ACE in Direct Server Return mode not working as expected

Question

Dear all,
I configured my ACE as I found it here:
https://supportforums.cisco.com/docs/DOC-22555
the VIP is working, that means I can ping it, routing is working etc.
I created a loopback on the win2012 Server with the IP of the VIP. When I try now to test the LB with telnet on port 25 e.g. it is not working. direclty on the server it works, also in my last deployment where I use SNAT/PAT. But we want the real client IPs visible on the Exchange Server.
Where is my problem ? Any ideas would be great..
rserver host YY
  description AServer-1
  ip address 10.1.x.2
  inservice
rserver host XX
  description AServer-2
  ip address 10.1.x.3
   inservice
serverfarm host Mail
  description Mail
  transparent
  predictor leastconns
  rserver AServer-1
    inservice
  rserver AServer-2
sticky ip-netmask 255.255.255.255 address both Mail
  timeout 5
  replicate sticky
  serverfarm Mail
class-map match-all Exchange_ALL
  2 match virtual-address 192.168.1.1 any
class-map type management match-any remote_access
  2 match protocol xml-https source-address 10.a.b.0 255.255.255.0
  3 match protocol icmp source-address 10.a.b.0 255.255.255.0
  5 match protocol ssh source-address 10.a.b.0 255.255.255.0
  7 match protocol https source-address 10.a.b.0 255.255.255.0
  8 match protocol snmp source-address 10.a.b.0 255.255.255.0
  9 match protocol xml-https source-address 10.d.e.1 255.255.255.255
  10 match protocol icmp source-address 10.d.e.1 255.255.255.255
  11 match protocol ssh source-address 10.d.e.1 255.255.255.255
  12 match protocol https source-address 10.d.e.1 255.255.255.255
  13 match protocol snmp source-address 10.d.e.1 255.255.255.255
policy-map type management first-match remote_mgmt_allow_policy
  class remote_access
    permit
policy-map type loadbalance first-match mail
  class class-default
    sticky-serverfarm Mail
policy-map multi-match VLAN20
  class Exchange_ALL
    loadbalance vip inservice
    loadbalance policy mail
    loadbalance vip icmp-reply
interface vlan 2
  ip address 10.a.b.2 255.255.255.0
  access-group input ALL
  service-policy input remote_mgmt_allow_policy
  no shutdown
interface vlan 20
  description Server
  ip address 10.1.x.20 255.255.255.0
  peer ip address 10.1.x.30 255.255.255.0
  no normalization
  access-group input ALL
  service-policy input VLAN20
  no shutdown
ft interface vlan 4
  ip address 10.f.g.2 255.255.255.252
  peer ip address 10.f.g.1 255.255.255.252
  no shutdown
ft peer 1
  heartbeat interval 300
  heartbeat count 10
  ft-interface vlan 4
ft group 1
  peer 1
  associate-context Admin
  inservice
ip route 10.d.e.0 255.255.255.255 10.1.x.1
ip route 0.0.0.0 0.0.0.0 10.a.b.1

Answer 1

Oh, I see. Very interesting indeed!
Do you get the BAD CHECKSUM and IP CHECKSUM OFFLOAD on the remote sites?
It could be this that is the problem. I read this and it seems as though it causes disconnects just as you experience too.
or just disable - it worked for some here, but for others, they upgraded the drivers of the NIC:
http://www.techsupportforum.com/forums/f137/wireshark-question-tcp-checksum-offload-248812.html
1. Open Device manager (right click "Computer" and click "Manage")
2. Click on "Device Manager"
3. Expand "Network Adapters"
4. Right click your network adapter
5. click "properties"
6. click the tab named "Advanced"
7. Find "IP Checksum Offload" and click it
8. Put the value to the right to "Disabled"
9. Find "TCP Checksum offload (IPvX)
10. Set the value to the right to "Disabled"
The Wiki Wireshark article had this:
In Windows, go to Control Panel->Network and Internet Connections->Network Connections, right click the connection to change and choose 'Properties'. Press the 'Configure...' button, choose the 'Advanced' tab to see or modify the "Offload Transmit TCP Checksum" and "Offload Receive TCP Checksum" values.
It seems like a server side issue rather than Load Balancer problem.
Hope this helps
Please rate useful posts and remember to mark any solved questions as answered. Thank you.