CSM in Bridge mode and Server initiated connections

I know one can use Source NAT for server initiated connections back to VIP using CSM in routed mode. How do I achieve the same for bridge mode?
Thanks in advance,
Shahid

Shahid,
that's a well-known problem for all loadbalancer in the world.
With a sniffer trace, or just thinking about TCP/IP rules you can figure out why client nat is required.
If you go from a server to a vip, the CSM will forward the traffic to a random server.
The CSM forwards the traffic with the source ip unchanged by default.
The server receiving the traffic will forward the response back to the source that initiated the request.
If the source is also a server in the same subnet, the response does not need to be sent through a gateway. Since both source and destination are in the same subnet, the traffic is sent based on mac address and it bypasses the CSM which can't perform the nating.
The source receiving the response from the server directly will just ignore it.
Using client nat forces the response to go back to the CSM which can perform the nating before sending it to the client.
This has been discussed tons of times in this forum.
It's a classic question :-)
Gilles.

Similar Messages

  • CSM in Bridge mode and STP

    How CSM deals with the situation when both modules become active? How can I configure CSM to passthrough STP BPDUs to break loops? I know how can I do it on FWSMs but wondering if there is a way to do it on CSM or there is no way to avoid loops when FT vlan is dead.

    There is no way to let BPDU go through and there is no way to avoid loop if the FT vlan goes down.
    You have to make sure it never goes down by using etherchannel and any other possible solution.
    Gilles.

  • CSM: server-initiated connections

    Hello
    I hope you can help me to figure out this question, I have a CSM module with more than 10 serverfarms, all of them working fine, and all of them are on different vlans. We are using route mode for all of them.
    For example:
    ServerFarm01-> Vlan10
    Client_Side01-> Vlan11
    ServerFarm02-> Vlan20
    Client_Side02-> Vlan21
    ServerFarm03-> Vlan30
    Client_Side03-> Vlan31
    and so on...
    I noticed something, When I generate outbound traffic from a real server, it does not matter it belong to SeverFarm01, 02 or 03; the packet leaves the CSM using alway the vlan31.
    Can you please help to determine what’s going on?
    Actually, we want realservers from ServerFarm01 to sent traffic to internet through the CSM, and those traffic should be seen on vlan11.
    Thankds and Regards
    Edgar

    Hi Edgar,
    Few things to check.
    Check if the servers has two interface. It may be sending traffic through other interface.
    Please go through below configuration guidelines that will help you to associate Particular serverfarm with their respective VLAN.
    Configuring Server-Initiated Connections
    The NAT for the server allows you to support connections initiated by real servers and to provide a default configuration used for servers initiating connections that do not have matching entries in the server NAT configuration. By default, the CSM allows server-originated connections without NAT.
    To configure NAT for the server, perform this task:
    Command
    Purpose
    Step 1
    Router(config)# static [drop | nat
    [ip-address | virtual]]
    Configures the server-originated connections. Options include dropping the connections, configuring them with NAT with a given IP address, or with the virtual IP address that they are associated with1 , 2 .
    Step 2
    Router(config-slb-static)# real ip-address
    [subnet-mask]
    Configures the static NAT submode where the servers will have this NAT option. You cannot use the same real server with multiple NAT configuration options.
    1 Enter the exit command to leave a mode or submode. Enter the end command to return to the menu's top level.
    2 The no form of this command restores the defaults.
    For Example :
      static nat 199.200.9.140  ( IP can be virtual IP as well)
       real 192.168.24.0 255.255.252.0
       real 192.168.20.0 255.255.252.0

  • After attempting to update to ios 7, my iphone is stuck in recovery mode and will not connect to the itunes software server.

    After attempting to update to ios 7, my iphone is stuck in recovery mode and will not connect to the itunes software server.  I have already tried the resetting with power swich and home button and plugging into computer but it says the "iPhone software update server cannot be contacted."  I am locked out of my phone.  Does anyone have any idea how to resolve this issue and get the phone working again.  I will add that I am now trying to restore it on a different computer with a lower version of itunes, but the computer that it initially happened on had the updated itunes and gave me the same result ... nothing.  Thanks for your help in advance.

    Try going to recovery mode as described here.  You may have to try this more than once to succeed.
    Use the original iTunes that the iPhone synced with.
    http://support.apple.com/kb/HT1808

  • Adding direct server access to CSM in bridge mode

    I have a CSM that I have set up in bridge mode and want to allow direct management access to the real servers.
    It looks like this. MSFC 10.1.100.1
    CSM 10.1.100.3
    Reals 10.1.100.10
    10.1.100.20
    10.1.100.25
    Virtual 10.1.100.130
    10.1.100.140
    I tried to use the same method that I found for routed mode on CCO.
    Serverfarm SERVER-SUBNET
    No nat server
    Predictor forward
    Vserver DIRECT-ACCESS
    Virtual 10.1.100.0 255.255.255.0 tcp any
    Serverfarm SERVER-SUBNET
    Inservice
    The next step in the documentation says to add a static route to the CSM
    Ip route 10.1.100.0 255.255.255.0 10.1.100.3
    But this does not make since since the MSFC 10.1.100.1 address is already the default gateway.
    So is there another way to configure bridge mode and enable direct management access?

    After I thought about bridge mode again and took out the direct-access and server-subnet commands. I tested again and I can now directly access the servers.

  • Bridge mode and router mode

    hello,
    I want to understand the basic operation, difference and advantages of both Bridge Mode and Router mode?
    i also want to know in which case i should go for Bridge mode and Router mode?
    regards
    Devang

    It realy depends on your requirements.
    Mainly bridge mode is used for multicast support, Multiple DMZs + FWSM, server initiated connections or for seemless migration from previously installed "bridged load balancing environment".
    Some of the differences are
    In bridge mode you do not need additional config for "Direct server access" / "Server Initiated connections"
    Broadcasts are dropped in routed mode whereas they are bridged in bridge mode.
    LB functionality is same in both modes.
    Syed Iftekhar Ahmed

  • Using an airport extreme in both bridged mode and guest network with DHCP

    I currently use a third-generation airport extreme in bridge mode to connect my various Mac servers To the Internet. I'm using bridge mode on the AirPort Extreme because I have up to five static IP address (only using three now) I am currently not using the wireless network, and none of the servers are serving DHCP. I am looking at the Newer airport extreme with guest network Wi-Fi. My question is, does the new airport extreme base station support bridge- mode for any devices and host DHCP for the guest network connecting wirelessly to the base station?

    The AirPort Extreme cannot be in Bridge Mode and support a Guest Network.
    The AirPort must be configured to provide DHCP and NAT services if you want to enable the Guest Network function.
    If you really do have a 3rd Gen AirPort Extreme, it will support the Guest Network feature if you connect the AirPort directly to a simple modem.....not a modem/router or gateway type of devices.......and configure the AirPort to provide DHCP and NAT services for the network.

  • Question about TC setup, bridge mode and security...

    Hello All
    I need some help...
    Have bought a 1 Tb TC to use with my existing ethernet/wireless all-Mac home network but have some specific queries.
    The system is set-up as follows:
    Cable modem > connected by ethernet cable to > 8-way Ethernet switch
    Connected via ethernet cable to the 8-way switch are: one MacBook (in another part of the house) and the TC (via its WAN socket).
    Elsewhere in the house, and _all connected wirelessly_ are:
    iMac G5
    Powerbook G4
    hi-fi (connected via an Airport Express)
    Airport Extreme basestation to which a HP Laserjet is connected via ethernet.
    Question:
    Before buying the TC, I used a spare Airport Express basestation in its place to act as the 'main' basestation and the IP addresses of each device on the network were 10.0.0.1, 2, 3, etc. I had the impression that my home network was not "seen" by the outside world as a consequence of this.
    Now, the TC seems only to work when in 'bridge' mode and it seems that the IP addresses are 196.xxx.x.100, 101, 102 etc. Does this mean that these devices are now visible to the outside world. Have I compromised my network security? I am worried that the outside world may have access to the contents of my TC, although my TC is password protected and the wireless network is 'closed'. What else should I be doing?
    Finally, should I have set up the network so that the cable modem feeds to TC directly, with the 8-way ethernet switch coming off one of the ethernet sockets on the TC?
    In all honestly, the instructions in the manual and the help guide are less than clear.
    Can anyone help?
    Thanks
    Daniel

    Section 4, here are my thoughts.
    1. Since you are currently seeing individual IP addresses like 196.xxx.xxx.100, etc., it sounds like your modem is also acting as a router. This also seems to be the case since the Time Capsule is only working in bridged mode (it wouldn't work in Share a Public IP address if another device is assigning private DHCP addresses). Now, you could still allow the Time Capsule to act as a DHCP server on your private network by enabling Connection Sharing as Distribute a range of IP addresses. This will create a private network within your private network where all the devices that are connected to your Time Capsule can see each other. If you leave it in bridged mode then you allow your cable modem to assign DHCP addresses and all devices that are connected to the Time Capsule or to your ethernet switch are on the same network.
    2. Assuming your cable modem is acting as a router you shouldn't have to worry about security, although you will have to access your modem's settings to make sure port forwarding isn't enabled and that the firewall is turned on (although I'm sure it is). I personally would plug the ethernet switch into the LAN port of the Time Capsule and allow the WAN port of the Time Capsule to be plugged into the cable modem. I also would just leave the Time Capsule in bridged mode as well, that's what I do for my own personal network.

  • HT201412 my phone goes in to recovery mode and flash logo connect to itune, when i connect to itune the msg disply update software and i click that than dwnld software to itune, when software dwnld and installing to my phone after smtime msg disply "error

    my phone goes in to recovery mode and flash logo connect to itune, when i connect to itune the msg disply update software and i click that than dwnld software to itune, when software dwnld and installing to my phone after sometime msg disply "errore no. 21" and software not install to my phone

    From TS3694:
    Error 20, 21, 23, 26, 28, 29, 34, 36, 37, and 40
    These errors typically occur when security software interferes with the restore and update process. Use the steps to troubleshoot security software issues to resolve this issue. In rare cases, these errors may be a hardware issue. If the errors persist on another computer, the device may need service.
    Also, check your hosts file to verify that it's not blocking iTunes from communicating with the update server. See the steps under the heading "Blocked by configuration (Mac OS X / Windows) > Rebuild network information > Mac OS X > The hosts file may also be blocking the iTunes Store." If you have software used to perform unauthorized modifications to the iOS device, uninstall this software prior to editing the hosts file to prevent that software from automatically modifying the hosts file again on restart.

  • How to Configure Transparent caching on Cat 6500 with CSM in bridge mode?

    hi.
    I found How to Configure Transparent caching on Cat 6500 with CSM in routed mode.
    But,
    I need help How to Configure Transparent caching on Cat 6500 with CSM in bridge mode?
    Please let me know sample configuration.
    thanks.

    Hi,
    I wrote the document you mentioned and I also wrote the one below.
    http://www.cisco.com/en/US/partner/products/hw/modules/ps2706/products_configuration_example09186a00802c1201.shtml
    The one with the SSLM is a bridge mode config.
    If you replace the SSLM with a cache [or a farm of caches] it would be a similar config.
    Replace the SSL21 vserver with an HTTP vserver [most important is to keep the vlan configured on each vserver]
    Regards,
    Gilles.

  • ACE in bridged mode and multicast

    We have configured an ACE SM in bridge mode and have a requirement to enable multicast on one of the networks where the back-end servers are residing. Will ACE support multicast out of the box, or will we need to do any tweaking on the ACE to enable the multicast support?
    Thanks..

    Hi Gilles,
    Is it also supported in routed mode?
    The ace isn't doing multicast routing right?
    Actually, the server-side vlan is being routed on the C6500 and has pim sparse-dense mode enabled.
    We want to move this server-side vlan behind the ace in routed mode. What about the pim?
    Any ideas?
    thanks,
    Dario

  • Can a single Access Point support both bridge mode and Access Point mode at the same time

    Hi Guys
    Does anyone know which access point can work in both bridge mode and AP mode ?
    Cheers

    Well what are you trying to cover. If its really a large outdoor area, then look at the mesh AP. Those require a WLC. Autonomous or stand alone ap can perform bridging on one radio and client access on another. You can also look at AP that support indoor mesh that also controlled by a wlc. If your putting APs outdoors, then look at the outdoor mesh.
    Thanks,
    Scott Fella
    Sent from my iPhone

  • I tried to up date my i phone 4 to iOS 5 then it wiped my phone and now it tells me to connect to iTunes and that the iPhone is in recovery mode and when i connect it goes to preparing to install to iPhone but never goes any further how do i restore

    i tried to up date my i phone 4 to iOS 5 then it wiped my phone and now it tells me to connect to iTunes and that the iPhone is in recovery mode and when i connect it goes to preparing to install to iPhone but never goes any further how do i restore the phone

    by reset option do you mean the DFU restore? worked for me, have you tried that?
    if not - hold the lock and home button until the power down bar comes up. then hold the lock button for ten seconds - next continue to hold the lock button and press the home button for ten seconds - next release the lock button and hold the home button for 10 seconds. this should be done with the phone tethered. If done right and your itunes is configured as such, the phone will reload the drivers and start up itunes, and then prompt for a restore/update.

  • My iphone 5 is in recovery mode and won't connect to itunes

    I was trying to update my phone using itunes but now my iphone 5 is stuck in recovery mode and won't connect to itunes.

    Hello nancarter97,
    Thank you for the details of the issue you are experiencing with your iPhone 5.  I would be concerned too if my iPhone was stuck in recovery mode and not recognized in iTunes so that you can restore it. 
    I recommend the following article for the issue you described and specifically this step:
    5. Use iTunes to restore your device.
    If you don't see your device in iTunes, follow these steps for Mac or these for Windows.
    Find the full article here:
    If you can't update or restore your iOS device
    http://support.apple.com/kb/ht1808
    Thank you for using Apple Support Communities.
    Best,
    Sheila M.

  • I try to update my iphone 4 to ios 7.1.1. But now my iphone stucks in recovery mode and can't connect to itune. i use windows 7

    I try to update my iphone 4 to ios 7.1.1. But now my iphone stucks in recovery mode and can't connect to itune. i use windows 7

    Try the iTunes troubleshooting advice here:
    Windows - http://support.apple.com/kb/ts1538

Maybe you are looking for

  • If all the songs in my playlist I want to burn are mp3 format, will iTunes automatically create an mp3 CD? I want the CD to be in a format that most CD players can play.

    I didn't know I would have to add more. What I need to know is in the title. If all the tracks in a playlist are mp3 encoded, will iTunes assume that I want it to burn an mp3 disk? What I really want is a CD that plays in most CD players everywhere,

  • Can't Run SCOM Report From Link

    We have a report subscription that sends out an email to a distribution list. Even though I've added the users to the SCOM roles "Report Operator", "Read-Only Operator", and "Operator" they get rsaccessdenied. The absolute only way I've found that th

  • GPIB timeout

    I'm using a GPIB to collect data from a Tektronix Oscilloscope and everyday when I come in and try to collect it gives me this error HEX 0XBFFF0A6. I'm using windows 7 and LabView 2011. Each time I just restart LabView and it works just fine througho

  • VC Transport WS References

    Hi guys, I would like to ask how the transported VC models work when I transport them to a QA system using NWDI, the thing is that I have several WebServices in my models that I get from the service registry, every WS that I call in my VC are called

  • Flash Bulilder 4.7 cannot install

         I cannot install Adobe Flash Builder trial version (my pc: Windows 8, 64x, downloaded file FlashBuilder_4_7_LS10_win64.exe) ????