ACE Implementation Bridging Question

Hi,
My customer is looking to undertake ACE Module implementation in favour of legacy installed products.
One of the requirements of the current environment is that some applications have VIPs and servers in the same IP Subnet and same Layer 2 vlan.
I assumed using Bridge Mode (BVI) would be the way to go - but now I am not so sure. The examples of bridge group config I have seen reference the VIP in a separate Layer 2 Vlan to the Servers.
My requirement is to have all in the same Layer 2 Vlan. Is this possible ?

yes it is possible.
You need two Vlans. clients & Vip will be on one Vlan and the servers on the other Vlan then you will bridge them using ACE.
For e.g
Lets say currently you have VLANX with all users & Servers.
You can create a new Vlan "VLAN Y" , assign all servers to VLAN Y, assign VLAN X & VLAN Y to ACE and bridge VLANY (new vlan) & VLANX (Old VLAN) using ACE.
Now your VIPs & clients will belong the old vlanX (same Ip subnet) & Servers will be on a new VlanY (again same Ip subnet.
If you donot want to use two Vlans
then you will have to use ACE in one arm mode. Simply extend the current vlan to the ACE module and configure SRC NAT/PBR.
Reason behind using SrcNat/PBR is to make sure that return traffic from the servers should not bypass ACE module
(which is not possible in case of bridge mode).
Thanks
Syed

Similar Messages

Oracle EBS R12 Pre - Implementations phase question air

Oracle EBS R12 Pre - Implementations phase question air
Posted: Jun 30, 2009 10:22 AM Edit Reply
Dear all Gurus,
We are going to implement Oracle EBS r12, for industrial concern, we have following quires if any peer may suggest.
1) we heard the oracle R12 has build new release with 11g db , is it been practical for choosing it for corporate ???
2) Linux Read hat which version is more stable like 5 releases is compatible with R12 new release?
3) We are also thinking for 64 bit architecture rather than 32 bit, could any one figure out the practical pros and cons for this.
4) We are also wondering about the server machine brand and its configurations like HP DL380 G6, DELL 2850? could any one share abut his experience about the same.
5) What sort of Server configurations (Processor , 2way -4way , RAM , HD and other accessories ) for r12 Multi node setup for 150 clients (DB Server , Apps Server , Test Prod )
6) What should be backup strategies like tap backup and how much space requirements we must have provisioned for retaining almost 2~3 month backup.
7) Application implementations methodologies?
8)
I know to address our queries would be time consuming for you bust peoples , but I would really oblige for being shared your journey this would defiantly the PATH way for other like mentoring for others.
looking forward your valuable instructions ASAP.
Thanks & Best Regards
Muhammad Waseem
Manager IT
Neee-Has Textiles Divisions
31-Q Gulberg II Lahore
Pakistan
92-0333-4240949

Duplicate post.
Oracle EBS R12 Pre - Implementations phase question air
Oracle EBS R12 Pre - Implementations phase question air

Mac OS10.8.3 and CS6 Bridge question

In CS 6, when I go to "File" > "Browse in Bridge" on the drop down menu, "Browse in Mini Bridge" is always highlighted in blue, along with "Import" and "Automate" and "Scripts". Other options including "Browse in Bridge" are available, but not highlighted in blue.
I have no clue why these options are highlighted as I never have used any of them in the other versions of PSCS I've used, as I much prefer just "Browse in Bridge". . Is there any way to remove the highlight on these options, (but NOT remove the options) ? It isn't a BIG deal, just annoying.
Hope someone can enlighten me ~
Thanks... Carolyn

Yes, you are right. This is more of a Photoshop question, and I appreciate your calling it to my attention. I did do as you suggested, but was unable to uncheck "What's New" in PS6. I tried a dozen times, and no matter what I do, it just won't uncheck.
I have actually posted this qustion on the dpreview.com Retouching Forum and Mac Forum, but yours is the first answe I've received in several days. So I appreciate your trying to help, and give you a "yes" for alerting me to my error in thinking it was a Bridge question.
Like I mentinoed, this is not a critical problem, just an annoying one. There are a LOT of options that are highlighted, but the one on "Mini Bridge' just hits me in the face everytime I get on PS and want to just "Browse in Bridge". It's like someone trying to make you buy something you don't want ! :-) I guess I'll just have to get used to it !
Thanks again for trying to help
Carolyn

No bridge forum for a bridge question (??)

I have a bridge question so if this is not the right place please send it to wherever moderators
Is it possible to run/have/use/purchase bridge without photoshop? Cost of ? (link)
I have PSE12 and don't need the big brother PS programs .... more like big sister PS programs.......but I would like have bridge again. I also have LR5 and would like bridge for couple things windows can't do
Cheers

Hi there, Heidi --
Just go to your OS Forum . . .
In your case Leopard.
Click below to get there:
http://discussions.apple.com/forum.jspa?forumID=1225
Hope this helps.

Could not initialize photoshop elements could not initialize ACE implementation

Hi,
Hoping somebody can help.I have Adobe photoshop elements 2.0 (i know its pretty old).Its always worked well until lately its bringing this message up and not letting me open it : could not inialize photoshop elements could not initialize ACE implementation.
I have been trying to clean up the computer and am not 100% confident at using the computer so im afraid i have deleted or locked something that this program needs to run.
Can any body help?
Erica

Repair does not work on any Windows version of PSE. Try resetting the preferences: Press and hold CTRL, ALT, and SHIFT when launching Elements until you see a box asking if you want to delete the settings. Yes, you do.
Juergen

ACE in bridge mode with FWSM as gateway

our design
FWSM--vlan 7--ACE-vlan 8---servers with default gateway as FWSM
originally there were no plans of servers looking to load balance traffic when they wanted to communicate each other. now there is a need this
since ACE is in bridge mode, there are no ip address to VLAN configured on it and cant do source NAT
what we want servers in serverfarm A can contact a single ip which can be load balanced and traffic to be sent to serverfarm B. both serverfarms reside in vlan 8 and ace is in bridge. with VLAN not having IP how can we get this working. we were looking to create a policy on ACE with an ip address in vlan 8 and then do a source NAT to send the traffic to serverfarm 7.
with FWSM as the default gateway, by enabling permit intra traffic , it doesnt work because the command routes the traffic, dont think will send the traffic back to the same vlan
e.g static (inside,outside) 10.7.0.1 10.7.8.13 and allow intra traffic.
so when a machine 10.7.8.11 pings 10.7.0.1 it goes to the FWSM but fwsm doesnt look for 10.7.8.13
with ACE in bridge and FWSM doing above how to get around. can something be done on ACE in bridge mode with source NAT
Thanks

First, why don't you have an ip in your ACE vlan ?
Then, for traffic hitting a vip, we can do source nating even in bridge mode.
But if the vip is not an ip in vlan 8, your server will anyway send the traffic to the FWSM and ACE will first bridge the request.
The FWSM should then send the request back to ACE (not sure how this can be done).
So the request from the server will actually hit the vip on vlan 7 (not vlan 8).
So your policy-map with client nat must be on vlan 7.
Another option would be to configure a static route on the server to point the vip to the ACE vlan 8 ip address (which you should have configured).
In this case, the policy-map will have to be in vlan 8 with client-nat.
Gilles.

ACE problem - bridge mode - behind a firewall

Hello
We are having problems with one of you ACE context, this implementation was done by a supplier and I am trying to troubleshoot it.
The clients and the servers are on different subnets, there is a Nokia firewall in the middle. The firewalls are setup on a cluster.
Connecting to port 7072 is taking at least 30 seconds. If I move the server into the VLAN in front of the ACE, the connection is instant. So it does indicate a problem on the ACE.
The client IP is .99.11.
The VIP is .100.62 and the server node is .100.12.
Running the capture command I can see the following behavior:
1. The client initiates the connection to the ACE Vip
2. At the same time it looks like a second connection is initiated from the client to the server node
Please see attachment.
Is this a normal situation where the connection is duplicated?
Does this interface setup look correct?
Is the bridge mode the correct setup in this scenario?
interface vlan 10
bridge-group 2
no normalization
mac-sticky enable
access-group input PERMITALL
service-policy input VLAN10-INTER-MMPM
no shutdown
interface vlan 15
bridge-group 2
no normalization
access-group input PERMITALL
no shutdown
interface bvi 2
ip address 192.168.100.7 255.255.255.192
alias 192.168.100.6 255.255.255.192
peer ip address 192.168.100.8 255.255.255.192
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.100.1
Many thanks,
Damian

Thanks for replying James,
I am sure I configured the capture only for VLAN10 which is in the VIP side.
But you are right, it looks like is showing both VLAN10 and VLAN15. So that is one of my theories out of the window! :)
This is a new installation, still on the testing stage. So it would be good time to make changes.
Do you normally implement a routed setup behind a firewall? Rather than a bridgedâ¦.
It is quite a small setup:
â¢ Traffic is coming from a separate local subnet
â¢ Traffic is not coming from the internet so it does not required a NAT
â¢ We need 1 VIP listening on two ports
â¢ The backend servers are four Linux boxes
Thanks again,
Damian

Adobe Bridge question...

I have a question about Adobe Bridge...
When I make changes to a Photoshop image’s description, under File info, Adobe Bridge will not recognize the changes and the new words do not come up in a search. Why is that?

Click on the link below to go to the Bridge forum:
Bridge Macintosh

Async sync bridge question

Hello,
I need expert advice regarding what is the best way to remove Async sync Bridge.
I am using the bridge from SAP to java application get message back. But I am not using to get any data, just to confirm that my message reached my java application.
Since I am not using to get data back in Sync call, i am planning to remove it since this is ver y resource consuming. On the other hand, i am palnning to use Async call and ackonowledgement.
If i use Async call, I have to depend on Xi queue for data synchronization. is there any other way that I can make sure my data is synchronised in SAP and java appl.
Thanks,
Srinivasa

Hey
By default SOAP adapter gives u a acknowledgement back in the form of a HTTP code(irrespective of you explicitly asking for it or not)HTTP 200 response code means success,you will see this in sxmb_moni.
if you don't get HTTP 200 in sxmb_moni then you will see and error there(HTTP 400 i guess).
>>Again, one basic doubt, is alert frmework can be implemented only in integraton process. or we can use for above case.
Alerts can be configured for any interface,it need not be Integration process.
You can configure alerts for your scenario and if u get HTTP 400 back you will see error in sxmb_moni and alert mechanism will trigger a e-mail to your account.
>>How can i assure data synchronization if i use async call
For Complete data synchronization you need a actual response from receiver system(not just HTTP return code)
but if you are concerned only with data delivery to the receiver system and are not concerned with how he/she handles it after it has been received,then HTTP response code will do.
Thanx
Aamir

First Implementation - Random Questions

Hi all, I've been doing my first implementation for past week and I've come across a few questions that I haven't found the answers to (yet). While scouring the user guides and Google, I figured I might as well ask the forums to expedite my research.
1) I created a new security device, but canceled creation during the process. Now when I try to re-add the device with the same name, it complains that it already exists, however it's not in the device list. Where can I find it?
2) I added my Foundstone device to MARS and configured it to do topology updates. Is there any method for confirming MARS is pulling vulnerability information from Foundstone?
3) When I create a custom rule (keyword specific) to be notified on, a similar built-in rule fires, but mine does not. If I disable the built-in rule, mine will fire and alert me. Does MARS match only the first, or the best rule to fire on?
4) Is it possible to customize the main Dashboard, or only the "My Reports" section.
Thanks in advance for any replies,
TBC

Thanks for the replies. I was able to add the device and schedule the topology updates, but short of watching the Foundstone database for incoming requests from MARS, I'm unable to verify that MARS is actually querying and using vulnerability information from Foundstone.
Thanks again
*Edit*
Progressing through this issue. I found that if I go to Management > IP Management > "Device_Name" > Edit > Vulnerability Assessment that I should be able to see the detected OS and services running on the machines. I do not see that information.
Upon review of the logs, I found the following:
pn va VulnerabilityDiscovererFActory PN-1100: Java message: Unsupported device type: Microsoft,Windows,Generic, use Dummy VulnerabilityDiscoverer
pn va foundstone FoundstoneVulnDiscoverer PN-1100: Java message: Exception caught in getting JDBC connection: Db server closed connection.
pn va ThirdPartyVulnDiscoverer PN-1100: Java message: Foundstone: Can not get JDBC connection.
So it appears to be a configuration issue or at least a database communication issue. I will continue to pursue it.
Thanks

Weblogic Messaging Bridge Question

          I am using the Weblogic Messaging Bridge and I have a question regarding Transactions.
          I am using the bridge to integrate MQ Series with Weblogic JMS.
          If I want to send messages over the the bridge and have it wrapped in a transaction
          do I wrap my code where I send the message across on the Queue within a User Transaction
          or do I wrap it in a Global Transaction?


Anuj,
          In your situation, if I remember correctly, use a JTA transaction to post
          the message to WL queue. Make sure that the bridge is configured with XA
          connection factory to move the message to MQ. The bridge will start an
          internal transaction and synchronously move messages to MQ and then it's
          upto your adapter code to dequue the message from MQ within transaction.
          On the receiving side, the adapter would put the message in MQ
          (transationally if you prefer), the bridge would move the message to WL
          destination within a transaction (assuming it is configured correctly). You
          could then use a MDB with container transaction to dequeue the message and
          invoke your business logic.
          Feel free to send me an email if you have further questions. You can also
          contact Helen. I am on the road, so I would not have access to my emails
          until I get back to the hotel.
          Once you are ready to move to 7.0 we could come back and see what hop can we
          remove.
          Hope this helps.
          .raja
          "Anuj Mehta" <[email protected]> wrote in message
          news:[email protected]...
          >
          > I am using the Weblogic Messaging Bridge and I have a question regarding
          Transactions.
          >
          > I am using the bridge to integrate MQ Series with Weblogic JMS.
          > If I want to send messages over the the bridge and have it wrapped in a
          transaction
          > do I wrap my code where I send the message across on the Queue within a
          User Transaction
          > or do I wrap it in a Global Transaction?
          >
          >

ACE Design/Normalization Question

We are deploying an ACE to LB some data center traffic. The ACE will sit off of our core 6500 w/ SUP720. We have multiple subnets that need to be loadbalanced that also reside on the same 6500.
We have done different tests in both routed and bridged mode and neither of these setups work without using a policy map on the 6500. I have disabled normalization and everything seems to work with the asymetric flow. Are there any disadvantages to disabling normalization? Also, i've read through most of the Cisco documents about bridged and routed mode. Does anyone know of any other documents out there with a similar design to above.
Thanks in Advance.

Hi Darren,
ACE normalization is more of a Security feature and won't allow asymmetrical flows through ACE. Normalization is enabled by
default.
Without normalization ACE does not monitor the state of the TCP connections and the first SYN is therefore enough to
consider the state as ESTABLISHED.
This link provides overview on TCP normalization,
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/security/guide/tcpipnrm.html#wp1002055
To prevent asymmetrical routing, you can configure Source NAT on ACE so that response from Server will go through ACE.
This link provides sample example on configuring Source NAT,
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c3041.shtml
Hope this helps,
Best Regards,
Rahul

ACE: design/config question: trans.slb + slb + mngt

Hi,
Could this ACE setup/design work?
I want PROXIED sessions (to VIP proxy 10.0.0.10) to be loadbalanced
All other sessions (eg. Some public ip's) will have to transparent loadbalanced to proxy servers. Thus not destinations NAT
ACE is inline between firewalls and proxy servers.
Vip definitions:
class-map match-all P_PXYVIP_VS_LB
2 match virtual-address 10.0.0.10 255.255.255.255 tcp 8080
class-map match-all P_PXYTRANS_VS_LB
2 match virtual-address 0.0.0.0 0.0.0.0 tcp any
Question in this case: would it still be possible to have management sessions towards proxy servers routed by the ACE ? (physical ip addresses of proxy)
Probably the classmap PXYTRANS is catching those sessies also.
Are there other design/config solutions to solve this one?
Thank you!
Wim

Let me repose the question:
How could one still be able to access the realserver IP (which is directly connected
to the ACE) for manangement.
Knowing that there is 1 VIP which (normal) loadbalance to the realservers
and
there is 1 VIP 0.0.0.0 tcp any which is configure to catch all other traffic to be
transparant loadbalanced.
The VIP 0.0.0.0 is always catching the sessions which need only to be routed
to the real servers ip.

ACE in bridged mode and multicast

We have configured an ACE SM in bridge mode and have a requirement to enable multicast on one of the networks where the back-end servers are residing. Will ACE support multicast out of the box, or will we need to do any tweaking on the ACE to enable the multicast support?
Thanks..

Hi Gilles,
Is it also supported in routed mode?
The ace isn't doing multicast routing right?
Actually, the server-side vlan is being routed on the C6500 and has pim sparse-dense mode enabled.
We want to move this server-side vlan behind the ace in routed mode. What about the pim?
Any ideas?
thanks,
Dario

ACE/FWSM design question

Hi - I'm designing the network topology for a multi tiered application using a 6509 with ACE and FWSM. Each tier will be in it's own VLAN and IP subnet and communications between tiers needs to be firewalled and in some cases loadbalanced.
I propose to do this by using a different context on both the ACE and the FWSM and using bridging mode within each context on both the FWSM and ACE as per Cisco's verified design for ACE/FWSM. It's perfectly feasable that a connection could be made for example to a server in the web tier, which would then need to make a connection to a server in the Application tier, which would in turn need to make a connection to a server in the database tier.
As far as I can see, the design I've proposed should work. Is anyone in a position to comment on whether there is anything wrong with this design, or a better way to do it?
There is no NAT to consider within this network
I've attached a JPG showing an example of the sort of connectivity that could be expected.
Many Thanks in advance

Thanks for your responses. I'm half way through implemeting this and there have been no problems so far.
With regards design & config notes for this, this document has most of what you need - http://www.cisco.com/application/pdf/en/us/guest/netsol/ns376/c649/ccmigration_09186a008078de90.pdf

ACE Implementation Bridging Question

Similar Messages

Maybe you are looking for