ACE Module - Archiving Rserver/Serverfarm connection statistics

Hello,
We have CiscoWorks and Cisco Security Manager in our setup. And we would like to record/archive the rserver/serverfarm connection statistics from ACE20 Module. CiscoWorks is only able to pull CPU & Memory stats.
Is there a way where connections stats can be collected. If so, please advise the method or tool (possibly free) which could record and give historical view of the connection statistics.
Thanks.

Hello Dedra-
What you are looking for is ANM. It is a software that runs on RedHat 5.2.X linux (we also just released a VMWare image for ESXi 4.X) It uses SNMP, SSH, and system logging to manage and monitor CSS, CSM, ACE, and the SSL Service module (and to a minor extent the 6k chassis the devices are in.) It stores information and has the ability not only to show you numbers, but graphs and topological ouputs based on your unique configuration.
Unfortunately, we do not offer it for free, but it is licensed based on how many contexts/physical devices you use it with. Give you Cisco Sales engineer, or Cisco Partner a call and see about getting a demo license. As well, check out the documenation on it located here:
http://cco.cisco.com/en/US/products/ps6904/tsd_products_support_series_home.html
Regards,
Chris Higgins

Similar Messages

ACE module - should 'sh serverfarm' and the SNMP OID 'slbVServerNumberOfConnections' show the same value?

I've recently begun to notice that the current connections value displayed by the ACE when using the 'sh serverfarm' command isn't matching up with the value returned by a custom MIB poller I'm using to return the value of the associated 'slbVServerNumberOfConnections' OID when I had assumed that they represented the same thing?
As an example at the moment the ACE is showing 400 current connections for a particular serverfarm but my customer poller is returning 250?
I'd noticed this behaviour whilst the ACE was running software version A2(1.6a) and had hoped that an upgrade to A2(2.3) might fix it but it hasn't - assuming it's a bug as opposed to just my misunderstanding of what value 'slbVServerNumberOfConnections' is actually returning?
Can anyone explain what I'm seeing or am I polling the wrong OID?
Thanks in advance
regards
Matthew

What about the 'show conn' ? do you see 400 or 250 concurrent connections ?
What about 'sho service-policy'
The OID refers to the VIP not the serverfarm.
Also the show serverfarm is known to display incorrect information
CSCtc94844: ACE: show serverfarm current connection counter incorrect
The fix will be in A2(2.4)
Gilles.

Ace module dropping assymetric layer 2 connections

Hi we had a situation in where the ACE would randomly drop certain tcp connections, and all ICMP packets from a certain windows server. The server in question was using Transmit Load Balancing with Fault Tolerance.
The server has one Nic connected to Access switch1, and the other nic connected to Access switch2. Each access switch connects up to a pair of 6509's, which is active on Core1 on both switches.
I am guessing If the server sends on Nic 2, core1 knows it came in on the downstream trunk port to Switch2, it must reply to these packets based on the teamed mac of the layer 3 address(no idea who is arping for the destination - the ace?), and send them back out the downstream trunk port to switch1. The ace module is in transparent mode. When contacting a server on the other side of the ace, the ace drop packets that came from the second nic - and I am wondering how it "knows" that the return path is out of different downstream port. Does it share some kind of layer 2 RPF check with the 6500 ?
Please note there is no routing involved here. The destination server is just on another vlan on the same subnet, on the other side of the ace.

Bryan,
As long as the server replies back to the ACE the client should only be commmunicating with the VIP address in either of your two examples.
In your first example the flow will look like this.
client > VIP after the ACE client > rserver
the reply would be
rserver > client after the ACE VIP > rserver
In your second example using client nat it will look like this
Client > VIP After ACE Natpool > rserver.
the reply would be
rserver > Nat-pool after ACE VIP > client.
The ACE by default will always nat the vip to the server ip unless you use the command "transparent" under the serverfarm. When using this command we send the packet to the MAC address of the server leaving the destination IP of the VIP. The server would need to have the VIP address configured under the loopback interface.
Regards
Jim

Per-ServerFarm SNAT on ACE Module.

Dear all,
I hace an ACE Module configured in Multiple Routed Contexts.
My cust wants to configure some NAT Feature that prevents the real server IP Address appear outside the ACE. They want that the only IP address outside the ACE will be the Virtual IP Adress (VIP) that represents the serverfarm.
Also, the cust wants that different serverfarms comunicate each other within the same VLAN.
I was reading and the option that acomplish both tasks is Dynamic (PAT) Per-ServerFarm SNAT using the VIP address.
Is this correct?
The software version is A2(3,5).
Thanks a lot!
David

Hi David
Could you please calrify and maybe separate tasks you have ?
As I understand you have such tasks for now :
1) Don't show rserver IPs anywere outside ACE
2) Servers in the same VLAN should be able to communicate with serverfarm which is located in the same VLAN via VIP
First task is a little bit unclear. I mean - actually you have VIP outiside of ACE and all outiside clients communicate to serverfarm via VIP and don't need to know rserers IPs (e.g. they can even be private and VIP is public, if we're talking about Internet)
Or do you mean that rservers need to communicate with outside world through ACE but you want to NAT these flows too ?
2) Yes, it's possible. For such configuration you need to create a service policy, with the same VIP and configuration as you have for outside interface and put it on inside interface. The only one key difference is that you need to add NAT statement , because return traffic should go to ACE and as rservers and clients in this case are in the same VLAN, you need to use NAT.
E.g.
policy-map multi-match VIP_IN
class MY-CLASS
loadb vip ins
loadb policy MY-L7Policy
nat 1 dynamic vlan X << - inside interface
and then on inside interface
inter vlan X
nat-pool 1Y.Y.Y.Y netmask 255.255.255.255 pat
In this case it will work in this way : say you have servers in vlan 10. Servers #1 and #2 are rservers in your serverfarms and server #3 wants to connect to serverfarm through VIP. Let's say that vlan 10 has subnet 10.0.0.0/24 and VIP for this serverfarm is 8.8.8.8. When you confiure like I wrote above this will happen :
Server #3 connects to 8.8.8.8, traffic goes to ACE as a gateway, as you have a policy map on inside interface which catches traffic to 8.8.8.8 , ACE will catch it an proceed it. You have a SNAT statement there, so ACE will perform standard loadblanacing and replace source IP with NAT IP (say 10.0.0.100) , thus when server #1 which gets this loadbalanced traffic receives it , it will send return traffic to 10.0.0.100 , thus to ACE.

ACE Module Cookie Parsing causes Reset Connection

I am trying to upgrade my ACE Modules from A2(1.3) to A2(3.2) . Unfortunately, the cookie parsing breaks when there are illegal characters and causes a connection reset (RST) when there is an invalid cookie, but only on code later than A2(1.3).
The cookie in question is being passed by a third party so making them change the cookie is not necessarily do-able. The cookie has the following value:
Cookie: CurrentUser={"UserKey":{"Key":"anonymous"},"LastUpdated":"10/13/2010 1:35:52 PM"}
We are using the following parameter map:
parameter-map type http CASE_PARAM
case-insensitive
persistence-rebalance
set header-maxparse-length 20480
length-exceed continue
On the older code, the request is passed on to the server.
Is there a setting similar to "length-exceed continue" that I can give the ACE to tell it to ignore cookies it cannot parse?

HTTP inspection is not enabled.
Did you mean adding a class-default to the policy-map?
Adding it to the policy-map does make it match the class-default. Unfortunately, cookie parse errors result in the inability to parse both the cookie and the host header as well. It seems that rather than just failing to parse the cookie and being unable to do sticky matching - it completely fails the entire header parsing.
Here's our setup:
rserver host test1
ip address 192.168.1.101
inservice
rserver host test2
   ip address 192.168.1.102
   inservice
rserver host test3
   ip address 192.168.1.103
   inservice
rserver host test4
   ip address 192.168.1.104
   inservice
serverfarm host auto
probe HTTP-diagnostic
rserver test1
    inservice
rserver test2
    inservice
serverfarm host news
probe HTTP-diagnostic
rserver test3
    inservice
rserver test4
    inservice
sticky http-cookie autoCookie auto-cookie
cookie insert browser-expire
replicate sticky
serverfarm auto
sticky http-cookie newsCookie news-cookie
cookie insert browser-expire
replicate sticky
serverfarm news
class-map type http loadbalance match-any auto
2 match http header Host header-value "www.auto.local"
3 match http header Host header-value "auto.local"
class-map type http loadbalance match-any news
   2 match http header Host header-value "www.news.local"
   3 match http header Host header-value "news.local"
class-map match-all prod_VIP
2 match virtual-address XXX.XXX.XXX.XXX tcp eq www
policy-map type loadbalance first-match prod_POLICY
class auto
    sticky-serverfarm auto-cookie
class news
    sticky-serverfarm news-cookie
class class-default
    sticky-serverfarm auto-cookie
policy-map multi-match aggregate-slb-apps
class prod_VIP
    loadbalance vip inservice
    loadbalance policy prod_POLICY
    loadbalance vip icmp-reply active
    loadbalance vip advertise
    appl-parameter http advanced-options CASE_PARAM

ACE Module and Limiting Connections

We currently use the ACE module to Load-balancing IPSEC connection into SPA's. Since the SPA's only support 60 new connections per second. I was looking for a way to limit the amount of connecitons from the ACE to the SPA's.

Hello,
Have a look at the Configuring Real Server Rate Limiting section of the ACE documentation. I think this will meet your needs.
Hope this helps,
Sean

ACE module connection drops

I am facing an issue with Cisco ACE module. Have 5 servers serving the connections for applications. However, during peak hours there is lot of dropped connections.
Also have lot of fragment reassemble.
Please help how to go ahead troubleshooting the issue.

it is on the cisco site. In the ACE datasheet to be exact. But I'm talking about the appliance. Not sure about the module. But should be the same. Only thing I was not sure was whether the same limits apply to the base license package, or are the figures lower for the base license. Cisco says that the numbers are the same for the base package.
however I'm yet to verify it on the field

Cisco ACE module missing licence file - no connectivity

Hi,
We have 2 ACE modules that were delivered without any licenses.
There is no IP connectivity whatsoever to these modules and I'm guessing this is due to the fact there are no licenses installed.
Have tried asking Cisco to no avail - and am not sure if there is an actual problem with them or not.
The VLANs are assigned correctly and I can see inbound ICMP echo from the 6509 that its hosted in, but no outbound packets ever leave the ACE. I've applied a mgmt policy to enable ping/telnet/ssh etc.
switch/Admin# sh vlans
Vlans configured on SUP for this module
vlan4 vlan30-31 vlan160 vlan180-195 vlan360 vlan380-395 vlan560 vlan580-
595 vlan760 vlan780-795
switch/Admin# sh ip int bri
Interface       IP-Address      Status                  Protocol
vlan4           10.119.127.196 up                      up
vlan30          10.119.127.241 up                      up
vlan31          10.119.127.245 up                      up
interface vlan 4
description ACE Mgmt interface for Admin Context
ip address 10.119.127.196 255.255.255.224
service-policy input REMOTE_MGMT
no shutdown
vlan4 is up
Hardware type is VLAN
MAC address is 00:1f:ca:7b:6f:33
Mode : routed
IP address is 10.119.127.196 netmask is 255.255.255.224
FT status is non-redundant
Description:ACE Mgmt interface for Admin Context
MTU: 1500 bytes
Last cleared: never
Alias IP address not set
Peer IP address not set
Assigned from the Supervisor, up on Supervisor
Config download failures : 1
     2980 unicast packets input, 16363862 bytes
     240857 multicast, 3026 broadcast
     0 input errors, 0 unknown, 0 ignored, 0 unicast RPF drops
     0 unicast packets output, 187712 bytes
     0 multicast, 2933 broadcast
     0 output errors, 0 ignored
switch/Admin# sh arp
Context Admin
================================================================================
IP ADDRESS      MAC-ADDRESS        Interface Type      Encap NextArp(s) Status
================================================================================
10.119.127.193 00.00.00.00.00.00 vlan4     GATEWAY    -       * 3 req     dn
10.119.127.196 00.1f.ca.7b.6f.33 vlan4     INTERFACE LOCAL     _         up
10.119.127.245 00.1f.ca.7b.6f.33 vlan31    INTERFACE LOCAL     _         up
10.119.127.241 00.1f.ca.7b.6f.33 vlan30    INTERFACE LOCAL     _         up
================================================================================
Total arp entries 4
The ARP table for the adjacent switch SVI has a valid MAC upon reboot, but soon after resets to 00.00.00.00.00.00
Problem is that once Cisco eventually send me the license file I have no way of TFTP'ing it to the ACE module.
Any suggestions/advice?

Thanks for the info - so I should at least be able to connect to a license-less ACE at least, but these modules seem to have a problem.
If the modules are reloaded (from the ACE) or reset (from the Supervisor) they initially have the ARP entry (however still cannot communicate to the attached Supervisor via SVI) which eventually resets.
Info as requested:
switch/Admin# sh resource usage
                                                     Allocation
        Resource         Current       Peak        Min        Max       Denied
Context: Admin
conc-connections              9          9          0          0          0
mgmt-connections              0          0          0          0          0
proxy-connections             0          0          0          0          0
xlates                        0          0          0          0          0
bandwidth                     0         76          0 125000000 296849008
    throughput                  0         76          0          0 296849008
    mgmt-traffic rate           0          0          0 125000000          0
connection rate               0          2          0          0         15
ssl-connections rate          0          0          0          0          0
mac-miss rate                 0          0          0          0          0
inspect-conn rate             0          0          0          0          0
acl-memory                    0       6336          0          0         11
sticky                        0          0          0          0          0
regexp                        0          0          0          0          0
syslog buffer                 0          0          0          0          0
syslog rate                   0          0          0          0         24
Context: APPLICATION
conc-connections              0          0    2000000          0          0
mgmt-connections              0          0      25000          0          0
proxy-connections             0          0     262144          0          0
xlates                        0          0     262144          0          0
bandwidth                     0          0 125000000 125000000          0
    throughput                  0          0 125000000          0          0
    mgmt-traffic rate           0          0          0 125000000          0
connection rate               0          0     250000          0          0
ssl-connections rate          0          0        250          0          0
mac-miss rate                 0          0        500          0          0
inspect-conn rate             0          0       1500          0          0
acl-memory                    0          0   19650480          0          0
sticky                        0          0     419430          0          0
regexp                        0          0     262144          0          0
syslog buffer                 0          0    1048576          0          0
syslog rate                   0          0      25000          0          0
Context: BACK_END
conc-connections              0          0    2000000          0          0
mgmt-connections              0          0      25000          0          0
proxy-connections             0          0     262144          0          0
xlates                        0          0     262144          0          0
bandwidth                     0          0 125000000 125000000          0
    throughput                  0          0 125000000          0          0
    mgmt-traffic rate           0          0          0 125000000          0
connection rate               0          0     250000          0          0
ssl-connections rate          0          0        250          0          0
mac-miss rate                 0          0        500          0          0
inspect-conn rate             0          0       1500          0          0
acl-memory                    0          0   19650480          0          0
sticky                        0          0     419430          0          0
regexp                        0          0     262144          0          0
syslog buffer                 0          0    1048576          0          0
syslog rate                   0          0      25000          0          0
Context: FRONT_END
conc-connections              0          0    2000000          0          0
mgmt-connections              0          0      25000          0          0
proxy-connections             0          0     262144          0          0
xlates                        0          0     262144          0          0
bandwidth                     0          0 125000000 125000000          0
    throughput                  0          0 125000000          0          0
    mgmt-traffic rate           0          0          0 125000000          0
connection rate               0          0     250000          0          0
ssl-connections rate          0          0        250          0          0
mac-miss rate                 0          0        500          0          0
inspect-conn rate             0          0       1500          0          0
acl-memory                    0          0   19650480          0          0
sticky                        0          0     419430          0          0
regexp                        0          0     262144          0          0
syslog buffer                 0          0    1048576          0          0
syslog rate                   0          0      25000          0          0
Context: TEST_DEV
conc-connections              0          0    2000000          0          0
mgmt-connections              0          0      25000          0          0
proxy-connections             0          0     262144          0          0
xlates                        0          0     262144          0          0
bandwidth                     0          0 125000000 125000000          0
    throughput                  0          0 125000000          0          0
    mgmt-traffic rate           0          0          0 125000000          0
connection rate               0          0     250000          0          0
ssl-connections rate          0          0        250          0          0
mac-miss rate                 0          0        500          0          0
inspect-conn rate             0          0       1500          0          0
acl-memory                    0          0   19650480          0          0
sticky                        0          0     419430          0          0
regexp                        0          0     262144          0          0
syslog buffer                 0          0    1048576          0          0
syslog rate                   0          0      25000          0          0
switch/Admin# sh cde health
CDE BRCM INTERFACE
======================
Packets received                                             3357
Packets transmitted                                            12
Broadcom interface CRC error count                              0
BRCM VOQ status                           [empty]      [not full]
BRCM pull status                                        [pulling]
CDE HYPERION INTERFACE
======================
Packets received                                          7668407
Packets transmitted                                        967915
Short packets drop count                                        0
Fifo Full drop count                                            0
Protocol error drop count                                       0
FCS error drop count                                            0
CRC error drop count                                            0
Num times flow control triggered on hyp interface                0
Num self generated multicast packets filtered              967915
HYP IXP0 VOQ status                       [empty]      [not full]
HYP IXP1 VOQ status                       [empty]      [not full]
HYP SLOW VOQ status                       [empty]      [not full]
HYP tx pull status                                      [pulling]
CDE IXP0 INTERFACE
======================
Packets received                                           964680
Packets transmitted                                       6581196
Num bad pkts recvd on fast spi channel0                         0
Num bad pkts recvd on slow spi channel8                         0
Num bad pkts recvd on fast spi channel2                         0
Num bad pkts recvd on slow spi channel4                         0
IXP0 Fast VOQ status                      [empty]      [not full]
IXP0 BRCM VOQ status                      [empty]      [not full]
IXP0 pull status                                        [pulling]
IXP0 spi src status                                     [healthy]
IXP0 spi snk status                                     [healthy]
CDE1 SWITCH1 INTERFACE
======================
Packets received (hyp, ixp0)                                 3241
Packets received (bcm)                                          6
Packets received (daughter card 0)                              0
Packets received (daughter card 1)                              0
Packets Errors received (hyp, ixp0)                             0
Packets Errors received (bcm)                                   0
Packets Errors received (daughter card 0)                       0
Packets Errors received (daughter card 1)                       0
Packets transmitted (ixp1)                                 122653
Packets transmitted (nitrox)                                    0
Packets Errors transmitted (ixp1)                               0
Packets Errors transmitted (nitrox)                             0
CDE2 SWITCH2 INTERFACE
======================
Packets received (ixp1)                                    122653
Packets received (nitrox)                                       0
Packets Errors received (ixp1)                                  0
Packets Errors received (nitrox)                                0
Packets transmitted (hyp, ixp0)                              3241
Packets transmitted (broadcom)                                  6
Packets transmitted (daughter card 0)                           0
Packets transmitted (daughter card 1)                           0
Packets Errors transmitted (ixp1)                               0
Packets Errors transmitted (nitrox)                             0
Packets Errors transmitted (daughter card 0)                    0
Packets Errors transmitted (daughter card 1)                    0
CDE IXP1 INTERFACE
======================
Packets received                                             3247
Packets transmitted                                        122653
Num bad pkts recvd on fast spi channel0                         0
Num bad pkts recvd on slow spi channel8                         0
Num bad pkts recvd on fast spi channel2                         0
Num bad pkts recvd on slow spi channel4                         0
IXP1 Fast VOQ status                      [empty]      [not full]
IXP1 BRCM VOQ status                      [empty]      [not full]
IXP1 pull status                                        [pulling]
IXP1 spi src status                                     [healthy]
IXP1 spi snk status                                     [healthy]
CDE NITROX INTERFACE
======================
Packets received                                                0
Packets transmitted                                             0
Num bad pkts recvd on fast spi channel0                         0
Num bad pkts recvd on slow spi channel8                         0
Num bad pkts recvd on fast spi channel2                         0
Num bad pkts recvd on slow spi channel4                         0
NTX Fast VOQ status                       [empty]      [not full]
NTX BRCM VOQ status                       [empty]      [not full]
NTX pull status                                         [pulling]
NTX spi src status                                      [healthy]
NTX spi snk status                                      [healthy]
== Backplane ==
ITASCA_SYS_CNTL1 0x300 data 0x61f0000
ITASCA_SYS_CNTL2 0x304 data 0x80630000

ACE module not load balancing across two servers

We are seeing an issue in a context on one of our load balancers where an application doesn't appear to be load balancing correctly across the two real servers. At various times the application team is seeing active connections on only one real server. They see no connection attempts on the other server. The ACE sees both servers as up and active within the serverfarm. However, a show serverfarm confirms that the load balancer sees current connections only going to one of the servers. The issue is fixed by restarting the application on the server that is not receiving any connections. However, it reappears again. And which server experiences the issue moves back and forth between the two real servers, so it is not limited to just one of the servers.
The application vendor wants to know why the load balancer is periodically not sending traffic to one of the servers. I'm kind of curious myself. Does anyone have some tips on where we can look next to isolate the cause?
We're running A2(3.3). The ACE module was upgraded to that version of code on a Friday, and this issue started the following Monday. The ACE has 28 contexts configured, and this one context is the only one reporting any issues since the upgrade.
Here are the show serverfarm statistics as of today:
ACE# show serverfarm farma-8000
serverfarm     : farma-8000, type: HOST
total rservers : 2
                                                ----------connections-----------
       real                  weight state        current    total      failures
   ---+---------------------+------+------------+----------+----------+---------
   rserver: server#1
       x.x.x.20:8000      8      OPERATIONAL 0          186617     3839
   rserver: server#2
       x.x.x.21:8000      8      OPERATIONAL 67         83513      1754

Are you enabling sticky feature? What kind of predictor are you using?
If sticky feature is enabled and one rserver goes down, traffic will leans to one side.
Even after the rserver retuns to up, traffic may continue to lean due to sticky feature.
The behavior seems to depend on the configuration.
So, please let me know a part of configuration?
Regards,
Yuji

Want to know about ACE module in 6509 : load-balancing concept

Hi,
I am quite new in this field , where i need to configure and understand the concept of load-balancing through ACE.
In my existing network set-up , i have some application servers as well as some other servers where i am looking for load-balancing.
I have gone through some of the site and cisco site as well and i came across ACE module which can be installed in 6509 switch.
I have 6509 switch as well but before going for installing the ACE module I am keen to understand below things:
1) what is difference between CSM or any other product load-balancer and ACE module :
Gone through site as well , but not getting proper answer or comparison.
1) I have some of the server configured with clustering and getting one virtual IP, In this case , will ACE work ?
2) If suppose i go for configuring different IP address with all server IP :
How do i achieve it ?
3) what is Virtual IP concept in ACE because i do not have and other ACE module then why do i need virtual IP ?
4) will the load-balancing happens based on destination based or session based ?
Please share the knowledge. It would be great help for me to go ahead with ACE and configure it and understand all the application ?

Hello,
1) what is difference between CSM or any other product load-balancer and ACE module :
There are several differences but to say simply, you get higher performance and more features with ACE module/appliance comparing others.
One big difference is that with ACE seriese, you can configure multiple contexts on one box (virtual load-balancers on one box) that makes us possible to provide a virtual load-balancer to a customer. In that way, the customer can access and makes changes on only the virtual box. You can split management domain for each customers. Also using contexts, you can assign certain resources available on the hardware for each contexts according to their service contract.
ACE serise has specific hardware chip for supporting SSL termination but some others do not.
For instance, you need a CSM-S, or a CSM and a SSL module to terminate SSL.
The other thing I should mention is that our most recent product is ACE serise that means it has longer product roadmap.
Let me try clarifying your other questions.
3) what is Virtual IP concept in ACE because i do not have and other ACE module then why do i need virtual IP ?
4) will the load-balancing happens based on destination based or session based ?
I think I'd better to put 3) and 4) first.
Virtual ip address (VIP) is the address to which client accesses.
VIP is tied with a serverfarm or serverfarms, in a serverfarm one or multiple rservers can be configured.
"serverfarm" is a group of "rservers".
"rserver" means real-server that has an ip address and processes transactions.
When a client accesses to the VIP, ACE picks up a rserver according to algorithm.
If you configure a VIP that is tied with a serverfarm where only one rsever is configured, client accesses to the virtual ip address are
all forwarded to the rserver.
If you configure a VIP that is tied with a serverfarm where multiple rsevers are configured, client accesses to the virtual ip address are
balanced among those rservers.
If you configure multiple VIPs, client accesses to those VIPs are forwareded to corresponding rservers according to configuration.
1) I have some of the server configured with clustering and getting one virtual IP, In this case , will ACE work ?
ACE load-balances connections to configured rservers.
If the clustered servers are sharing one virtual ip address and you configure the virtual ip address as a rserver, all connections are
sent to the virtual ip address. That is not "load-balancing" on ACE... You need multiple rservers to which ACE load-balances connections.
2) If suppose i go for configuring different IP address with all server IP :
How do i achieve it ?
You can configure those ip addresses as rserver ip address.
Multiple rservers are tied into a group, "serverfarm".
I'm not certain about your culstered servers but I guess you can configure each ip addresses in the culster as rservers.
Then put those rservers in a serverfarm.Client accesses to a virtual ip address configured on ACE for the serverfarm.
This way connections are load-balanced among those rservers depending on load-balancing algorithm you choose.
Above is just an overveiw. ACE gives you granular control not mentioned above.
I can provide more specific information if you tell me details of what you are trying to archive with ACE.
Regards,
Kimihito.

Ace module in bridged mode with client nat

Could someone confirm whatever a NAT is supported for ACE-20 module, please?
Let me to explain technical details.
I do need to convert working CSM(SLB) config to ACE configuration and I am not quite sure
if the configuration below is correct. ACE module should be configured in bridge mode with two
vlans - vlan 36 (client) and vlan 436 (server) - bridged with interface bvi 36.
NAT on ACE configurad as "nat dynamic 1025 vlan 436" into corresponding
"policy-map type loadbalance"
Could you check two parts of configs and advise me if the ACE config is
properly converted from CSM and will be working in the same way (especialy for NAT).
Thank you in advance.
CSM config
=======
vlan 36 client
ip address 10.36.3.3 255.255.255.0 alt 10.36.3.4 255.255.255.0
gateway 10.36.3.1
vlan 436 server
ip address 10.36.3.3 255.255.255.0 alt 10.36.3.4 255.255.255.0
natpool WEB-MAIL 10.36.3.100 10.36.3.100 netmask 255.255.255.0
sticky 30 netmask 255.255.255.255 address source timeout 60
probe SHAREPOINT tcp
interval 30
failed 120
open 3
port 80
probe WEBMAIL-443 tcp
interval 5
failed 60
open 2
port 443
serverfarm WEBMAIL-443
nat server
nat client WEB-MAIL
predictor leastconns
real 10.36.3.101 443
   inservice
real 10.36.3.102 443
   inservice
probe WEBMAIL-443
serverfarm WEBMAIL-80
nat server
nat client WEB-MAIL
predictor leastconns
real 10.36.3.101 80
   inservice
real 10.36.3.102 80
   inservice
probe SHAREPOINT
vserver WEBMAIL-443
virtual 10.36.3.100 tcp https
serverfarm WEBMAIL-443
sticky 60 group 30
replicate csrp sticky
replicate csrp connection
persistent rebalance
inservice
vserver WEBMAIL-80
virtual 10.36.3.100 tcp www
serverfarm WEBMAIL-80
replicate csrp connection
persistent rebalance
inservice
ACE config
=======
probe tcp WEBMAIL-443
interval 5
open 2
passdetect interval 60
port 443
probe tcp SHAREPOINT
interval 30
open 3
passdetect interval 120
port 80
serverfarm host WEBMAIL-443
predictor leastconns
probe WEBMAIL-443
rserver 10-36-3-101 443
    inservice
rserver 10-36-3-102 443
    inservice
serverfarm host WEBMAIL-80
predictor leastconns
probe SHAREPOINT
rserver 10-36-3-101 80
    inservice
rserver 10-36-3-102 80
    inservice
class-map match-all WEBMAIL-80
match virtual-address 10.36.3.100 tcp eq www
class-map match-all WEBMAIL-443
match virtual-address 10.36.3.100 tcp eq https
sticky ip-netmask 255.255.255.255 address source 30
serverfarm WEBMAIL-443
replicate sticky
timeout 60
policy-map type loadbalance first-match WEBMAIL-80
class class-default
    serverfarm WEBMAIL-80
    nat dynamic 1025 vlan 436 serverfarm primary
policy-map type loadbalance first-match WEBMAIL-443
class class-default
    sticky-serverfarm 30
    nat dynamic 1025 vlan 436 serverfarm primary
parameter-map type http HTTP_ADV_OPT
persistence-rebalance
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
interface vlan 36
bridge-group 36
service-policy input IFVLAN36-POLICY
mac-sticky enable
no shutdown
interface vlan 436
bridge-group 36
nat-pool 1025 10.36.3.100 10.36.3.100 netmask 255.255.255.0
no shutdown
interface bvi 36
ip address 10.36.3.3 255.255.255.0
peer ip address 10.36.3.4 255.255.255.0
no shutdown

Hello F.Makarenko-
You will want to use PAT while you do nat, so change the natpool configuration to this:
   nat-pool 1025 10.36.3.100 10.36.3.100 netmask 255.255.255.0 pat
You also need to apply the nat like this:
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    nat dynamic 1025 vlan 436
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
    nat dynamic 1025 vlan 436
If you are going to build out a lot of classes, you can instead do source nat like this:
policy-map multi-match IFVLAN36-POLICY
class WEBMAIL-80
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-80
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class WEBMAIL-443
    appl-parameter http advanced-options HTTP_ADV_OPT
    loadbalance policy WEBMAIL-443
    loadbalance vip inservice
    loadbalance vip icmp-reply active
class class-default
    nat dynamic 1025 vlan 436
Regards,
Chris Higgins

Simple SLB with the ACE Module

Hello,
i have some problems with a ACE module i am currently tesing.
I have a simple Serverfarm with two Servers.
But there seems to be some Problems with the Loadbalancing i not understand:
1) I use Round Robin, but the ACE seems to put me serval times to the same server. I notice this, because i have different content on both servers, also different URLs.
2) withz the show serverfarm statement the total connects do not increment.
switch/slb-c1# show serverfarm webfarm
serverfarm : webfarm, type: HOST
total rservers : 2
----------connections-----------
real weight state current total
---+---------------------+------+------------+----------+--------------------
rserver: web1
10.0.33.201:0 8 OPERATIONAL 0 0
rserver: web2
10.0.33.200:0 8 OPERATIONAL 0 0
switch/slb-c1# show service-policy L4_LB_VIP
Status : ACTIVE
Interface: vlan 300
service-policy: L4_LB_VIP
class: L4_VIP_CLASS
loadbalance:
L7 loadbalance policy: L7_SLB_POLICY
VIP Route Metric : 77
VIP Route Advertise : DISABLED
VIP ICMP Reply : ENABLED
VIP State: INSERVICE
curr conns : 0 , hit count : 15
dropped conns : 0
client pkt count : 10198 , client byte count: 420991
server pkt count : 23367 , server byte count: 34915173
I have attatched the Config.
Any Idea what is going on?

what version do you have ?
I would recommend to run the very recent A1.4.
This is something that really should work.
Gilles.

Bizarre ACE module behavior

Hi,
I configured a new serverfarm with leastconns predictor for two servers on our ACE module Version A2(2.3). Probes (show probes XX detail) to the servers are successful and both servers are operational (show serverfarm APPLI detail) but connections are directed only to one server.
When I deactived the server which is receiving the connections (no inservice), the ACE start to direct connection to the second server.
There are several serverfarm, configured the same way, that are Loadbalancing traffic as correctly.
Here is a sample of my config
serverfarm host TEST_443
predictor leastconns
probe TEST_443_PROBE01
rserver TEST_RS01 443
    inservice
rserver TEST_RS02 443
    inservice
sticky http-cookie TEST_HTTPS TEST_443_STKY
cookie insert
timeout 720
replicate sticky
serverfarm TEST_443
probe http TEST_443_PROBE01
port 443
interval 20
passdetect interval 60
passdetect count 5
request method get url /test
expect status 302 302
connection term forced
policy-map type loadbalance first-match TEST_L7PLB_HTTPS
class class-default
    sticky-serverfarm TEST_443_STKY_SF
    insert-http X-Forwarded-Proto header-value "https"
    insert-http X-Forwarded-For header-value "%is"
policy-map multi-match SLB-HTTP-POLICY
class TEST_L4VIP_HTTPS
    loadbalance vip inservice
    loadbalance policy TEST_L7PLB_HTTPS
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    nat dynamic 1 vlan 202
    appl-parameter http advanced-options PERSIST
    ssl-proxy server TEST_SSL_PROXY_SERVER
PS : ACE uptime is 291days, could that impact ACE behavior ?
Thanks for any troubleshooting hints

Looking at this on my phone but it looks like you L7 policy is referencing a sticky server farm that does not exist.
ie TEST_443_STKY_SF is incorrect name for sticky
If that's not it. Then check that the first server actually has a number of conns on it when a new connection is established. Sometimes when both servers have 0 conns - new incoming conns will always go to the first server
Regards
Stephen
===============================
Free network configuration management software at www.rconfig.com
Sent from Cisco Technical Support iPhone App

How to Virtual IP configuration in ACE module?

Hi,
I am in the process of configuring load balancing on ACE module but struggling to configure virtual IP address for ACE module.
I'm working on ACE30 module and using software version A5 (1.2). ACE module is in slot of Catalyst 6504 switch.
Can anybody please post the steps/commands to perform this activity? An early response would be appreciated.
Regards,
Rachit.

Hi Rachit,
Here is a basic configuration example:
access-list Allow_Access line 10 extended permit ip any any
rserver host test
ip address 10.198.16.98
inservice
rserver host test2
ip address 10.198.16.93
inservice
serverfarm host test
rserver test 80
    inservice
rserver test2 80
    inservice
sticky http-cookie test group2
cookie insert
serverfarm test
class-map match-all VIP
2 match virtual-address 10.198.16.122 tcp eq www
policy-map type loadbalance first-match test
class class-default
    sticky-serverfarm group1
policy-map multi-match clients
class VIP
    loadbalance vip inservice
    loadbalance policy test
    loadbalance vip icmp-reply active
    nat dynamic 1 vlan 112
interface vlan 112
ip address 10.198.16.91 255.255.255.192
access-group input Allow_Access
nat-pool 1 10.198.16.122 10.198.16.122 netmask 255.255.255.192 pat
service-policy input NSS_MGMT
service-policy input clients
no shutdown
ip route 0.0.0.0 0.0.0.0 10.198.16.65
Here is the configuration guide:
http://tools.cisco.com/squish/101AD
Cesar R

Reuse of context in ACE module

Hi all, just have a question about som reuse of resources in a ACE module context. I don't want to make a new context, and can reuse most of the existing configuration in one of my context. The config is not complex and difficult, but I'm not sure if I can do this.
The primary goal is to loadbalance 2 webservers with a new vip, new serverfarm, stickygroup, policy-map and different nat-pool.
Since I haven't decided the ip addresses to be used, they are just xx in the config below.
The changes I want to implement are in bold. Will this work for me?
probe http WEBGUI_D2
description Probe for http mot webgui
interval 10
passdetect interval 10
passdetect count 1
request method get url /D2/auth/login.aspx
expect status 200 302
header User-Agent header-value "IDENTITY"
rserver host cwi003
description content server logon
ip address 10.163.22.27
inservice
rserver host cwi004
description content server logon
ip address 10.163.22.28
inservice
rserver host cwi503
description content server logon 2
ip address 10.163.22.23
inservice
rserver host cwi504
description content server logon 2
ip address 10.163.22.24
inservice
serverfarm host SF_LOGON_D2
probe WEBGUI_D2
rserver cwi003 80
   inservice
rserver cwi004 80
   inservice
serverfarm host SF_LOGON2_D2
probe WEBGUI_D2
rserver cwi503 80
   inservice
rserver cwi504 80
   inservice
sticky ip-netmask 255.255.255.255 address source STICKYGROUP1
timeout 20
replicate sticky
serverfarm SF_LOGON_D2
serverfarm SF_LOGON2_D2
class-map match-all VS_LOGON_D2
3 match virtual-address 10.163.22.13 any
class-map match-all VS_LOGON2_D2
3 match virtual-address 10.163.22.xx any
policy-map type loadbalance first-match PM_ONE_ARM_LB
class class-default
   sticky-serverfarm STICKYGROUP1
policy-map multi-match PM_ONE_ARM_MULTI_MATCH
class VS_LOGON_D2
   loadbalance vip inservice
   loadbalance policy PM_ONE_ARM_LB
   nat dynamic 5 vlan 1240
class VS_LOGON2_D2
   loadbalance vip inservice
   loadbalance policy PM_ONE_ARM_LB
   nat dynamic 6 vlan 1240
interface vlan 1240
description Client_server
ip address 10.163.22.11 255.255.255.0
peer ip address 10.163.22.12 255.255.255.0
access-group input INBOUND
nat-pool 5 10.163.22.14 10.163.22.17 netmask 255.255.255.192 pat
nat-pool 6 10.163.22.xx 10.163.22.xx netmask 255.255.255.192 pat
service-policy input PM_ONE_ARM_MULTI_MATCH
no shutdown
ip route 0.0.0.0 0.0.0.0 10.163.22.1
BR
Geir

Thanks for your reply.
Hope I understand you correct. This sould be the config I need to paste into the existing context.
rserver host cwi503
description content server logon 2
ip address 10.163.22.23
inservice
rserver host cwi504
description content server logon 2
ip address 10.163.22.24
inservice
serverfarm host SF_LOGON2_D2
probe WEBGUI_D2
rserver cwi503 80
    inservice
rserver cwi504 80
    inservice
sticky ip-netmask 255.255.255.255 address source STICKYGROUP2
   timeout 20
   replicate sticky
   serverfarm SF_LOGON2_D2
class-map match-all VS_LOGON2_D2
   3 match virtual-address 10.163.22.xx any
policy-map type loadbalance first-match PM_ONE_ARM_LB2
class class-default
    sticky-serverfarm STICKYGROUP2
policy-map multi-match PM_ONE_ARM_MULTI_MATCH
class VS_LOGON2_D2
    loadbalance vip inservice
    loadbalance policy PM_ONE_ARM_LB2
    nat dynamic 6 vlan 1240
interface vlan 1240
nat-pool 6 10.163.22.xx 10.163.22.xx netmask 255.255.255.192 pat
Br
Geir

ACE Module - Archiving Rserver/Serverfarm connection statistics

Similar Messages

Maybe you are looking for