
      expect status 0 600
    probe http RMS_HTTP
      request method get url /_wmcs
      expect status 0 600
    rserver host PORTAL1
      ip address 172.22.11.241
      inservice
    rserver host PORTAL2
      ip address 172.22.11.243
    rserver host QGLRSPW1
      inservice
    rserver host RMS01
      ip address 172.22.10.12
      inservice
    rserver host RMS02
      ip address 172.22.10.8
      inservice
    serverfarm host PORTAL
      failaction purge
      probe PORTAL_HTTP
      rserver PORTAL1
        inservice
      rserver PORTAL2
        inservice
    serverfarm host RMS
      failaction purge
      probe RMS_HTTP
      rserver RMS01
        inservice
      rserver RMS02
        inservice
    class-map match-any PORTAL
      2 match virtual-address 172.22.10.166 tcp any
    class-map match-any RMS
      2 match virtual-address 172.22.10.52 tcp eq www
      3 match virtual-address 172.22.10.52 tcp eq https
    policy-map type loadbalance first-match RMS-POLICY
      class class-default
        serverfarm RMS
    policy-map type loadbalance first-match PORTAL-POLICY
      class class-default
        serverfarm PORTAL
    policy-map multi-match SFARM-LB-POLICY
      class RMS
        loadbalance vip inservice
        loadbalance policy RMS-POLICY
        loadbalance vip icmp-reply active
    class PORTAL
        loadbalance vip inservice
        loadbalance policy PORTAL-POLICY
        loadbalance vip icmp-reply active
    interface vlan 800
      description ACE Client Interface
      bridge-group 1
      mac-sticky enable
      service-policy input SFARM-LB-POLICY
      no shutdown
    interface vlan 898
      description ACE Server Interface
      bridge-group 1
      mac-sticky enable
      no shutdown
    interface bvi 1
      ip address 172.22.11.151 255.255.252.0
      alias 172.22.11.153 255.255.252.0
      peer ip address 172.22.11.152 255.255.252.0
      description Bridge Group for 800 and 898 Interfaces
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.22.8.17
    ===================================
    Pleae help..Thanks in advance

    Hello!
    Well yes it would work. BUT...you have to change your config a bit. First you need to apply your accesslist to both interfaces, or the ACE will reject it, because it is acting as a firewall by default. And second you have to apply the policymap to both interfaces as well or you put the policymap globally on the ACE.

  • ACE 4700 load balancing Issue

    Hi,
    I am new in ACE 4700. I have configured ACE 4700 for load balancing the FAX servers. Probe, ServerFarm, Real server, Virtual server, VIP state every thing is up and in service. But I am not able to access the real server using VIP IP address.
    Below is the running configuration. Please help me to troubleshot the problem.
    HOB-ACE-1/Admin# sh run
    Generating configuration....
    no ft auto-sync startup-config
    boot system image:c4710ace-mz.A3_2_0.bin
    hostname HOB-ACE-1
    interface gigabitEthernet 1/1
      description Man_HOB_1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      description VIP_HOB_1
      switchport access vlan 24
      no shutdown
    interface gigabitEthernet 1/3
      description HA_HOB_1
      switchport access vlan 180
      no shutdown
    interface gigabitEthernet 1/4
      shutdown
    [7m--More-- [m
    access-list ALL line 8 extended permit ip any any
    probe icmp ICMP_PROBE1
      interval 15
      faildetect 4
      passdetect interval 60
      passdetect count 5
      receive 5
    rserver host MFREFSAS497
      description MAAFAXSERVER
      ip address 10.16.12.148
      conn-limit max 4000000 min 4000000
      inservice
    rserver host MSHOFCFS489
      description HOBFAXSERVER
      ip address 10.26.12.130
      conn-limit max 4000000 min 4000000
      inservice
    [7m--More-- [m
    [K
    serverfarm host SFHOBACE-1
      description SFHOBACE-1
      predictor hash header Accept
      probe ICMP_PROBE1
      rserver MFREFSAS497 80
        conn-limit max 4000000 min 4000000
        inservice
      rserver MSHOFCFS489 80
        conn-limit max 4000000 min 4000000
        inservice
    class-map match-all VSHOBACE-1
      2 match virtual-address 10.26.24.242 any
    class-map type management match-any remote_access
      201 match protocol xml-https any
      202 match protocol icmp any
      203 match protocol telnet any
      204 match protocol ssh any
      205 match protocol http any
      206 match protocol https any
      207 match protocol snmp any
    [7m--More-- [m
    [K
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match VSHOBACE-1-l7slb
      class class-default
        serverfarm SFHOBACE-1
    policy-map multi-match global
      class VSHOBACE-1
        loadbalance vip inservice
        loadbalance policy VSHOBACE-1-l7slb
        loadbalance vip icmp-reply
        nat dynamic 1 vlan 24
        nat dynamic 1 vlan 1000
    service-policy input global
    interface vlan 24
      description "Client VLAN"
      ip address 10.26.24.243 255.255.255.0
    [7m--More-- [m
      access-group input ALL
      no shutdown
    interface vlan 1000
      ip address 10.26.12.132 255.255.255.0
      peer ip address 10.26.12.133 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ft interface vlan 180
      ip address 192.168.180.2 255.255.255.248
      peer ip address 192.168.180.3 255.255.255.248
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 180
    ft group 1
      peer 1
      priority 140
      associate-context Admin
    [7m--More-- [m
      inservice
    ip route 0.0.0.0 0.0.0.0 10.26.12.1
    snmp-server contact "HOB_ACE"
    snmp-server location "HOB"
    snmp-server community FAXSERVER group Network-Monitor
    snmp-server user administrator Network-Monitor
    snmp-server trap-source vlan 1000
    username admin password 5 $1$GtO1e504$eGuyxxDcXck7SkxqBfRkI.  role Admin domain
    default-domain
    username www password 5 $1$N5ClX7jy$kDhGgN.uukWQKvQMd3pY.1  role Admin domain de
    fault-domain
    ssh key rsa 1024 force
    Thanks and Regards,
    Ashfaque

    Hello Hossain,
    Applying the policy globally on the box is commonly not the prefered way to go, you can use instead a single multi-match policy per SVI for easier managent; this will also also help to narrow down problems to a specific policy and VIP while T-Shooting.
    Use the
    ACE/Admin(config)# no service-policy input global
    ACE/Admin(config)# interface vlan 24
    ACE/Admin(config-if)# service-policy input global
    Also you want to remove the NAT from the multi-match policy, you're running in routed mode so NAT should not be required; if it was required then you don't have any natpool configured or as Ahmad mentioned it was truncated from the configuration.
    Something that caught up my attention is that your default route is pointing to the server VLAN that happens to be also your management VLAN, I'll have to lab it up but my first impression is that either the traffic coming to the VIP on vlan 24 should be always NAT'd to an IP of 10.26.24.X/24 before it gets to the ACE or else there will be a routing loop that will not allow the flow to complete correctly.
    Do you happen to have a quick logical diagram of this piece of the network?
    Thnx
    Pablo

  • ACE Load Balancing Problem

    Hi,
    I have ACE 4701 with c4710ace-mz.A3_2_2.bin image. In the current setup ACE is located in the center of network where all the WAN, Intenret and LAN is connected and ACE has default towards Internet and All other segment has default route towards ACE appliance. ACe is only redirecting the port 80 traffic to my Proxy server and bypass my lan subnet on port 80.
    Internet
    i
    i
    i
    i
    i
    ACE--------------------------------WAN
    i
    i
    i
    i
    LAN
    I want to use ACE for the load balancing of two servers. Today I did the load balancing configuration but as soon as I applied the policy map on the interface vlan 200 and 300, my complete network reachability went down. When I remove the policy my network came back to normal.
    192.168.200.66  FAX Server-1
    192.1168.200.67 FAX Server-2
    192.168.200.65   Virtual IP address
    Attached is the configuration that I did on ACE for the load balancing and below is the current configuration of the ACE appliance.
    access-list acl-in remark ACCESS LIST FOR ACE-INSIDE
    access-list acl-in line 1 extended permit ip any any
    access-list acl-out remark ACCESS LIST FOR ACE-OUTSIDE
    access-list acl-out line 1 extended permit ip any any
    access-list acl-proxy remark ACCESS LIST FOR PROXY SEGMENT
    access-list acl-proxy line 1 extended permit ip any any
    access-list acl-wan remark ACCESS LIST FOR WAN SEGMENT
    access-list acl-wan line 1 extended permit ip any any
    probe tcp PROBE_5050
    port 5050
    interval 15
    passdetect interval 60
    open 1
    probe tcp PROBE_5101
    port 5101
    interval 15
    passdetect interval 60
    open 1
    probe tcp PROBE_TCP
    port 80
    interval 15
    passdetect interval 60
    open 1
    parameter-map type http PARAMAP_CASE
    case-insensitive
    no persistence-rebalance
    rserver host RS_BCPR01
    ip address 192.168.0.103
    inservice
    rserver host RS_BCPR02
    ip address 192.168.0.104
    inservice
    rserver host RT_fax1
    description Right Fax Server-1
    ip address 192.168.200.66
    rserver host RT_fax2
    description Right Fax Server-2
    ip address 192.168.200.67
    serverfarm host SF_BCPR
    transparent
    probe PROBE_5050
    probe PROBE_5101
    probe PROBE_TCP
    rserver RS_BCPR01
    inservice
    rserver RS_BCPR02
    inservice
    serverfarm host SF_RT_fax
    rserver RT_fax1
    rserver RT_fax2
    sticky ip-netmask 255.255.255.255 address source STICKY-SOURCE
    replicate sticky
    serverfarm SF_BCPR
    sticky ip-netmask 255.255.255.255 address source FAX-STICKY
    replicate sticky
    serverfarm SF_RT_fax
    class-map type management match-any CM_ALL
    2 match protocol snmp any
    3 match protocol http any
    4 match protocol https any
    5 match protocol icmp any
    6 match protocol telnet any
    class-map match-any CM_BYPASS_FOR_LAN
    3 match virtual-address 100.1.1.0 255.255.255.0 tcp eq www
    8 match virtual-address 10.0.0.0 255.0.0.0 tcp eq www
    9 match virtual-address 172.16.0.0 255.255.0.0 tcp eq www
    10 match virtual-address 192.168.0.0 255.255.0.0 tcp eq www
    class-map match-any CM_BYPASS_SUBNET
    9 match virtual-address 100.0.0.0 255.0.0.0 tcp eq www
    13 match virtual-address 10.0.0.0 255.0.0.0 tcp eq www
    14 match virtual-address 172.16.0.0 255.255.0.0 tcp eq www
    15 match virtual-address 192.168.0.0 255.255.0.0 tcp eq www
    class-map match-any CM_IM
    2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 5050
    3 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 1080
    4 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 5101
    class-map match-all CM_SF_BCPR
    255 match virtual-address 0.0.0.0 0.0.0.0 tcp eq www
    class-map match-any RT_FAX
    2 match virtual-address 192.168.200.65 0.0.0.0 any
    policy-map type management first-match PM_ALL
    class CM_ALL
    permit
    policy-map type loadbalance http first-match PM_L7_BYPASS_FOR_LAN_HTTP
    class class-default
    forward
    policy-map type loadbalance http first-match PM_L7_BYPASS_HTTP
    class class-default
    forward
    policy-map type loadbalance first-match PM_LB_RT_FAX
    class class-default
    sticky-serverfarm FAX-STICKY
    policy-map type loadbalance http first-match PM_LB_SF_BCPROXY
    class class-default
    sticky-serverfarm STICKY-SOURCE
    policy-map multi-match PM_BYPASS_FOR_LAN_HTTP
    class CM_BYPASS_FOR_LAN
    loadbalance vip inservice
    loadbalance policy PM_L7_BYPASS_FOR_LAN_HTTP
    policy-map multi-match PM_BYPASS_HTTP
    class CM_BYPASS_SUBNET
    loadbalance vip inservice
    loadbalance policy PM_L7_BYPASS_HTTP
    policy-map multi-match PM_MAIN_BCPROXY
    class CM_SF_BCPR
    loadbalance vip inservice
    loadbalance policy PM_LB_SF_BCPROXY
    loadbalance vip icmp-reply active
    appl-parameter http advanced-options PARAMAP_CASE
    class CM_IM
    loadbalance vip inservice
    loadbalance policy PM_LB_SF_BCPROXY
    policy-map multi-match PM_RT_FAX
    class RT_FAX
    loadbalance vip inservice
    loadbalance policy PM_LB_RT_FAX
    service-policy input PM_ALL
    interface vlan 100
    description FW-INSIDE CONTEXT RACK1
    ip address 192.168.0.5 255.255.255.224
    alias 192.168.0.11 255.255.255.224
    peer ip address 192.168.0.6 255.255.255.224
    mac-address autogenerate
    no icmp-guard
    access-group input acl-out
    no shutdown
    interface vlan 200
    description WAN-VLAN CONTEXT RACK1
    ip address 192.168.0.33 255.255.255.224
    alias 192.168.0.43 255.255.255.224
    peer ip address 192.168.0.34 255.255.255.224
    mac-address autogenerate
    access-group input acl-wan
    service-policy input PM_BYPASS_HTTP
    service-policy input PM_MAIN_BCPROXY
    no shutdown
    interface vlan 300
    description ACE-INSIDE CONTEXT RACK1
    ip address 192.168.0.65 255.255.255.224
    alias 192.168.0.73 255.255.255.224
    peer ip address 192.168.0.66 255.255.255.224
    mac-address autogenerate
    access-group input acl-in
    service-policy input PM_BYPASS_FOR_LAN_HTTP
    service-policy input PM_BYPASS_HTTP
    service-policy input PM_MAIN_BCPROXY
    no shutdown
    interface vlan 301
    description BC-VLAN CONTEXT RACK1
    ip address 192.168.0.97 255.255.255.224
    alias 192.168.0.107 255.255.255.224
    peer ip address 192.168.0.98 255.255.255.224
    mac-address autogenerate
    access-group input acl-proxy
    no shutdown
    ft track interface TRACKING_FOR_FT_VLAN
    track-interface vlan 300
    peer track-interface vlan 300
    priority 255
    peer priority 255
    ip route 0.0.0.0 0.0.0.0 192.168.0.1
    Please help me out what i am missing. Is there any limitation on policy map or my bypass subnet list is creating problem. 

    I did these changes this time nothing disconnected but I am not able to do the Remote desktop on the virtual IP address. Real IP has Remote desktop enabled even VIP is not ping able for me.
    rserver host RT_fax1
      description Right Fax Server-1
      ip address 192.168.200.66
      inservice
    rserver host RT_fax2
      description Right Fax Server-2
      ip address 192.168.200.67
      inservice
    serverfarm host SF_RT_fax
      rserver RT_fax1
        inservice
      rserver RT_fax2
        inservice
    policy-map type loadbalance rdp first-match PM_LB_RT_FAX
      class class-default
        serverfarm SF_RT_fax
    policy-map multi-match PM_RT_FAX
      class RT_FAX
        loadbalance vip inservice
        loadbalance policy PM_LB_RT_FAX
        loadbalance vip icmp-reply active
    interface vlan 200
      description WAN-VLAN CONTEXT RACK1
      ip address 192.168.0.33 255.255.255.224
      alias 192.168.0.43 255.255.255.224
      peer ip address 192.168.0.34 255.255.255.224
      mac-address autogenerate
      access-group input acl-wan
      service-policy input PM_BYPASS_HTTP
      service-policy input PM_MAIN_BCPROXY
      service-policy input PM_RT_FAX
      no shutdown
    interface vlan 300
      description ACE-INSIDE CONTEXT RACK1
      ip address 192.168.0.65 255.255.255.224
      alias 192.168.0.73 255.255.255.224
      peer ip address 192.168.0.66 255.255.255.224
      mac-address autogenerate
      access-group input acl-in
      service-policy input PM_BYPASS_FOR_LAN_HTTP
      service-policy input PM_BYPASS_HTTP
      service-policy input PM_MAIN_BCPROXY
      service-policy input PM_RT_FAX
      no shutdown
    But nothing is working for me. Please help me out. This time i didnt configure the sticky. But in real I will go with sticky and complete IP protocol will be use a VIP. Please help me out.

  • ACE in Direct Server Return mode not working as expected

    Dear all,
    I configured my ACE as I found it here:
    https://supportforums.cisco.com/docs/DOC-22555
    the VIP is working, that means I can ping it, routing is working etc.
    I created a loopback on the win2012 Server with the IP of the VIP. When I try now to test the LB with telnet on port 25 e.g. it is not working. direclty on the server it works, also in my last deployment where I use SNAT/PAT. But we want the real client IPs visible on the Exchange Server.
    Where is my problem ? Any ideas would be great..
    rserver host YY
      description AServer-1
      ip address 10.1.x.2
      inservice
    rserver host XX
      description AServer-2
      ip address 10.1.x.3
       inservice
    serverfarm host Mail
      description Mail
      transparent
      predictor leastconns
      rserver AServer-1
        inservice
      rserver AServer-2
    sticky ip-netmask 255.255.255.255 address both Mail
      timeout 5
      replicate sticky
      serverfarm Mail
    class-map match-all Exchange_ALL
      2 match virtual-address 192.168.1.1 any
    class-map type management match-any remote_access
      2 match protocol xml-https source-address 10.a.b.0 255.255.255.0
      3 match protocol icmp source-address 10.a.b.0 255.255.255.0
      5 match protocol ssh source-address 10.a.b.0 255.255.255.0
      7 match protocol https source-address 10.a.b.0 255.255.255.0
      8 match protocol snmp source-address 10.a.b.0 255.255.255.0
      9 match protocol xml-https source-address 10.d.e.1 255.255.255.255
      10 match protocol icmp source-address 10.d.e.1 255.255.255.255
      11 match protocol ssh source-address 10.d.e.1 255.255.255.255
      12 match protocol https source-address 10.d.e.1 255.255.255.255
      13 match protocol snmp source-address 10.d.e.1 255.255.255.255
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match mail
      class class-default
        sticky-serverfarm Mail
    policy-map multi-match VLAN20
      class Exchange_ALL
        loadbalance vip inservice
        loadbalance policy mail
        loadbalance vip icmp-reply
    interface vlan 2
      ip address 10.a.b.2 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    interface vlan 20
      description Server
      ip address 10.1.x.20 255.255.255.0
      peer ip address 10.1.x.30 255.255.255.0
      no normalization
      access-group input ALL
      service-policy input VLAN20
      no shutdown
    ft interface vlan 4
      ip address 10.f.g.2 255.255.255.252
      peer ip address 10.f.g.1 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 4
    ft group 1
      peer 1
      associate-context Admin
      inservice
    ip route 10.d.e.0 255.255.255.255 10.1.x.1
    ip route 0.0.0.0 0.0.0.0 10.a.b.1

    Oh, I see. Very interesting indeed!
    Do you get the BAD CHECKSUM and IP CHECKSUM OFFLOAD on the remote sites?
    It could be this that is the problem. I read this and it seems as though it causes disconnects just as you experience too.
    or just disable - it worked for some here, but for others, they upgraded the drivers of the NIC:
    http://www.techsupportforum.com/forums/f137/wireshark-question-tcp-checksum-offload-248812.html
    1. Open Device manager (right click "Computer" and click "Manage")
    2. Click on "Device Manager"
    3. Expand "Network Adapters"
    4. Right click your network adapter
    5. click "properties"
    6. click the tab named "Advanced"
    7. Find "IP Checksum Offload" and click it
    8. Put the value to the right to "Disabled"
    9. Find "TCP Checksum offload (IPvX)
    10. Set the value to the right to "Disabled"
    The Wiki Wireshark article had this:
    In Windows, go to Control Panel->Network and Internet Connections->Network Connections, right click the connection to change and choose 'Properties'. Press the 'Configure...' button, choose the 'Advanced' tab to see or modify the "Offload Transmit TCP Checksum" and "Offload Receive TCP Checksum" values.
    It seems like a server side issue rather than Load Balancer problem.
    Hope this helps
    Please rate useful posts and remember to mark any solved questions as answered. Thank you.

  • Use ACE to redirect or insert a WWW in a client request

    I am using ACE 4710s running 4.1 to load balance web traffic across our web server farms.  Redirection is configured to redirect http to https.  There is a new requirement to redirect a request that does not include the "www" in the URL to include the "www".  In other words, if a client merely types "mytesturl.com/test1" the ACE is to redirect or rewrite and insert the www so the request becomes"www.mytesturl.com/test1".  I am searching through the documentation, but thought I would pick the collective brains of the community at the same time to see who can come up with the correct answer first.  Below is a sample of the working config.
    Thanks in advance,
    mb
    rserver host RS_TEST_01
      description ***Test Producation Host***
      ip address 10.64.64.45
      inservice
    rserver redirect RD_EC
      description ***TEST Sub-Site***
      webhost-redirection https://www.test.com/EC/
      inservice
    rserver redirect http
      webhost-redirection https://%h%p 301
      inservice
    serverfarm redirect REDIRECT
      rserver http
        inservice
    serverfarm host SF_TEST
      rserver RS_TEST_01 80
        inservice
    serverfarm redirect SF_EC
      description ***Test Sub-Site***
      rserver RD_EC
        inservice
    sticky ip-netmask 255.255.255.0 address both STICKY_TEST_1
      timeout 600
      replicate sticky
      serverfarm SF_TEST
    ssl-proxy service SSL_TEST_1
      key TEST_KEY
      cert TEST_CERT
      chaingroup VERISIGN
      ssl advanced-options SSL_TERMINATION
    class-map match-any TEST_VIP_01
      description ***VIP for TEST***
      2 match virtual-address 10.64.74.45 tcp eq https
    class-map type http loadbalance match-all TEST_EC
      2 match http url /ec*
    policy-map type loadbalance first-match LB_TEST_01
      description ***Load Balancing Policy for Test***
      class TEST_EC
        serverfarm SF_EC
    policy-map type loadbalance first-match LB_REDIRECT
      description L7SLBPolicy-Redirect
      class class-default
        serverfarm REDIRECT
    policy-map multi-match NEW_WEB_POLICY
      class TEST_VIP_01
        loadbalance vip inservice
        loadbalance policy LB_TEST_01
        loadbalance vip icmp-reply active
        ssl-proxy server SSL_TEST_1
    interface vlan 474
      description ***Front End VIP interface***
      ip address 10.64.74.254 255.255.255.0
      alias 10.64.74.252 255.255.255.0
      peer ip address 10.64.74.253 255.255.255.0
      access-group input TEST_WEB
      service-policy input TEST_WEB_POLICY
      no shutdown

    Hi Michael,
    The configuration to achieve this would be something like the one below. I wrote it without trying it in the lab first, so, make sure to test it before putting it in production (specially the syntax of the regular expressions)
    rserver redirect http
      webhost-redirection https://%h%p 301
      inservice
    rserver redirect http_and_www
      webhost-redirection https://www.%h%p 301
      inservice
    serverfarm redirect REDIRECT
      rserver http
        inservice
    serverfarm redirect REDIRECT_and_www
      rserver http_and_www
        inservice
    class-map type http loadbalance match-all http_with_www
      2 match http header Host header-value www.*
    policy-map type loadbalance first-match LB_REDIRECT
      description L7SLBPolicy-Redirect
      class http_with_www
        serverfarm REDIRECT
      class class-default
        serverfarm REDIRECT_AND_WWW
    I hope this helps
    Daniel

  • Facing Issue in ACE 4710 ..Secondary ACE showing as FSM_FT_STATE_STANDBY_COLD ...

    Hi All ,
     I am facing problem with my ACE 4710 in active-standby environment . When I check Show ft group detail on my Active ACE , it shows peer state as
    FSM_FT_STATE_STANDBY_COLD for Admin context . Below is the output :
    Primary_ACE/Admin#sh ft group detail
    FT Group                     : 1
    No. of Contexts              : 1
    Context Name                 : Admin
    Context Id                   : 0
    Configured Status            : in-service
    Maintenance mode             : MAINT_MODE_OFF
    My State                     : FSM_FT_STATE_ACTIVE
    My Config Priority           : 120
    My Net Priority              : 120
    My Preempt                   : Enabled
    Peer State                   : FSM_FT_STATE_STANDBY_COLD
    Peer Config Priority         : 100
    Peer Net Priority            : 100
    Peer Preempt                 : Enabled
    Peer Id                      : 1
    Last State Change time       : Tue Jan  1 05:32:55 2002
    Running cfg sync enabled     : Enabled
    Running cfg sync status      : Peer in Cold State. Error on Standby device when
    applying configuration file replicated from active
    Startup cfg sync enabled     : Enabled
    Startup cfg sync status      : Peer in Cold State. Startup configuration sync ha
    [7m--More--[m
    s completed
    Bulk sync done for ARP: 0
    Bulk sync done for LB: 0
    Bulk sync done for ICM: 0
    FT Group                     : 2
    No. of Contexts              : 1
    Context Name                 : APP_Context
    Context Id                   : 1
    Configured Status            : in-service
    Maintenance mode             : MAINT_MODE_OFF
    My State                     : FSM_FT_STATE_ACTIVE
    My Config Priority           : 120
    My Net Priority              : 120
    My Preempt                   : Enabled
    Peer State                   : FSM_FT_STATE_STANDBY_HOT
    Peer Config Priority         : 100
    Peer Net Priority            : 100
    Peer Preempt                 : Enabled
    Peer Id                      : 1
    Last State Change time       : Tue Jan  1 05:32:56 2002
    Running cfg sync enabled     : Enabled
    [7m--More--[m
    Running cfg sync status      : Running configuration sync has completed
    Startup cfg sync enabled     : Enabled
    Startup cfg sync status      : Startup configuration sync has completed
    Bulk sync done for ARP: 0
    Bulk sync done for LB: 0
    Bulk sync done for ICM: 0
    Also when I give show ft config-errors on my secondary ACE it gives the following result .
    Secondary_ACE/Admin#sh ft config-error
    Mon Jun 10 00:04:11 IST 2002
    `no 3 match virtual-address 10.40.3.15 tcp eq https`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.15 tcp eq 8082`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.21 tcp eq www`
    Error: LB action requires match vip command
    `no 3 match virtual-address 10.40.3.21 tcp eq https`
    Error: LB action requires match vip command
    `2 match virtual-address 10.40.3.21 tcp eq https`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.21 tcp eq www`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.15 tcp eq 8082`
    Error: This configuration already exists
    `2 match virtual-address 10.40.3.15 tcp eq https`
    Error: This configuration already exists
    Error(s) while applying config.
     I am attaching the running configuration of both the ACE's . Kindly help me in resolving the issue .
    Also I noticed one thing . There is configuration difference in Primary and Secondary ACE . I guess this is causing the issue .
    Need help to fix this asap .
     Following configuration is missing on the secondary ACE .
    ======================================================================
    class-map match-all WEB_FARM_VIP-80
      3 match virtual-address 10.40.3.15 tcp eq www
    policy-map type loadbalance first-match WEB_FARM_VIP-80-l7slb
      class class-default
        serverfarm HTTP-2-HTTPS
      class WEB_FARM_VIP-80
        loadbalance vip inservice
        loadbalance policy WEB_FARM_VIP-80-l7slb
    Thanks ,
    Tushar

    Dear all,
    Pls help me out in this regard, I dont have much idea about ACE.
    Regards,
    Sashi

  • ACE ignoring class map depending on source???

    I have a problem with a the load balancing "not working" properly depending on the source.
    The load balancing decision is done with a secondary cookie (?ld=fe1 or ?ld=fe2). If it appears and the value is fe1 the request should go to serverfarm FE1-app. If the value is fe2 then serverfarm FE2-app should be choosen. If it is not present in the http request then serverfarm FE-app in the class-default is taking over.
    This approach works if "surfing" to the VIP from a certain part of the internal network. It does not work from another part of the network. It seems that cookie is ignored and only the class default triggers.
    The strange thing is that the same approach works for another setup that looks identical (with different rservers and different VIP of course). There the class map for the cookie triggers always.
    My question is now: Why does the ACE seem to ignore the class map for the cookie when coming from a certain part of the network? How can I debug/follow a certain connection or load balancing decision?
    Here is the config:
    rserver host FE1-app
      description frontend app
      ip address 192.168.137.69
      inservice
    rserver host FE2-app
      description frontend app
      ip address 192.168.137.74
      inservice
    serverfarm host FE1-app
      rserver FE1-app 80
        inservice
    serverfarm host FE2-app
      rserver FE2-app 80
        inservice
    serverfarm host FE-app
      rserver FE1-app 80
        inservice
      rserver FE2-app 80
        inservice
    class-map type http loadbalance match-all COOKIE-FE1
      2 match http cookie secondary ld cookie-value "fe1"
    class-map type http loadbalance match-all COOKIE-FE2
      2 match http cookie secondary ld cookie-value "fe2"
    class-map match-all VIP-app
      2 match virtual-address 192.168.138.39 tcp eq www
    policy-map type loadbalance first-match VIP-app-loadbalance
      class COOKIE-FE1
        serverfarm FE1-app
      class COOKIE-FE2
        serverfarm FE2-app
      class class-default
        serverfarm FE-app
    policy-map multi-match INT470
      class VIP-app
        loadbalance vip inservice
        loadbalance policy VIP-app-loadbalance
        loadbalance vip icmp-reply
    interface vlan 470
      description lb_rpfedrift
      ip address 192.168.138.36 255.255.255.240
      alias 192.168.138.35 255.255.255.240
      peer ip address 192.168.138.37 255.255.255.240
      service-policy input remote_mgmt_allow_policy
      service-policy input INT470
      no shutdown

    Hi Federico,
    The source of the request has no relation with the way ACE handles the connections, so, there are probably other differences in the traffic.
    The best way to troubleshoot these kind of connections is taking a traffic capture on the TenGigabit interface connecting the ACE with the switch backplane. Once you have it, you can try to look for differences between the working and failing connections.
    From what you describe, I wouldn't be surprised if the issue comes from the fact that there are several HTTP requests inside the same TCP flow (in which case, by default, the ACE will look only at the first one), so I would suggest you to enable "persistence rebalance" for this VIP. For more details, check the link below:
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/slb/guide/classlb.html#wp1062907
    I hope this helps
    Daniel

  • Reuse of context in ACE module

    Hi all, just have a question about som reuse of resources in a ACE module context.  I don't want to make a new context, and can reuse most of the existing configuration in one of my context.  The config is not complex and difficult, but I'm not sure if I can do this.
    The primary goal is to loadbalance 2 webservers with a new vip, new serverfarm, stickygroup, policy-map and different nat-pool.
    Since I haven't decided the ip addresses to be used, they are just xx in the config below.
    The changes I want to implement are in bold.  Will this work for me?
    probe http WEBGUI_D2
    description Probe for http mot webgui
    interval 10
    passdetect interval 10
    passdetect count 1
    request method get url /D2/auth/login.aspx
    expect status 200 302
    header User-Agent header-value "IDENTITY"
    rserver host cwi003
    description content server logon
    ip address 10.163.22.27
    inservice
    rserver host cwi004
    description content server logon
    ip address 10.163.22.28
    inservice
    rserver host cwi503
    description content server logon 2
    ip address 10.163.22.23
    inservice
    rserver host cwi504
    description content server logon 2
    ip address 10.163.22.24
    inservice
    serverfarm host SF_LOGON_D2
    probe WEBGUI_D2
    rserver cwi003 80
       inservice
    rserver cwi004 80
       inservice
    serverfarm host SF_LOGON2_D2
    probe WEBGUI_D2
    rserver cwi503 80
       inservice
    rserver cwi504 80
       inservice
    sticky ip-netmask 255.255.255.255 address source STICKYGROUP1
    timeout 20
    replicate sticky
    serverfarm SF_LOGON_D2
    serverfarm SF_LOGON2_D2
    class-map match-all VS_LOGON_D2
    3 match virtual-address 10.163.22.13 any
    class-map match-all VS_LOGON2_D2
    3 match virtual-address 10.163.22.xx any
    policy-map type loadbalance first-match PM_ONE_ARM_LB
    class class-default
       sticky-serverfarm STICKYGROUP1
    policy-map multi-match PM_ONE_ARM_MULTI_MATCH
    class VS_LOGON_D2
       loadbalance vip inservice
       loadbalance policy PM_ONE_ARM_LB
       nat dynamic 5 vlan 1240
    class VS_LOGON2_D2
       loadbalance vip inservice
       loadbalance policy PM_ONE_ARM_LB
       nat dynamic 6 vlan 1240
    interface vlan 1240
    description Client_server
    ip address 10.163.22.11 255.255.255.0
    peer ip address 10.163.22.12 255.255.255.0
    access-group input INBOUND
    nat-pool 5 10.163.22.14 10.163.22.17 netmask 255.255.255.192 pat
    nat-pool 6 10.163.22.xx 10.163.22.xx netmask 255.255.255.192 pat
    service-policy input PM_ONE_ARM_MULTI_MATCH
    no shutdown
    ip route 0.0.0.0 0.0.0.0 10.163.22.1
    BR
    Geir

    Thanks for your reply.
    Hope I understand you correct.  This sould be the config I need to paste into the existing context.
    rserver host cwi503
      description content server logon 2
      ip address 10.163.22.23
      inservice
    rserver host cwi504
      description content server logon 2
      ip address 10.163.22.24
      inservice
    serverfarm host SF_LOGON2_D2
      probe WEBGUI_D2
      rserver cwi503 80
        inservice
      rserver cwi504 80
        inservice
    sticky ip-netmask 255.255.255.255 address source STICKYGROUP2
       timeout 20
       replicate sticky
       serverfarm SF_LOGON2_D2
    class-map match-all VS_LOGON2_D2
       3 match virtual-address 10.163.22.xx any
    policy-map type loadbalance first-match PM_ONE_ARM_LB2
      class class-default
        sticky-serverfarm STICKYGROUP2
    policy-map multi-match PM_ONE_ARM_MULTI_MATCH
      class VS_LOGON2_D2
        loadbalance vip inservice
        loadbalance policy PM_ONE_ARM_LB2
        nat dynamic 6 vlan 1240
    interface vlan 1240
      nat-pool 6 10.163.22.xx 10.163.22.xx netmask 255.255.255.192 pat
    Br
    Geir

  • Query vlan in cisco ACE

    I've configured query vlan FT internface as follow:
    class-map type management match-any query_VLAN
      2 match protocol icmp any
    policy-map type management first-match query_VLAN_MGT
      class query_VLAN
        permit
    interface vlan 11
      description ##query vlan##
      ip address 192.30.3.196 255.255.255.252
      peer ip address 192.30.3.195 255.255.255.252
      access-group input ANY-ANY
      service-policy input query_VLAN_MGT
      no shutdown
    ft interface vlan 10
      ip address 192.30.3.192 255.255.255.252
      peer ip address 192.30.3.191 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 10
      query-interface vlan 11
    and when I do "sh ft peer sum" I see following:
    sh ft peer sum
    Peer Id                      : 1
    State                        : FSM_PEER_STATE_COMPATIBLE
    Maintenance mode             : MAINT_MODE_OFF
    FT Vlan                      : 10
    FT Vlan IF State             : UP
    My IP Addr                   : 192.30.3.191
    Peer IP Addr                 : 192.30.3.192
    Query Vlan                   : 11
    Query Vlan IF State          : UP, Manual validation - please ping peer
    Peer Query IP Addr           : 192.30.3.196
    Heartbeat Interval           : 300
    Heartbeat Count              : 10
    SRG Compatibility            : COMPATIBLE
    License Compatibility        : COMPATIBLE
    FT Groups                    : 5
    would you please advise why "Query Vlan IF State " is showing "Manual validation - please ping peer" do I need to configure anything else?
    Thanks....

    You don't need to configure anything further. Your config looks good.
    The query interface thing can be a bit misleading.  The ACE does not use the query interface until the FT vlan goes down. This is the reason why we added a etxt to request users to manually verify query interface is functioning properly as below :
    "Manual validation - please ping peer"
    So if you need to check if the query vlan is up, then manually ping the peer ip address. That's what the message means.
    - Andrew

  • ACE 4710 Device Manager Gives Blank Screen

    Hi Guys,
    Wish somebody could share his/her experience on this.
    I have a problem with ACE4710 Device Manager that after entering username and password, it will appear just a blank screen. And it happen also to the FT peer.
    I know that the workaround is to reload the ACE (as it happened one time before) but I wish somebody could share a better or probably permanent solution to this problem.
    Thank you in advance guys.
    Tomy.

    CSCsv95366: Device Manager displays a blank page after login
    Upgrade to A3(2.2) or beyond.
    Gilles.

Maybe you are looking for