ACE in bridge mode with FWSM as gateway

our design
FWSM--vlan 7--ACE-vlan 8---servers with default gateway as FWSM
originally there were no plans of servers looking to load balance traffic when they wanted to communicate each other. now there is a need this
since ACE is in bridge mode, there are no ip address to VLAN configured on it and cant do source NAT
what we want servers in serverfarm A can contact a single ip which can be load balanced and traffic to be sent to serverfarm B. both serverfarms reside in vlan 8 and ace is in bridge. with VLAN not having IP how can we get this working. we were looking to create a policy on ACE with an ip address in vlan 8 and then do a source NAT to send the traffic to serverfarm 7.
with FWSM as the default gateway, by enabling permit intra traffic , it doesnt work because the command routes the traffic, dont think will send the traffic back to the same vlan
e.g static (inside,outside) 10.7.0.1 10.7.8.13 and allow intra traffic.
so when a machine 10.7.8.11 pings 10.7.0.1 it goes to the FWSM but fwsm doesnt look for 10.7.8.13
with ACE in bridge and FWSM doing above how to get around. can something be done on ACE in bridge mode with source NAT
Thanks

First, why don't you have an ip in your ACE vlan ?
Then, for traffic hitting a vip, we can do source nating even in bridge mode.
But if the vip is not an ip in vlan 8, your server will anyway send the traffic to the FWSM and ACE will first bridge the request.
The FWSM should then send the request back to ACE (not sure how this can be done).
So the request from the server will actually hit the vip on vlan 7 (not vlan 8).
So your policy-map with client nat must be on vlan 7.
Another option would be to configure a static route on the server to point the vip to the ACE vlan 8 ip address (which you should have configured).
In this case, the policy-map will have to be in vlan 8 with client-nat.
Gilles.

Similar Messages

Ace module in bridged mode with client nat

Could someone confirm whatever a NAT is supported for ACE-20 module, please?
Let me to explain technical details.
I do need to convert working CSM(SLB) config to ACE configuration and I am not quite sure
if the configuration below is correct. ACE module should be configured in bridge mode with two
vlans - vlan 36 (client) and vlan 436 (server) - bridged with interface bvi 36.
NAT on ACE configurad as "nat dynamic 1025 vlan 436" into corresponding
"policy-map type loadbalance"
Could you check two parts of configs and advise me if the ACE config is
properly converted from CSM and will be working in the same way (especialy for NAT).
Thank you in advance.
CSM config
=======
vlan 36 client
ip address 10.36.3.3 255.255.255.0 alt 10.36.3.4 255.255.255.0
gateway 10.36.3.1
vlan 436 server
ip address 10.36.3.3 255.255.255.0 alt 10.36.3.4 255.255.255.0
natpool WEB-MAIL 10.36.3.100 10.36.3.100 netmask 255.255.255.0
sticky 30 netmask 255.255.255.255 address source timeout 60
probe SHAREPOINT tcp
interval 30
failed 120
open 3
port 80
probe WEBMAIL-443 tcp
interval 5
failed 60
open 2
port 443
serverfarm WEBMAIL-443
nat server
nat client WEB-MAIL
predictor leastconns
real 10.36.3.101 443
   inservice
real 10.36.3.102 443
   inservice
probe WEBMAIL-443
serverfarm WEBMAIL-80
nat server
nat client WEB-MAIL
predictor leastconns
real 10.36.3.101 80
   inservice
real 10.36.3.102 80
   inservice
probe SHAREPOINT
vserver WEBMAIL-443
virtual 10.36.3.100 tcp https
serverfarm WEBMAIL-443
sticky 60 group 30
replicate csrp sticky
replicate csrp connection
persistent rebalance
inservice
vserver WEBMAIL-80
virtual 10.36.3.100 tcp www
serverfarm WEBMAIL-80
replicate csrp connection
persistent rebalance
inservice
ACE config
=======
probe tcp WEBMAIL-443
interval 5
open 2
passdetect interval 60
port 443
probe tcp SHAREPOINT
interval 30
open 3
passdetect interval 120
port 80
serverfarm host WEBMAIL-443
predictor leastconns
probe WEBMAIL-443
rserver 10-36-3-101 443
    inservice
rserver 10-36-3-102 443
    inservice
serverfarm host WEBMAIL-80
predictor leastconns
probe SHAREPOINT
rserver 10-36-3-101 80
    inservice
rserver 10-36-3-102 80
    inservice
class-map match-all WEBMAIL-80
match virtual-address 10.36.3.100 tcp eq www
class-map match-all WEBMAIL-443
match virtual-address 10.36.3.100 tcp eq https
sticky ip-netmask 255.255.255.255 address source 30
serverfarm WEBMAIL-443
replicate sticky
timeout 60
policy-map type loadbalance first-match WEBMAIL-80
class class-default
    serverfarm WEBMAIL-80
    nat dynamic 1025 vlan 436 serverfarm primary
policy-map type loadbalance first-match WEBMAIL-443
class class-default
    sticky-serverfarm 30
    nat dynamic 1025 vlan 436 serverfarm primary
parameter-map type http HTTP_ADV_OPT
persistence-rebalance
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
interface vlan 36
bridge-group 36
service-policy input IFVLAN36-POLICY
mac-sticky enable
no shutdown
interface vlan 436
bridge-group 36
nat-pool 1025 10.36.3.100 10.36.3.100 netmask 255.255.255.0
no shutdown
interface bvi 36
ip address 10.36.3.3 255.255.255.0
peer ip address 10.36.3.4 255.255.255.0
no shutdown

Hello F.Makarenko-
You will want to use PAT while you do nat, so change the natpool configuration to this:
   nat-pool 1025 10.36.3.100 10.36.3.100 netmask 255.255.255.0 pat
You also need to apply the nat like this:
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    nat dynamic 1025 vlan 436
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    nat dynamic 1025 vlan 436
If you are going to build out a lot of classes, you can instead do source nat like this:
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class class-default
    nat dynamic 1025 vlan 436
Regards,
Chris Higgins

Is anyone using a 1252 ap in bridge mode with channel bonding?

Is anyone using a 1252 ap in bridge mode, with channel bonding?
I had a question a while ago from a customer with regards to bridging with a 1252 ap to increase throughput for a wireless link he was using, from the throughput improvements in 802.11n. At the time I spoke to Cisco Pre-Sales, and they indicated that the bridge function in the 1252 exists for 'testing' purposes. I advised our customer that although it should be possible to implement, we may run into difficulties with TAC support ect. in the event of problems with the link.
Can anyone comment if this is a Cisco validated/approved design now?
Also, has anyone done this and tested the throughput achievable?
Has anyone bridged both 2.4Ghz and 5Ghz radios on a 1252?
The reason I ask is I've seen a note about a Cisco 5Ghz 802.11n bridge being launched.
Thanks in advance.
Alex.

Hi All,
Thanks for all the feedback; I have finally done some throughput testing with the 1252's. Please note, this is very rough, just to give an idea on throughput that's achievable, and what you can enable. Did this a few weeks back, and have now wiped the cnf, so dont have the show runs any more....
The two devices were set up a few feet apart, with the standard 2dBi and 3dBi antenna.
All tests done on the 5GHz radio with Autonomous AP IOS.
I did data transfers via a laptop either end of the link; transferring data using the Test TCP utility (wasn't going for scientific tests, just getting some idea of throughput).
802.11a @ 54mbs (20Mhz chan) WGB - root to non root = 2.43 - 2.5MB/Sec = 19.44 - 20 Mbps
802.11a @ 54mbs (20Mhz chan) WGB non root to root = 2.42 - 2.44MB/Sec = 19.44 - 20 Mbps
802.11n @ 'n' rates( 20Mhz chan) WGB root to non root = 6.18 - 6.33MB/Sec = 49.44 - 50.64 Mbps
802.11n @ 'n' rates ( 20Mhz chan) WGB non root to root = 4.77 - 5.00MB/Sec = 38.16 - 40 Mbps
802.11n @ 'n' rates ( 40Mhz chan) WGB root to non root = 8.59 - 8.58MB/Sec = 68.64 - 68.64 Mbps
802.11n @ 'n' rates ( 40Mhz chan) WGB non root to root = 6.35 - 7.20MB/Sec = 50.8 - 57.6 Mbps
802.11n @ 'n' rates ( 40Mhz chan) Bridge root to non root = 9.73 - 10MB/Sec = 77.84 - 80 Mbps
802.11n @ 'n' rates ( 40Mhz chan) Bridge non root to root = 8.40 - 8.57MB/Sec = 67.2 - 68.56 Mbps
So basically, as per the above posts, you can implement bridging on the 1252's and utilise the 802.11n rates and features, SGI, Spatial Streams and Channel Bonding etc, to achieve higher throughput.
Also, as per the above posts, this is still not supported by Cisco, so, in my case, I'd be highlighting that to customers straight off, but don't see it as too much of an impediment to deploy, as long as the customer weighs up the risks.
On a side note, I attended a Cisco session recently, and was told that the 802.11n Bridge, (the 1430?) was on hold indefinitely. My feeling is that this makes it more pressing that Cisco introduces support for bridging on the 1252.
Get in the ear of your local Wireless SE's, the more they hear it, the more they'll moan to the Wireless BU in San Jose! ;-)
Bridging with 802.11n has some interesting possibilities, I worked with Alvarion 5GHz bridges 6 or 7 years ago, that could do 'near LOS' - Worked well in cities, using reflection of the RF from buildings. I had never heard of 802.11n back then, but I'm guessing Alvarion was using MIMO to achieve good non-LOS connectivity in the 5GHz band.
Cheers,
Alex.

Using a Dlink router in bridged mode with Airport Express

I have a broadban connectiond via a Zyxel P-660 wifi modem + router. I have connected the Airport Express to this modem via ethernet and set up a wifi network. The wifi on the Zyxel has been turned off.
Since the wifi signal is weak in the other rooms, I am planning to link up a Dlink DIR-600 router running on the DD-WRT firmware on the bridged mode with the AE.
What settings do I need to have on the Dlink ?

I am planning to link up a Dlink DIR-600 router running on the DD-WRT firmware on the bridged mode with the AE.
If you are planning to have the Dlink device pickup the wireless signal from the AirPort Express and then "repeat" that signal, it is extremely unlikely that this will work.
Apple uses proprietary settings for their "extend" feature, which will only work with other Apple routers. It is....as far as we know....not compatible with devices from other manufacturers.
What settings do I need to have on the Dlink ?
All you can do is try to follow Dlink's instructions to setup the device as a "repeater" or "relay". The DD-WRT Forum might provide some tips. As you might imagine, there will not be much chance of a Dlink user ever seeing your post on an Apple forum.
DD-WRT Forum :: View topic - D-link DIR-600
There are no settings on the AirPort Express to adjust for this other than the obvious setting to check the box next to "Allow this network to be extended" on the Wireless settings page.
Good luck

Setup airport extream in bridge mode with ethernet

how do i setup airport extream in bridge mode with ethernet connection to extend wireless coverage. thanks for help.

We need some additional information to be able to provide the correct answer for your question.
What is the make and model of your "main" router?
What device will you use to set up the AirPort Extreme? Mac? iPad/iPhone?
If you have a Mac, we need the operating system that you are using on the computer. If you are not sure, click the Apple icon in the upper left corner of the screen, then click About This Mac. Post back with the OS X Version number that you see there.

Westell 6100G in bridge mode with Linksys BFSR41 wired router

I have had a long go-round with V tech support over slow DSL speeds since March 2011. They sent me the Westell 6100G to replace an ancient Westell that had provided satisfactory service for many years, connected through my LInksys BFSR41.
Initially, I connected the Westell directly to a PC and did not see any improvement in speed (always around 1.3M since March). So I re-connected it in bridge mode with the LInksys. Slow speeds continued, plus periodic hiccups, where the connection would simply not exist, although the lights were all good and the LInksys said "connected. Cure was to wait or power down modem and router. The following week a V tech called and said they had made changes to the network and fixed a problem with my line.
Thereafter I did see a vast improvement in speed as tested by Speedtest.net and Speakeasy.com (usually 2.8 M or thereabouts). But I still had the "hiccups". Now you see it, now you don't.
V tech support said, "connect the Westell directly". This indeed solved all intermittance problems. But I need the router and I need it to do the DHCP addressing dynamically as I frequently swap out machines. FYI this is a PPOe connection.
I hope someone on the forum can help me before I spend anther 2 hours in voicemail limbo.
Solved!
Go to Solution.

Well, my heat/humidity solution helped, but has not solved my problem. My connection still disappears at unpredictable, though less frequent intervals. Any and all ideas willl be appreciated.
Thanks

PBR with ACE in bridge mode

I have one ACE configured in bridge mode.
for proxy users : they have the VIP as proxy so the traffice from the client with destination the VIP
but there are some users without proxy so we used the Policy Base Routing and it is working and can see the connections on the ACE
but with destination IP of the websites so the traffice is not comming back as show below
BC-LB1/BlueCoat# sho conn | include 10.1.50.10
1782765 1 in TCP 210 10.1.50.10:52052 67.195.160.76:80 SYNSEEN
1355728 1 out TCP 210 67.195.160.76:80 10.1.50.10:52052 INIT
BC-LB1/BlueCoat#
in the PBR , we used the VIP as next hop address.
please advice what is the problem?
thanks in advance

Good afternoon,
As you mentioned, it seems the return traffic is not coming back through the ACE. You should review your PBR configuration to ensure that also the return traffic is matched and sent to the ACE
Regards
Daniel

ACE problem - bridge mode - behind a firewall

Hello
We are having problems with one of you ACE context, this implementation was done by a supplier and I am trying to troubleshoot it.
The clients and the servers are on different subnets, there is a Nokia firewall in the middle. The firewalls are setup on a cluster.
Connecting to port 7072 is taking at least 30 seconds. If I move the server into the VLAN in front of the ACE, the connection is instant. So it does indicate a problem on the ACE.
The client IP is .99.11.
The VIP is .100.62 and the server node is .100.12.
Running the capture command I can see the following behavior:
1. The client initiates the connection to the ACE Vip
2. At the same time it looks like a second connection is initiated from the client to the server node
Please see attachment.
Is this a normal situation where the connection is duplicated?
Does this interface setup look correct?
Is the bridge mode the correct setup in this scenario?
interface vlan 10
bridge-group 2
no normalization
mac-sticky enable
access-group input PERMITALL
service-policy input VLAN10-INTER-MMPM
no shutdown
interface vlan 15
bridge-group 2
no normalization
access-group input PERMITALL
no shutdown
interface bvi 2
ip address 192.168.100.7 255.255.255.192
alias 192.168.100.6 255.255.255.192
peer ip address 192.168.100.8 255.255.255.192
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.100.1
Many thanks,
Damian

Thanks for replying James,
I am sure I configured the capture only for VLAN10 which is in the VIP side.
But you are right, it looks like is showing both VLAN10 and VLAN15. So that is one of my theories out of the window! :)
This is a new installation, still on the testing stage. So it would be good time to make changes.
Do you normally implement a routed setup behind a firewall? Rather than a bridgedâ¦.
It is quite a small setup:
â¢ Traffic is coming from a separate local subnet
â¢ Traffic is not coming from the internet so it does not required a NAT
â¢ We need 1 VIP listening on two ports
â¢ The backend servers are four Linux boxes
Thanks again,
Damian

CSM-S in bridge mode with more than one vlan.

I want to understand well how CSM works with more vlans in bridge mode?
Can a host in a vlan contact another server in vlan if I change the IP address?
Thanks for your help.
Andrea.

Hi,
Yes it can
Please look @ this documents:
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00800946e0.shtml
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00802c1201.shtml
If you find this post usefull
please don't forget to rate this
#Iwan Hoogendoorn

Using WAG120N in bridged mode with EA4500

Hello everyone,
Right now, I'm trying to use my WAG120N router as a modem only/Bridged Mode and I've managed to enter all my settings needed on the WAG120N which is the Encapsulation to Bridged Mode Only, QoS to UBR, Type Of Connection to LLC, VPI and VCI to 0 and 35, DSL Modulation to Multimode.
On the EA4500's end I've entered my Usrname and password in the Internet settings and configured for PPPoE.
What am I doing wrong or am I missing something ?

Are you getting an error message on the EA4500 on its status page? If so, what is that error message? Are the settings you set on the modem coming from your ISP? Try to connect your pc directly to your modem with those settings enabled and check if you can get online. You may have to create a dialer or PPPoE connection on that one to work so that you can enter your username and password from your ISP to authenticate the internet connection.
Resolving PPPoE error messages when setting up router

Can the CSS operate in bridged mode with multple subnets?

The white paper below notes that the CSS CAN operate in bridged mode but it is not recommended. Is it possible to load balance more than a single subnet while operating the CSS in bridged (single VLAN) mode? I would like to test how effective it is despite the warning. Thanks.
http://www.cisco.com/en/US/products/hw/contnetw/ps1894/products_white_paper09186a00801bd4ae.shtml

you can assign multiple ip from different subnets to a single circuit vlan.
You link the physical interfaces with the "vlan" command. Then assign ip addresses under the circuit-vlan.
The CSS will bridge traffic on physical interfaces belonging to a same vlan.
I hope this is what you need.
Thanks,
Gilles.

ACE in bridged mode and multicast

We have configured an ACE SM in bridge mode and have a requirement to enable multicast on one of the networks where the back-end servers are residing. Will ACE support multicast out of the box, or will we need to do any tweaking on the ACE to enable the multicast support?
Thanks..

Hi Gilles,
Is it also supported in routed mode?
The ace isn't doing multicast routing right?
Actually, the server-side vlan is being routed on the C6500 and has pim sparse-dense mode enabled.
We want to move this server-side vlan behind the ace in routed mode. What about the pim?
Any ideas?
thanks,
Dario

TC in Bridge Mode with ISP router vs TC as Ethernet with VDSL modem

Hi, I have a time capsule. It's the newest generation of the old shape/design - i.e second to newest version. It's running 7.6.4. firmware.
I recently updgraded my ISP to Fibre VDSL and the ISP sent me a crappy router with a built-in modem that you have to use. I checked the ISP support forums and found plenty of advice to configure the TC over ethernet with this router using the DMZ of the router etc. Anyway, I got it all working but i wasn't happy. port forwarding was a pain and you end up with double NAT issue - not surprising.
The alternative config was to switch the TC to 'bridge mode' so the crappy ISP router does the NAT / DHCP, port forwarding, dpnp, internet routing. I got this all working and i have made sure that all of my network nodes/clients (wired and wifi) are all off the TC and only use the ISP router for internet, dhcp etc. This is all working with good speeds, solid internet access but...
Major issues with airplay (use this a lot) and also with stuff like facetime etc. The connection is much faster (40mbps down/10mbps up) than my old ASDL setup but as I said, key services that I use are not as stable.
I think my only alternative solution is to buy a VDSL modem seperately and use the TC as the router i.e. go back to my old config with TC doing all the routing, port forwarding etc.
Does anyone here have a view as to whether this is worth trying? I'm hoping that it if the TC is doing all the routing, I will get less drop outs and services will work as they should. On the other hand, I hoped airplay would be OK as it's a wifi/Lan service rather than WAN but I have had quite a few issues.
Appreciate any help with this and sorry for the lengthy note!
Jata.

In theory, you will do better by using a simple bridge mode modem and then setting up the Time Capsule as the router to provide DHCP and NAT services.
But, as you might imagine, it is not possible to predict whether your results will actually be better using this type of setup.
Worth a try, in my opinion, if you can find a store that will let you return the modem for credit if it does not do what you want.
Even a simple modem will still likely have to be configured to operate in bridge mode, but the setup should only take a few minutes using the web based configuration interface.
Let us know how things are working if you can, if you decide to the try the simple modem approach.

Is it ok to use Westell 6100F in non-bridged mode with Linksys router?

I'm a new Verizon DSL customer.
After several attempts I was only able to connect my Verizon 6100F modem with my Linksys wired router in non-bridged mode. I just changed the IP address in my router, and then released and renewed. I did this just yesterday and the connection is fine...so far.
Fyi, I'm using the Linksys for its firewall. I don't need wireless.
Since I didn't bridge the modem, I assume I'm basically using two routers, the 6100F and the Linksys. Will this cause me issues in the future?
I need to decide whether to try again to bridge the modem or just leave it alone.
Thanks.

dslr595148 wrote:
Yes, it is ok.
Here are things that I have ever heard of what can happen (or happens) with Double NAT:
#1 Might not possible to get online, depending on the LAN IP of both routers. But it sounds like you already solved that issue.
#2 NAT and Double NAT cause lag/latency.
I point to two source(s).
a) URL: http://www.dslreports.com/faq/15872
Title/Location: All DSLR (dslreports.com) FAQs » AT&T Southeast Forum FAQ » Motorola Info » How do I properly set up a Motorola 2210 with a Netgear router.
b) As to why that theory/concept is true, go to http://www.endlagnow.org/ELN/TakeAction_TopTips.aspx
and read tip number one, there.
#3 If you want to allow users from the net to connect to you, I point to..
http://www.portforward.com/ -> Other Guides -> Port Forwarding Behind Two Routers?
#4 http://kb.netgear.com/app/answers/detail/a_id/992
Where they talk about Double NAT, VPNs, and visiting secure (SSL) sites.
#5 Some routers may or may not show up when doing a trace route to the outside.
Another problem with double-NAT is some screen sharing methods may not work. Such as Apple "Back To My Mac".
Using and troubleshooting Back to My Mac in Mac OS X 10.5
I just logged on to this forum to see if I can find the necessary steps to turn my Westel 6100F up to "bridge" so I can use my Linksys WRT54G2v1 as the only router on my home network.
PS, I'm subscribing to this thread in case anyone has a link to step by step for setting this up on the Westel 6100F (I can handle the Linksys end of things).
{edited for privacy}
Message Edited by ElizabethS on 07-11-2009 01:30 PM

X3500 wont work in Bridge mode with ASA 5505

Hi Everyone, I am currently running Linksys X3500 v1.0.0 and plan to use ASA 5505 as a PPPoE client. While PPPoE connection is working fine when i configure the linksys for PPoE, but When I configure the ASA 5505 to act as PPPoE client I'm unable to get the Linksys get the Internet up and running. I have opened support ticket with Cisco and per them X3500 is unable to provide PPPoE details in bridge mode. Cisco Ticket # 62968611 (PPPoE connection not working) The error on Cisco console is - asa5505# PPPoE: send_padiSnd) Dest:ffff.ffff.ffff Src:c8b3.735d.4e13 Type:0x8863=PPPoE-Discovery PPPoE: Ver:1 Type:1 Code:09=PADI Sess:0 Len:12 PPPoE: Type:0101VCNAME-Service Name Len:0 PPPoE: Type:0103:HOSTUNIQ-Host Unique Tag Len:4 PPPoE: 00000002 PPPoE: padi timer expired Can Linksys help.. What's the issue. Regards, Sumit

Hi! I'm not so familiar with the Cisco ASA 5505 device. If you set your X3500 to a Bridge Mode, it will not give any PPPoE mode details and vice versa. Which of the two devices would you like to connect to the ISP's connection, is it the X3500 or the ASA 5505?

ACE in bridge mode with FWSM as gateway

Similar Messages

Maybe you are looking for