Cannot create L7 Class

Question

My load balancing is not working, I believe it is due to the fact that the class map i have created for L7 is not being treated as an L7 class map.
From doc: "The ACE treats as a Layer 3 and Layer 4 policy any policy map that ... has the default class configured as the class map, and there are no Layer 7 policy actions configured"
This is what I have configured so I must change it. However, it is not http or ftp (it's LDAP). Here is my attempt..
class-map match-any L7_Class
description L7 class map for VIP-A
2 match port tcp eq xxx
ace/Context1(config)# policy-map type loadbalance first-match L7_Policy
ace/Context1(config-pmap-lb)# class ?
class-default Specify actions for default class-map
ace/Context1(config-pmap-lb)# class L7_Class
Error: Specified class-map is not consistent with the policy-map type
ace/Context1(config-pmap-lb)# exit
ace/Context1(config)# class-map type ?
ftp Configure ftp class-map
http Configure http class-map
management Configure management traffic class-map
How can I get this to work?

Answer 1

Hi Gilles,
As far as I can tell that is what I have, but it is not working.
rserver host M-Old
ip address 1.1.8.11
inservice
rserver host M-Old-2
ip address 1.1.8.12
inservice
rserver host S
serverfarm host A
rserver M-Old 389
backup-rserver M-Old-2 389
inservice
rserver M-Old-2 389
class-map match-any Class
2 match virtual-address 1.1.3.13 tcp eq 389
! not in use
class-map match-any L7_Class
description L7 class map for VIP-A
2 match port tcp eq 389
policy-map type loadbalance first-match A_L7_Policy
class class-default
serverfarm A
policy-map multi-match VIP-A
class Class
loadbalance vip inservice
loadbalance policy A_L7_Policy
loadbalance vip icmp-reply active
loadbalance vip advertise active
interface vlan 500
ip address 1.1.2.7 255.255.255.240
no shutdown
interface vlan 511
ip address 1.1.3.12 255.255.255.248
service-policy input VIP-A
no shutdown
ip route 0.0.0.0 0.0.0.0 1.1.2.3
ip route 1.1.8.0 255.255.255.0 1.1.3.11 (real server subnet)
ip route 1.1.7.0 255.255.255.0 1.1.3.11 (source of request)
vcp-sd-ace-1/CUR# sh service-policy
Policy-map : IDV_VIP-A
Status : ACTIVE
Interface: vlan 511
service-policy: IDV_VIP-A
class: IDV_Class
loadbalance:
L7 loadbalance policy: IDV-A_L7_Policy
VIP Route Metric : 77
VIP Route Advertise : ENABLED-WHEN-ACTIVE
VIP ICMP Reply : ENABLED-WHEN-ACTIVE
VIP State: INSERVICE
curr conns : 0 , hit count : 0
dropped conns : 0
client pkt count : 0 , client byte count: 0
server pkt count : 0 , server byte count: 0
vcp-sd-ace-1/CUR# sh stat
+------------------------------------------+
+------- Connection statistics ------------+
+------------------------------------------+
Total Connections Created : 184
Total Connections Current : 0
Total Connections Destroyed: 0
Total Connections Timed-out: 184
Total Connections Failed : 0
vcp-sd-ace-1/CUR# sh tcp stat
TCP statistics:
Rcvd : 822 total, 0 errors
Sent : 0 total, 0 RST flag segments
0 active opens, 0 passive opens
Connections: 0 attempts-failed, 0 established resets, 0 currently establised
the real server has nothing in it's tcp dump for the connection. The session in in SYN_SENT. The client can ping the VIP, and i can ping the real server from the context. Is it not binding (LDAP) because of something to do with NAT? It NATs by default right? and you turn it off with transparent command? The client must get the response from the VIP, not the real, for the bind to occur.
And yes, I am confused (and tired)! :)
Any thoughts?