Cisco ACE probe setup

Configured a Probe to check the heath of server webpage .But getting a status code of 400.
probe http PROBE_80
  interval 10
  faildetect 2
  passdetect interval 10
  passdetect count 2
  receive 5
  request method get url http://<host>:<port>/eml/HealthCheckServlet
  expect status 200 202
  open 10
getting below status code .would like to know the correct format for the requesr method of the above url
     real      : app02p[0]
                         192.168.10.6  80 VIP     161    161    0      FAILED
   Socket state        : CLOSED
   No. Passed states   : 0         No. Failed states : 1
   No. Probes skipped  : 0         Last status code  : 400
   No. Out of Sockets  : 0         No. Internal error: 0
   Last disconnect err : Received invalid status code
   Last probe time     : Tue Mar 17 02:53:58 2015
   Last fail time      : Tue Mar 17 02:27:15 2015
   Last active time    : Never

Hi Hari,
Does this URL return status 200 when you send the request directly from your browser?
You should use the exact URL here.  If the URL is fine, then check with your server team why server is responding with 400. The syntax looks fine. You can also take a pcap on server and see what is ACE sending for probe.
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Similar Messages

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • ACE: probe timers

    Hi,
    I've general question about ACE probe timers. I've following probe setup:
    probe https probe:1061
      port 1061
      interval 34
      passdetect interval 17
      open 1
    ACE# sh probe probe:1061detail
    probe       : probe:1061
    type        : HTTPS
    state       : ACTIVE
    description :
       port      : 1061   address     : 0.0.0.0         addr type  : -
       interval  : 34      pass intvl  : 17              pass count : 3
       fail count: 3       recv timeout: 10
    ===
    for above probe: when ACE will declare the server as down? will it declare it down after (17*3+34) 85 seconds or it will declare it down after 115 seconds (added recv timeout=secs 3 times = 30 seconds).
    please help.
    ========
    we did a test and bought down the server manually. ACE declared the server down after 91 seconds (from the time when server was brought down).

    Hi Gavin, Krishna,
    The explanation for all these parameters can be found in the health monitoring section of the configuration guide (
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/slb/guide/probe.html#wp1031040)
    Below are the definitions quoted from the guide:
    Interval:
    The time interval between probes is the frequency  that the ACE sends probes to a server marked as passed. You can change  the time interval between probes by using the interval command
    Faildetect:
    Before the ACE marks a server as failed, it must  detect that probes have failed a consecutive number of times. By  default, when three consecutive probes have failed, the ACE marks the  server as failed. You can configure this number of failed probes by  using the faildetect command
    Passdetect interval/count:
    To configure the time interval after which the ACE  sends a probe to a failed server and the number of consecutive  successful probes required to mark the server as passed, use the passdetect command.
    So, to summarize, taking Gavin's configuration as example. A server failure would be detected in a time between 78 seconds (2x34 +10) and 112 (3x34 +10). Once it's down, it will become operational between 34 (2x17) and 51 (3x17) seconds after it comes back up.
    I hope this helps
    Daniel

  • Cisco ACE loadbalancing matching more than one header in L7 class map

    Dear All,
    This is regarding Cisco ACE loadbalancing matching more than one header in L7 class map. I have a small setup with ACE 30 module in Cisco6500. I have got three webservers. Presently I have following configuration where I am mathing one url header.
    class-map type http loadbalance match-all L7_WEB_HEADER_MATCH
    description MATCH THE HOST HEADER OF HTTP REQUEST
    2 match http header Host header-value ".*abhisar.com*"
    So for above configuration, when traffic is coming for abhisar.com, it is working fine.
    Now, I have following headers and DNS entry is pointing to same virtual IP for all http url header same as abhisar.com
    abhisarindia.com
    indiaabhi.com
    So new configuration will be
    class-map type http loadbalance match-any L7_WEB_HEADER_MATCH
    description MATCH THE HOST HEADER OF HTTP REQUEST
    2 match http header Host header-value ".*abhisar.com*"
    4 match http header Host header-value ".*abhisarindia.com*"
    6 match http header Host header-value ".*indiaabhi.com*"
    So just want to confirm if this is fine.
    Thank You,
    Abhisar.

    Dear Rajesh,
    Thank you for reply. I will let you know once I carry out this activity.
    Thank You,
    Abhisar.

  • Slow connection in one server if accessing through Cisco ACE

    Hi,
    Good day, Can someone help me on my problem? I have 3 servers, server1, server2 and server3. When one pc accessing the server 3 application via Cisco ACE, it experienced a slow connection but when direct access without Cisco Ace, it's fast. The connection of this PC through cisco ace and direct access have no issue.
    What need to do in my configuration? Below is my configuration
    logging enable
    logging timestamp
    logging trap 7
    logging buffered 7
    logging monitor 7
    logging host 167.81.126.5 udp/514
    logging host 137.55.152.147 udp/514
    resource-class SG_01
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 10.00 maximum equal-to-min
    boot system image:c4710ace-mz.A3_2_0.bin
    login timeout 30
    peer hostname singapore-ace2
    hostname singapore-ace1
    interface gigabitEthernet 1/1
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/2
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/3
      channel-group 14
      no shutdown
    interface gigabitEthernet 1/4
      channel-group 14
      no shutdown
    interface port-channel 14
      description ISOLAN-ACE-TRUNK
      ft-port vlan 99
      switchport trunk native vlan 1
      switchport trunk allowed vlan 12,14,112
      no shutdown
    clock timezone SGT 8 0
    ntp server 137.55.152.1
    context Admin
      member SG_01
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 9 extended permit icmp any any
    ip domain-name ysn.psg.philips.com
    probe http singapore_01
      description This probe used to monitor application url-app-script
      interval 5
      passdetect interval 5
      request method get url /insiteserverstatus/insiteserverstatus.aspx
      expect status 200 200
      open 1
    probe http singapore_02
      description This probe used to monitor IIS-login-page
      interval 5
      passdetect interval 5
      request method get url /InSiteLumiledsApplication/
      expect status 200 200
      open 1
    probe icmp uplink
      description This probe used in conjunction with ft track host
      interval 2
      faildetect 2
      passdetect interval 3
    parameter-map type connection PARAM_L4STICKY-IP
      exceed-mss allow
    rserver host sggysnysn1ms013
      ip address 137.55.152.135
      inservice
    rserver host sggysnysn1ms014
      ip address 137.55.152.136
      inservice
    rserver host sggysnysn1ms018
      ip address 137.55.152.145
      inservice
    serverfarm host PLI9058
      probe singapore_01
      probe singapore_02
      rserver sggysnysn1ms013
        inservice
      rserver sggysnysn1ms014
        inservice
      rserver sggysnysn1ms018
        inservice
    sticky ip-netmask 255.255.255.255 address both SG_GROUP_01
      timeout 720
      replicate sticky
      serverfarm PLI9058
    class-map type management match-any HTTPS-ALLOW_CLASS
    class-map match-all L4STICKY-IP_141:ANY_CLASS
      2 match virtual-address 137.55.152.141 any
    class-map type http loadbalance match-any NO_MS018
      50 match source-address 137.55.155.31 255.255.254.0
    class-map type management match-any SSH-ALLOW_CLASS
      2 match protocol ssh source-address 167.81.124.0 255.255.255.192
      3 match protocol ssh source-address 167.81.126.0 255.255.255.192
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match L7PLBSF_STICKY-NETMASK_POLICY
      class class-default
        sticky-serverfarm SG_GROUP_01
        insert-http X-Forwarded-For header-value "%is"
    policy-map multi-match PLI9058-VIPs_POLICY
      class L4STICKY-IP_141:ANY_CLASS
        loadbalance vip inservice
        loadbalance policy L7PLBSF_STICKY-NETMASK_POLICY
        loadbalance vip icmp-reply
        connection advanced-options PARAM_L4STICKY-IP
    interface vlan 12
      description Client-side vlan
      bridge-group 1
      no normalization
      mac-sticky enable
      access-group input ALL
      access-group output ALL
      service-policy input PLI9058-VIPs_POLICY
      no shutdown
    interface vlan 14
      ip address 137.55.152.236 255.255.255.248
      peer ip address 137.55.152.237 255.255.255.248
      service-policy input remote_mgmt_allow_policy
      no shutdown
    interface vlan 112
      description Server-side vlan
      bridge-group 1
      no normalization
      access-group input ALL
      access-group output ALL
      nat-pool 1 137.55.152.141 137.55.152.141 netmask 255.255.255.192 pat
      no shutdown
    interface bvi 1
      ip address 137.55.152.189 255.255.255.192
      alias 137.55.152.188 255.255.255.192
      peer ip address 137.55.152.190 255.255.255.192
      description Bridge-Group 1 Virtual Interface
      no shutdown
    ft interface vlan 99
      ip address 192.168.1.1 255.255.255.252
      peer ip address 192.168.1.2 255.255.255.252
      no shutdown
    ft peer 1
      heartbeat interval 100
      heartbeat count 10
      ft-interface vlan 99
    ft group 1
      peer 1
      priority 150
      peer priority 50
      associate-context Admin
      inservice
    ft track host test1
      track-host 137.55.152.234
      peer track-host 137.55.152.235
      peer probe uplink priority 50
      probe uplink priority 50
    ip route 0.0.0.0 0.0.0.0 137.55.152.233

    Hi Earsdale,
    All the three servers are using the same configuration, so, I'm afraid it's not possible to give you a simple answer. You will need more troubleshooting.
    I would recommend you to start by checking the differences between the servers because one of those differences is certainly causing the failure.
    Also, it would be helpful to get traffic captures on the TenGig interface of the ACE to compare the behavior of the connection when going to the different servers, as well as the differences when being load-balanced vs accessing the server directly.
    If you need help with this troubleshooting, you can always open a TAC service request
    Regards
    Daniel

  • Cisco ACE dynamic rerouting (dc to dc failover)

    Good day,
    We currtenly have two dc's (site A and site B)
    We are using netapps as our SAN and we ar booting our server directly from the SAN
    SAN A and SAN B are insync and the network between site A and site B is routed.
    The challange:
    When a server is failover from site A to B it still has an ip adress that is routed to site A.(due to the SAN boot)
    We have a cold - hot design in regards to the servers (so no clustering of ESX)
    I have been reading about cisoc ACE and i think that it would solve the challange by dynamily updateing OSPF.
    Can any one please confirm that cisco ACE will solve this challlange (whitout the need for any other additional hardware)
    Thanks a lot,
    Regards,
    joli-coeur Wouter
    (CCIE Security 23078)

    It's more related to disaster recovery planning than ACE configuration
    The cleanest way is to use L2 extension.
    Otherwise you can use VMWare SRM to change the ip addresses of your VMs, or run an OSPF process and replicate all the subnets and put it in the "shutdown state" (or announcing it with a very high cost, proximity routing will do the rest - ACE module can do this for the VIPs with OSPF route health injection, ACE4710 doesn't support RHI but on the upstream router you can define an IP SLA probe and perform conditionnal redistribution), or use a dummy VRF with all your subnets and when enabling DRP, perform route leaking... use NAT with DNS-based failover etc...
    There is no generic answer to your problem.

  • ACE ; probe for host header-value

    Hi,
    we have following probe setup. sometimes this probe fails because server resets the connection but server team claims there aren't any issues with server.
    probe https probe1.abc.com:10456
      port 10456
      interval 34
      passdetect interval 17
      ssl version all
      expect status 200 200
      header Host header-value "probe1.abc.com"
      open 1
    is there a way to validate able probe using linux/linux servers? i.e. using unix/linux server is there a way to send that host header-value to the servers and see if servers are responding with 200 OK status? if not from Unix/Linux servers than if there any otherway to validate it apart from validating it from ACE?
    Thanks...

    or can we do it using window? maybe using firefox on windows machine?
    please advise.

  • Cisco ACE Inspecting RTSP Wowza Service?

    Did somebody knows if Cisco ACE in some of their HW and SW versions support Inspect for RTSP of Wowza Service running in the serverfarm? We intend to setup the service in routing mode and without a Firewall or a Web APP Firewall avoiding BW consumption in ASA/FWSM.

    Hi Samuel,
    ACE does support RTSP inspection but specific server support is not mentioned. Please see more details about RTSP inspection at below:
    http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/security/guide/securgd/appinsp.html#wp1318637
    Regards,
    Kanwal
    Note: Please mark answers if they are helpful.

  • Integrate Cisco ACE into AAA TACACS+

    Dear Community!
    I would like to configure Cisco ACE 4710 CLI and WebAmin to use ACS v4.2 TACACS+ authentication and accounting feature. After found a Cisco document, which describes ACE AAA features (http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/security/guide/aaa.html), I have setup all configuration parameters mentioned in this document, everything seems to be OK.
    But...
    I have a TACACS+ group named "Network Administrators", which has privilege level 15 option enabled, so admins do not have to type enable password when authenticating. After setting up ACE AAA, the prvilege level 15 option stops working, while logging in Cisco routers: after authentication, the user remains in privilege level 1.
    Logging in Cisco switches seems to be OK, stepping immediately to level 15 as usual.
    I tried upgrading IOS in a router, but no luck...
    Does anybody have any experiance about this "bug"?
    Thanks in advance!
    Regards,
    Belabacsi
    @ Budapest, Hungary

    Hello Bela
    In ACE on every context (including Admin and other) you should have following strings:
    tacacs-server host x.x.x.x key 7 "xxx"
    tacacs-server host x.x.x.x key 7 "xxx"
    aaa group server tacacs+ MYTACACS
      server x.x.x.x
      server x.x.x.x
    aaa authentication login default group MYTACACS local
    aaa authentication login console group MYTACACS local
    aaa accounting default group x.x.x.x
    On ACS side for group named "Network Administrators" you should configure in TACACS settting:
    1. Shell (exec) enable
    2. Privilege level 15
    3. Custom attributes:
              shell:Admin*Admin default-domain
        if you have additional context add next line
              shell:mycontext*Admin default-domain
    After loging to ACE and issuing sh users command you should see following
    User            Context                                                                 Line     Login Time   (Location)        Role   Domain(s)   
    *adm-x       Admin                                                                   pts/0   Sep 21 12:24  (x.x.x.x)    Admin   default-domain
    Regards,
    Stas

  • ACE Probe regex and escaping Parenthesis

    I'm trying to setup a ACE probe that expects a return of
    (server.domain.com) EXISTS=TRUE,AVAILABLE=TRUE,ACTIVE=TRUE
    But it doesn't appear that I can use Parenthesis inside a regex.  I've tried escaping as well.
    expect \(server\.domain\.com\) EXISTS=TRUE,AVAILABLE=TRUE,ACTIVE=TRUE
    % invalid command detected at '^' marker.   Pointing at the (
    But this doesn't work either.  Any ideas?

           Hi,
    Hi,
    If it has taken it, it should match the response from server.  Is it still not matching?
    If you look at the regex builder below, the regex matches the response which is expected from the server. So ACE should be able to match it.
    Also, you can try and put \ before dots but not sure. In my opinion it should work fine with what we have put in already. If it doesn't we will have to use hit and trial. Let me know if you need this regex builder. You can download it from google though. In any case i just attached it.

  • SMTP and IMAP ACE Probe configuration Example

    Hi,
    Could someone share he SMTPS and IMAPS probe setting configuration in CISCO ACE 4710 for my reference.
    I have two server 10.1.1.58 and 10.1.1.59 which supposed to be load balaced for the service 993 and 465.
    Regards
    BR

    Hello There,
    The ACE has built-in scripted probes in order to check connectivity beyond layer 4 with these kinds of mail servers but only for the unencrypted versions SMTP/IMAP.
    In your case since you're working with these protocols over SSL/TLS, you'll need to configure regular TCP probes for each serverfarm so reachability will be test'd based on TCP port.
    probe tcp IMAPS-993
      port 993
      interval 5
      faildetect 2
      passdetect interval 3
      passdetect count 1
      open 1
    probe tcp SMTPS-464
      port 465
      interval 5
      faildetect 2
      passdetect interval 3
      passdetect count 1
      open 1
    HTH
    Pablo

  • Cisco ACE & MARS

    Can Cisco ACE be added to CSMARS.
    MARS version is 5.3.2

    If a device not supported by MARS can send syslog in clear text format, then it can be parsed by MARS using a custom parser.
    The customer parser allows you to define new devices and applications in order that they can report to MARS.
    The reason why you need the syslog servers to work with MARS is that the more devices you can have reporting to MARS the greater the accuracy of the analysis it provides.
    In a nutshell this is how MARS works (with a tip of the cap to Dale Tesch):
    The logging data from devices is used in parallel by MARS with the information gleaned from querying network device routing tables, configurations, ARP tables, CAM tables, system probes, and other processes to determine the topology of the network and the location of devices.
    After log data is collected and the alert information is analyzed, it is cross-referenced with this topology information to determine its validity and to calculate attack paths.
    MARS was built to enhance the common data provided by syslog and SNMP. Once the data from multiple devies is summarized it can be used both as an early warning alert system and as a forensics tool to analyze successful attacks.
    Hope this helps.
    Paul

  • T3 Oracle´s proprietary tunneling protocol and Cisco ACE

    Does anybody know if it is possible to load balance the T3 Oracle´s proprietary tunneling protocol supported by Oracle Weblogic with Cisco ACE?
    TIA,
    Claudio Uemura

    HI Claudio,
    I don't know much about T3 protocol, in short you can load balance almost anything really, the issue becomes to how granular and if you can do any intelligent inspection besides source and dest ip and if there are multiple different connections on different ports. These last points sort of decide whether it's worth it.
    - If you find the specifics about the connection ( port, type of protocol and type of connection ( long-lived or short lived) you should be able to setup a basic rule to test. A sniffer trace will give you the most information if oracle website does not explain T3 in detail.
    - From a quick search there also looks to be a method to encapsulate T3 inside a http packet on weblogic servers, if this were the case then you could do some deep packet inspection with regex etc to get more granular load balancing
    http://forums.oracle.com/forums/thread.jspa?threadID=706909
    I would think it's defintely worth looking at both options
    cheers,
    Chris

  • Urgent!!! Cisco ACE and asymetric routing assistance needed

    I am wondering if someone can give me pointers on the cisco ACE
    and asymetric routes. I've attached the diagram:
    -Cisco IOS IP address is 192.168.15.4/24 and 4.1.1.4/24
    -Firewall External interface is 192.168.15.1/24,
    -Firewall Internal interface is 192.168.192.1/24,
    -F5_BigIP External interface is 192.168.192.4/24,
    -F5_BigIP Internal interface is 192.168.196.1/24 and 192.168.197.1/24,
    -host_y has IP addresses of 192.168.196.10/24 and 192.168.197.10/24,
    -Checkpoint has static route for 192.168.196.0/24 and 192.168.197.0/24
    pointing to the F5_BigIP,
    -host_y is dual-home to both VLAN_A and VLAN_B with the default
    gateway on host_y pointing to VLAN_A which is 192.168.196.1,
    -host_x CAN ssh/telnet/http/https to both of host_y IP addresses
    of 192.168.196.10 and 192.168.197.10.
    In other words, from host_x, when I try to connect to host_y
    via IP address of 192.168.197.10, the traffics will go through VLAN_B
    but the return traffics will go through VLAN_A. Everything
    is working perfectly for me so far.
    Now customer just replaces the F5_BigIP with Cisco ACE. Now,
    I could not get it to work with Asymetric route with Cisco ACE. In
    other words, from host_x, I can no longer ssh or telnet to host_y
    via IP address of 192.168.197.10.
    Anyone knows how to get asymetric route to work on Cisco ACE?
    Thanks in advance.

    That won't work because ACE uses the vlan id to distinguish between flows.
    So when the response comes back on a different vlan, ACE can't find the flow it belongs to and it drops it.
    Even if we could force it to accept the packet, ACE would then try to create a new flow for this packet and it will collide with the flow already existing on the frontend.
    You would need to force your host to respond on the same vlan the traffic came in.
    This could be done with client nat on ACE using different nat pool.
    Gilles.

  • Cisco ACE A2(2.0) - webhost-redirection

    Hello,
    We are currently running the version ACE A2(2.0), pretty old one on Cisco ACE Module.  We have applied webhost-redirection https://%h%p 302 but it doesn't seem to take effect and always go back to the host header value.
    Is it a bug or a missing feature within A2(2.0) build ?
    Please assist.
    Thanks.

    Also is there a way to check in ACE logs as to what are the redirects taking place to identify any issues etc.
    Thanks.

Maybe you are looking for