ACE http redirect on probe fail & others

Hi everyone,
I have multiple http based application running on 2 servers and they all be referenced behind the publised VIP from the load balancer.
The probes are already there, applications are accessed but one criteria from the business is not to fail the whole server for one application. There is some independance between the apps that if one fails, the other would need to still load balanced.
I would like, if the application fails on both server, to maybe be able to redirect to another URL any request for a particular App/URL.
Any suggestions ?

Hi,
To not declare a real server down if one of its applications fail, you should configure your probes in your serverfarm, and (if not already done) create a serverfarm per application.
If you want to be able to redirect a request send to a failed serverfarm, you can configure a backup serverfarm in you L7 policy map like this:
serverfarm name1 backup name2
The second serverfarm should then be of the type:
serverfarm redirect name2
webhost-redirection relocation_string [301 | 302]
where the relocation_string is the URL that should be used, 301 is permanently moved and 302 is temporarily.
For the relocation_string, you can use following special characters:
%h Inserts the hostname from the request Host header
%p Inserts the URL path string from the request
Mor info can be found in this doc:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/slb/guide/slbgd.html
Hope this helps.
Kr,
Dario

Similar Messages

  • ACE - HTTPS redirection

    Hi,
    How to configure the ACE to redirect a https request to different url.
    For example
    Clients requesting https://www.mycompany.com shall be redirected to https://www1.mycompany.com.
    Please let me know.Thanks in Advance

    Hi Gilles,
    I am having the certificate and the key.
    Please check the config and confirm whether this looks fine or not.
    I am using GSS to resolve www.mycompany.com and www1.mycompany.com
    probe http Server1
    interval 15
    passdetect interval 60
    request method head url /keepAlive.html
    expect status 200 202
    open 10
    parameter-map type ssl PARAMMAP_SSL_TERMINATION
    cipher RSA_WITH_3DES_EDE_CBC_SHA
    cipher RSA_WITH_AES_128_CBC_SHA priority 2
    cipher RSA_WITH_AES_256_CBC_SHA priority 3
    rserver redirect HTTPS-REDIRECT
    conn-limit max 4000000 min 4000000
    webhost-redirection https://www1.mycompany.com.au 301
    inservice
    serverfarm host SFARM_HTTPS
    rserver Server1_http 80
    inservice
    serverfarm redirect https-redirect
    rserver HTTPS-REDIRECT
    inservice
    ssl-proxy service SSL_PSERVICE
    key MYKEY.PEM
    cert ACE-SP2.CER
    ssl advanced-options PARAMMAP_SSL_TERMINATION
    class-map type http loadbalance match-any HTTPS1
    2 match http header Host header-value "www[.]mycompany[.]com"
    class-map type http loadbalance match-any HTTPS2
    2 match http header Host header-value "www1[.]mycompany[.]com"
    policy-map type loadbalance first-match HTTPS
    class HTTPS1
    serverfarm https-redirect
    class HTTP2
    serverfarm SFARM_HTTPS
    class class-default
    serverfarm SFARM_HTTPS
    policy-map multi-match HTTPS-PM
    class HTTPS-RED
    loadbalance vip inservice
    loadbalance policy HTTPS
    loadbalance vip icmp-reply active
    ssl-proxy server SSL_PSERVICE
    Also let me know know if there is any another way to configure the redirection other than matching host header.
    Thanks in Advance

  • ACE: How does one probe "rservers redirect" in "serverfarm redirect"?

    Probes can be used with serverfarms of type host
    probe http WEB_SERVERS
    interval 5
    passdetect interval 10
    passdetect count 2
    request method get url /index.html   expect status 200 200
      !--- Probe used to detect the status  !--- of the servers in the serverfarm.
    rserver host S1
    ip address 192.168.0.200
    inservice
    rserver host S2
      ip address 192.168.0.201
      inservice
    rserver host S3
      ip address 192.168.0.202
      inservice
    rserver host S4
      ip address 192.168.0.203
      inservice
    serverfarm host SF-1
      probe WEB_SERVERS
      rserver S1
       inservice
      rserver S2
       inservice
      rserver S3
       inservice
      rserver S4
       inservice
    When it comes to "serverfarm redirect" how would one emulate the probing to work as above. (When one is loadbalancing servers of type redirect, the probe command is not available for serverfarm redirect SF-2)
    Its also not possible to mix reservers of type redirect with serverfarm of host. If it was possible, This would have answered my question, which is.
    How does one emulate the probe functionality found in rsever host and serverfarm host in serverfarm redirect?

    Probing a redirect server was supported on A2(3.2) or later.
    So, you can use the probe configuration on 'serverfarm redirect', where 'ip address [ip_address] routed' option is required.
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_x/Release/Note/RACEA2_3_X.html#wp620109
    Unfortunately, 'rserver host' and 'rserver redirect' cannot exist together in the same serverfarm since 'serverfarm host' is
    for real server and 'serverfarm redirect' is for redirect rserver.
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/command/reference/config.html#wp1117844
    When you use backup serverfarm as below, you can use both serverfarms. However, you cannot use primary serverfarm
    and backup serverfarm at the same time.
    policy-map type loadbalance first-match lb
      class class-default
        serverfarm SF1 backup SF2
    Regards,
    Yuji

  • ACE http probe "request method type" mandatory on A3(2.6)?

    Hi people,
    I recently upgraded to A3(2.6) from A3(2.0) and I don't see the N/A option on the http probe "request method type".
    It also has an asterisk * which means it's mandatory.
    I tried to set up a new http probe for another farm I am creating and the probe shows status failed, although I can ping and telnet to the http server on port 80 from the ACE context. My probe is like that:
    probe http http_probe_WWW
      interval 15
      passdetect interval 60
      expect status 200 200
      open 10
    My other http probes for other farms work ok after the upgrade and they are similar.
    So my question is: Do I need to set the request method type or something else causes the probe to fail?
    thanks a lot.
    George

    What you see is a problem with the GUI.
    CSCtg78008    while creating http probe default method slected should be get as in CLI
    But the request-method is not required.
    So your config should work.
    Do a 'show probe detail' to see the failure reason.
    Get a sniffer trace as well.
    Regards,
    Gilles.

  • ACE HTTP Probe with regex

    ACE HTTP Probe with regex
    Hi,
    I'm trying to setup a HTTP probe with expected string rather then a code (config below). I do a GET for the page then a search for a string in the response however it's not working, as probe appears as failed.
    I've tested the connection to the server by using telneting and then looking at the page displayed to make sure the string I want to match is in the response.
    probe http HTTP-PROBE
    port 43050
    interval 30
    passdetect interval 30
    passdetect count 1
    request method get url /action=help
    open 43050
    expect regex action=help
    Q. Is there anything wrong with this configuration and what I'm trying to achive?
    Thanks,
    Pritesh

    Use "expect status" under probe config. expect regex doesnt work if expect status is not configured.
    expect regex work flawlessly with static pages. It doesnt work all the time with dynamic pages.
    Specially if "content-length" header is missing from Server response.
    Hope it helps
    Syed Iftekhar Ahmed

  • ACE: probe failing

    Hi,
    I've following probe configured:
    probe http probe1.test.com:10114
      port 10114
      interval 34
      faildetect 17
      passdetect interval 60
      expect status 200 200
      header Host header-value "hcmfincrp1.test.com"
      open 1
    and it is applied to serverfarm. but health check is failing. I see following when I do "sh probe probe1.test.com:10114 detail":
    sh probe probe1.test.com:10114 deta
    probe       : probe1.test.com:10114
    type        : HTTP
    state       : ACTIVE
    description :
       port      : 10114   address     : 0.0.0.0         addr type  : -
       interval  : 34      pass intvl  : 60              pass count : 3
       fail count: 17      recv timeout: 10
       http method      : GET
       http url         : /
       conn termination : GRACEFUL
       expect offset    : 0         , open timeout     : 1
       expect regex     : -
       send data        : -
                    ------------------ probe results ------------------
       associations ip-address      port  porttype probes   failed   passed   health
       ------------ ---------------+-----+--------+--------+--------+--------+------
       serverfarm  : probe1.test.com:443
         real      : server1.test.com[10114]
                    192.168.1.110114 PROBE    41531    19556    21975    FAILED
       Socket state        : CLOSED
       No. Passed states   : 5         No. Failed states : 6
       No. Probes skipped  : 0         Last status code  : 0
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err : Unrecognized or invalid response
       Last probe time     : Wed Oct 12 17:43:30 2011
       Last fail time      : Tue Oct 11 02:33:52 2011
       Last active time    : Sun Oct  9 20:24:02 2011
    May i know why health check is failing? why am I seeing msg "Last disconnect err : Unrecognized or invalid response" ?

    Hi ,
    This error means, that the ace is not receiving a 200 ok response from the server, this happens when server is not responding it or it is receiving that do not have a host header having value hcmfincrp1.test.com , which you have definied, or the page has got modified. Please check if your http server is working fine.
    Regards
    Abijith

  • Ace HTTP Probe expect regex

    Hi,
    I have a question about the config of the ACe probe.
    I have the following probe defined :
    probe http P_HTTP_TEST
    interval 5
    passdetect interval 2
    passdetect count 2
    request method get url /test
    expect status 200 200
    expect regex trululu
    I would like to use the regex just like the expect string on the csm probe...
    The regex doesn't seem to work as the strin trululu is not on the page tested.
    I guess the expect status override the regex but without the expect status it doesn't work either.
    Anyone know how exactly the probe expect works for http ?
    Another question, on the CSM module, the tcp probe by default use the real port for the probe, not the default port of the probe type, is it possible to change that so it mimmicks the CSM way of working ?
    Thanks a lot ;-)

    This seems to be bug related to some version of ACE software as HTTP return code overrides missing regexp. For sure this bug is present in:
    system:    Version A2(2.0) [build 3.0(0)A2(2.0)]
    Notice the difference between 192.168.1.1 (is missing regex in HTTP response) and 192.168.1.2 (sends regexp in HTTP response). Both are successful and as addition 192.168.1.1 (missing regexp) is showing last status code 200 which seems to be sufficient for probe to pass. 192.168.1.2 (which sends expected regexp) doesn't show last status code.
    probe       : tw2_http_81
    type        : HTTP
    state       : ACTIVE
    description :
       port      : 81      address     : 0.0.0.0         addr type  : -
       interval  : 30      pass intvl  : 30              pass count : 1
       fail count: 1       recv timeout: 10
       http method      : GET
       http url         : /knowtw2-f/livelink.exe?func=ll&objtype=142&bypass
       conn termination : GRACEFUL
       expect offset    : 0         , open timeout     : 10
       expect regex     : lbmonitor
       send data        : -
                           --------------------- probe results --------------------
       probe association   probed-address  probes     failed     passed     health
       ------------------- ---------------+----------+----------+----------+-------
         real      : 192.168.1.1[81]
                           192.168.1.1    2          0          2          SUCCESS
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 0
       No. Probes skipped  : 0         Last status code  : 200
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err :  -
       Last probe time     : Mon Nov  7 12:38:42 2011
       Last fail time      : Never
       Last active time    : Mon Nov  7 12:38:22 2011
         real      : 192.168.1.2[81]
                           192.168.1.2    2          0          2          SUCCESS
       Socket state        : CLOSED
       No. Passed states   : 1         No. Failed states : 0
       No. Probes skipped  : 0         Last status code  : 0
       No. Out of Sockets  : 0         No. Internal error: 0
       Last disconnect err :  -
       Last probe time     : Mon Nov  7 12:38:27 2011
       Last fail time      : Never
       Last active time    : Mon Nov  7 12:37:58 2011

  • ACE HTTP probe hash md5 value

    Hi,
    We would like to see the hash value calculated by the ACE when the HTTP probe hash command configured.
    This is possible on CSS via the "sh service" command. We have tried to get it from sh rserver , sh probe XXX detail sh serverfarm XXX det but we do not get it.
    Is this possible to get it on the ACE as we do on the CSS?
    We need this to manually configure it via the hash <value> command because if the ACE probe is reseted for any reason, the probe http hash will be re-calculated based on the first http response of the server and we can not predict that the server will give the expected web page at this time.
    A // question is: on what the md5 value is calculated? HTTP header + payload or only http object payload? We have calculated the md5 hash value by ourselves but the probe is still failing whatever the http portion used for the calculation is.
    Many thanks for your help.
    Regards/ludovic.

    probe http MD5-HTTP
    interval 15
    passdetect interval 15
    request method get url /index.html
    expect status 200 200
    hash 2441DA7F68A265F8CFB4426B6897CE33
    And here is how I computed the hash on the server itself [linux machine]
    md5sum /var/www/HTML/index.html
    2441da7f68a265f8cfb4426b6897ce33 /var/www/HTML/index.html
    [root@linux-1 tftpboot]#
    The probe is UP
    switch/Admin# sho probe MD5-HTTP detail
    probe : MD5-HTTP
    type : HTTP
    state : ACTIVE
    description :
    port : 80 address : 0.0.0.0 addr type : -
    interval : 15 pass intvl : 15 pass count : 3
    fail count: 3 recv timeout: 10
    http method : GET
    http url : /index.html
    Hash-value : 2441da7f68a265f8cfb4426b6897ce33
    conn termination : GRACEFUL
    expect offset : 0 , open timeout : 10
    expect regex : -
    send data : -
    --------------------- probe results --------------------
    probe association probed-address probes failed passed health
    ------------------- ---------------+----------+----------+----------+-------
    serverfarm : linux1
    real : linux1[0]
    192.168.30.27 13 4 9 SUCCESS
    md5sum is a standard tool.
    Nothing fancy about it.
    Gilles.

  • HTTPS probe failing randomly

    Hello All,
    I have a physical server running behind the ACE module ACE20-MOD-K9. The Server has several virtual machines. One of that virtual machines, has a WEB SERVER running virtual https servers. For example, server with IP address 10.0.0.20/24, has serveral virtual HTTPs servers as of www.virtual.local, www.virtual2.local, www.virtual3.local. So, if you nslookup the servers, they all respond with 10.0.0.20 IP address. So if I do https://www.virtual.local goes to 10.0.0.20 and read the VIRTUAL SERVER config and replies back to the request.
    Now, I am trying to verify that the TCP connection (443) and the HTTPS server itself is up and running but only for the www.virtual.local site and not for the other 2.
    I've got 2 probes for that:
    probe tcp TCP_443
      port 443
      interval 20
      passdetect interval 30
    probe https TEST_HTTPS
      interval 20
      passdetect interval 30
      request method head url https://www.virtual.local/default.htm
      expect status 200 200
    The problem that I am facing is tha the HTTPS probe fails randomly. The TCP probe works fine.
    Thanks

    Hi Fernando,
    If it is failing randomly, what do you see in last status code and last disconnect err? That should show you the reason and give an idea where is the problem.
    Regards,
    Kanwal

  • ACE http/https redirect or rewrite

    Greetings,
    We have a setup that requires ACE http/https redirection or rewrite.
    A client connects to a secured Web portal which has its ssl termination on the ACE.
    The web portal will request from the client a redirection to another application. As the portal is unaware that the incoming client https request was terminated on the ACE,
    the client receives the redirect request for an unsecured http URL rather than for the secured https URL.
    In this case what would be best to use? ACE "rewrite" or "redirect"?
    Will the following example config for ACE "redirect" be sufficent to implement this?
    ssl-proxy service ssl-App-443-81
    key app1.test.com.key
    cert app1.test.com.cert
    rserver redirect App-secure-redirect
    webhost-redirection https://app1.test.com/Go/
    inservice
    serverfarm redirect App-secure-redirect-sf
    rserver App-secure-redirect
    inservice
    serverfarm host App-81-sf
    probe TCP81
    rserver proxy1 81
    inservice
    rserver proxy2 81
    inservice
    parameter-map type http http_param_map
    header modify per-request
    sticky http-cookie App-cookie App-sticky
    cookie insert
    replicate sticky
    serverfarm App-81-sf
    class-map match-any App-443-81-cm
    2 match virtual-address 10.10.10.112 tcp eq https
    class-map match-any App-81-cm
    2 match virtual-address 10.10.10.112 tcp eq 81
    class-map type http loadbalance App-secure-redirect-cm
    match http url http://app1.test.com:81/Go/
    policy-map type loadbalance http first-match App-rewrite-pm
    class App-secure-redirect-cm
    serverfarm App-secure-redirect-sf
    policy-map type loadbalance http first-match App-sticky-443-81-pm
    class class-default
    sticky-serverfarm App-sticky
    policy-map multi-match policy-inbound
    class App-81-cm
    loadbalance vip inservice
    loadbalance policy App-rewrite-pm
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    class App-443-81-cm
    loadbalance vip inservice
    loadbalance policy App-sticky-443-81-pm
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    appl-parameter http advanced-options http_param_map
    ssl-proxy server ssl-App-443-81

    If you are offloading www.yoursite.com on ACE and on the backend
    real servers are not ssl aware (sends URL with http://) then with
    following sample config you can instruct ACE to rewrite such urls (http->https)
    class-map match-all VIP-443
    match virtual-address x.x.x.x tcp eq https
    action-list type modify http HTTP2HTTPS-REWRITE
    ssl url rewrite location www\.yoursite\.* sslport 443 clearport 80
    policy-map type loadbalance first-match YOUR-POLICY
    class class-default
    serverfarm YOUR-SFARM
    action HTTP2HTTPS-REWRITE
    class VIP-443
    loadbalance vip inservice
    loadbalance policy YOUR-POLICY
    loadbalance vip icmp-reply active
    ssl-proxy server YOUR-SSL-SERVICE
    You need Ace2.x+ on Ace module & 3.x+ on 4710 appliance for this feature.
    Syed Iftekhar Ahmed

  • ACE 4710 Probes on other servers than the real server

    Hi,
    I wanted to know if there is a means to configure a probe that is independent of the real servers.
    The aim is to configure a probe a real server but also probe another intermediate server which is not in the server farm.
    The objective is to declare the real server down if its probe fails but also the probe to an intermediate server fails as well as a or condition.
    From the document, there is no mention of it.
    But is there a means to do it.
    Thanks.

    Hi Ashley,
    i see it is not mentioned anywhere in document but i think ou should be able to bind two probes with real server of which one probe is actually probing another server.
    I would configure one probe let's say TCP based and bind it with serverfarm. Then i would configure another probe TCP based and define IP address in that probe (the other server IP which we need to probe) and bind this probe with same serverfarm. Serverfarm will not have this rserver added. And then i would configure "fail-on-all" and test if that works for you.
    i know you can set probe on redirect server/serverfarm which actually probes another real server so logically should work for normal host rserver as well. But i have never tested it myself.
    Regards,
    Kanwal

  • I am unable to open my Gmail account. Message says a proxy is failing to accept cookies on HTTP redirects.

    When trying to open my Gmail account, message says a proxy is failing to accept cookies on HTTP redirects. How do I fix it?

    Upgrade your browser to Firefox 8 and check
    * getfirefox.com

  • Probe fail on Standby ACE in One-armed mode

    Hi there
    I'm Kilsoo.
    I made One-armed mode using ACE.
    Real servers are in away Vlan from ACE.
    So, I configured the PBR with ACE alias ip address for the next-hop on the real server's gateway interface.
    And, the probe from active ACE works well.
    But, the probe from standby ACE was fail.
    At this point, my first question
    Is it normal situation that the probe fail from standby ACE????
    So, I made the route-map for PBR like below for temporary solution.
    route-map deny PBR 5
    match ip address Probe_ACL
    route-map permit PBR 10
    match ip address L4_ACL
      set ip next-hop <Alias IP address>
    ip access-list extended Probe_ACL
      pemit ip any <Standby ACE's IP address>
    ip access-list extended L4_ACL
    permit tcp <Real server's IP address> eq 80 any
    Second question...
    Do you have any other good solutions???
    Thanks

    Hi Cesar
    Thanks for your reply.
    But I think I was confuse when I wrote the message.
    I used both ace's vlan ip address for next-hop ip address like your advice.
    Do you know the standby ace can't check probe without route-map in one-armed mode like below diagram???
    Backbone Router
             |
             |
             |
    Supervisor --------------------ACE(vserver: 172.19.100.100)
             |         (vlan 200)
             |
             |
             |(vlan 110)
             |
             |
    Real servers
    (172.19.110.111)

  • ACE HTTP Probe Question (HTTP Version)

    Hello, I am wondering what HTTP version ACE uses when sending HTTP/HTTPS probes to a web server. I am currently running A2(3.3) if that has any bearing. TIA

    Hi,
    The default get request method is HTTP/1.1 when the ACE is sending the probe and i dont
    think there is a way to change this default behavior.
    Regards,
    Siva

  • ACE Module: Recover a real server probe-failed status

    How does the ACE module recover a real server that has entered a probe-failed status state? We are doing some testing, purposely dropping a servers interface. ACE recognizes the server as being down and show it in a probe-failed state. When we bring the system's interface back up, will ACE see this and automatically bring the state back into Operational status, or does someone have to do something on the ACE module?

    ACE continues to probe servers that are down or probe_failed. As soon as a server starts responding again its state will switch to alive again.
    Nothing to be done.
    Gilles.

Maybe you are looking for

  • Why can I no longer open IBooks?

    Why can I no longer open IBooks?

  • How do I place a label on page 1 of a pdf doc, for example, Exhibit "A"

    I used to knew how to do this in version 10 but 11 has me stumped.

  • Best way to move from msjava to sun java

    Hello Java people, We have a web version of a program, attachmate extra, (mainframe emulator), that requires Java 1.5 runtime applet. I have a package set up using the msi from java ready to be pushed with SMS. My goal is to have users using Sun java

  • Error running imported PAR on 7.31

    Hi all, I have migrated a simple PAR from 7.0 to 7.31 but I can not run it. I get the following error message: "com.sap.engine.services.deploy.exceptions.ServerDeploymentExceptions: Application sap.com/MyApp cannot be started. Reason: it has hard ref

  • Distributing objects on a slide

    Here is a strange one. I want to evenly distribute many small graphic objects (stars, circles, etc.) on a slide. I have inserted a shape; copy and pasted multiple times, and then tried to use the Arrange: Distribute Objects to move them around. Rathe