CSM Setup Review

Hi Folks-
I've recently "inherited" responsibility of our CSMs.
Unfortunately, the configs are a mess and I'm looking to clean them up a bit.
Honestly, I'm astounded they're working -albeit, not without issue.
And so, I believe I have a good approach in starting to configure these correctly .
However, I do have some immediate issues and I was hoping to solicit some feedback as to any interim workarounds.
I have one client vlan - 146 and two server vlans - 74 and 75.
Problem #1: servers in vlan 74 cannot get out to internet - network 206.212.105.0. i've done some sniffer traces and I see the connection attempts going out but return packets are getting lost. also, direct access from client network to these system are required - which works fine.
Problem #2: servers located in vlan 75 can get to the internet ok but direct access to these servers is not working.
again i ran some sniffer traces and I see the connection attempts going out but return packets are getting lost.
Observations:
1. client gateway on the MFSC is not properly defined. All traffic is traversing over vlan 1. i do not want to do this...
2. Server VLAN interfaces (74 & 75) are defined on MFSC. I believe this may be causing an issue as well.
I believe these issues are due to mis-configuration on the CSMs and the MFSC.
I was hoping to get some feedback to address the more immediate problems described above.
Thanks in advance! //C

the problem of having the MSFC in the same vlan as the CSM [vlan 74 and 75] will cause asymetric routing.
The CSM does not tolerate asymetric routing.
So, you should find a way to remove those vlans.
Create a static route on the MSFC pointing to the CSM.
However, if there are devices in these vlans that generate a lot of traffic and are not of any use to the CSM, you may end up killing the CSM [which does not have the same bandwidth as the MSFC]. Just make sure what is there and if necessary, move some devices in a different vlan.
If the return packet is getting lost when accsing from vlan 74, it could be because the subnet associated with this vlan is not know by the remote end. It should be troubleshooted at the other end to be sure.
Another solution could be to enable client nat for server initiated traffic. You could nat the traffic from vlan 74 with an ip of vlan 75 since it seems to work for this one.
For that you would create a new serverfarm like this
serverfarm route_nat
no nat server
predictor forward
nat client SPEEDPOOL
and a new vserver
vserver SERV_ACCESS_105_VLAN74
virtual 206.212.105.0 255.255.255.0 any
serverfarm ROUTE_NAT
vlan 74
idle 26400
persistent rebalance
inservice
Gilles.

Similar Messages

GSLB probes in redundant CSM setup

Hi -
When using leastloaded in GSLB setup a probe is needed to get load data from remote CSM. Is it possible to initiate probes from specific interface on CSM?
Does the secondary unit in a ft setup make own probes, or is it updated on the load from the primary?
Right now I have a situation where probes from a CSM is sent with the source IP adr. belonging in one vlan out another - there is no bridging between theese vlans.
Any help would be appreciated.

Hi Gilles -
Many thanks for your fast answer.
Yes - the way to control it is to define routing within the vlan that I want to source the address. Came to the same conclusion, and it works. What really bothered me was to discover traffic sourced from one vlan interface in another vlan (especially because it is a DMZ setup). My problem was that I had defined gateway command on several client vlan interfaces. Is there a way to se the routing table of the CSM?
Rgds Peter

CSM 4.2(5): Reoccuring failed health probes

Hi all
I've finally started to investigate an issue I have with our CSM setup. Several times a day I get the below syslog message from the 6500
10:49:11: %CSM_SLB-6-RSERVERSTATE: Module 4 server state changed: SLB-NETMGT: TCP health probe failed for server
Then a few seconds later
10:49:41: %CSM_SLB-6-RSERVERSTATE: Module 4 server state changed: SLB-NETMGT: TCP health probe re-activated server
I never seems to catch the event in action and can never verify if the real server is indeed failed or if this is only a probe timeout. I have both layer 2 and layer 3 server farms in operation and this problem occurs on all of my server farms a few times a day.
No pattern and I have no other indications of any problems. I have most of the probes set on 1 repeat and 30sec timeout. Increase the probe timeouts perhaps?
Regards
Fredrik

Those error messages are related to probing the CSM does when determining server health. For a TCP probe, this means that the CSM either gets a TCP RST from the server or it does not see a SYN-ACK coming from the server.

POWL - Review Leave request

Hi,
I have been facing an issue with POWL and review leave request. Instead of opening the overview page, it opens as if it has creation mode only when cancelling it shows the overview mode.
when cancel it goes to overview page:
As per my understanding the hress_a_ptarq_leavreq_appl has this set by default:
my configuration in powl :
no custom attributes defined
on portal side, the iview settings
any ideas how to setup review leave request through POWL?
Thank you in advance for any feedback.
Carla Sousa

Hi Siddharth,
I am very happy to see you are analysing my issue.
I have olny a doubt regarding your last answer: this is supposed to work for leave approval (that with your recommendations works fine).
Now i need to know for the task sent to employee after manager rejection - the review leave request by the employee. From my point of view, normally we would customize the task the open the overview page, but i am getting another page (create new request) before that one.
Would you kindly advise?
Thank you in advance.
Best regards,
Carla Sousa

CSM access control

I have a basic CSM setup where 2 servers are load balanced accross a CSM. How would I disable anything other than established connections for going out of the servers through the CSM's? The servers are externally managed where incoming loadbalanced (through the CSM) connections are permitted but the 3rd party should be disabled from making outgoing connections from the servers.

you could create a vserver with a vip 0.0.0.0/0, specify the server vlan with the 'vlan x' command and use a serverfarm with a fake real server with no mac-address so those connections should be dropped.
ACE has a 'drop' option which permit the same thing more easily.
Gilles.

Trend Micro Login error on System reports

I'm getting a login failed screeen from Trend Micro when the system report tries to load What password is the system looking for ?
https://services.linksys.com/lela_reporting/lela_reporting.jsp?x=PHg%2BPHU%2BbWlrcm9taWtlQGxpdmUuY29...
Mikro the Owner of the Linksys BEFCMU10_V4-UG Modem & The BEFSR41v4 Router.

You go into task then Setup & review computer reports, uncheck and clear out the e-mail address, then hit ok
then you exit network magic and go through and open windows task manager end services on NM services end task on nmctxth
then restart Network Magic and redo the first part I discribed only now enable by clicking on the box and entering an e-mail address
don't forget to confirm by checking your e-mail for the confirmation letter
then in 24hrs it'll be back up.
If that all don't work it's a current server issue and will be resolved by Monday
Mikro the Owner of the Linksys BEFCMU10_V4-UG Modem & The BEFSR41v4 Router.

Logged in to someone elses account

Having trouble logging in to my skype, I requested a password reset. When i typed my e-mail address and then choosed a new password, I was logged in to someone elses account. Can one e-mail address be used in more that one account? And how do I fix this?
I tried the Microsoft/skype support page link, but that page didn't exist...

Hi and welcome to the Skype Community,
This could happen if your email address wa associated with multiple Skype accounts. Would you mind sending me the Skype account name in question via a private message here on the Skype Community and I'll have the account setup reviewed?
Follow the latest Skype Community News
↓ Did my reply answer your question? Accept it as a solution to help others, Thanks. ↓

Have you used the new workflow features in CM 12?

In CM 12.0, users can optionally deploy the standard
approval processing or new flexible, workflow approval
processing based on the project and/or document. Have you
used the new workflow features? Do you think the new
workflows will allow your organization to better drive and
control internal and multiple party reviews?

I was one of those users who fight for this
functionality.
I find using it however very
unhandy.
Let me give you real
life examples:
1. Once you
create an order/contract and do not choose "New
Method" you cannot change approval method to new any
more. Imagine one of my users was creating an order
with 120 items (hell of typing!) then she spotted that
she cannot send it with new review process to several
reviewers in sequence. The need for retyping it makes
5 other ppl already against this software, even if
they did not used it at all.
2.
Document Owner has admin rights.
For some
reason user needs to be document owner in order to
setup review process. Imagine in our situation usual a
site assistant, or junior person in technical office
is responsible for creating and typing all the
orders/contracts. So this person needs to be Document
Owner in order start review.
Document owner
however can also approve/reject in name of other users
mentioned in review cycle. This I find strange and
make entire new review/approval cycle worthless, as
the situation is still that anyone can approve someone
on someone behalf with no control.
 3. Alerts missing. I couldn't find an alert that
would be generated if a document is held internal (by
user) for more then ... x days.
 4. I'm also missing a Project Setting for "all
documents must use new review process"; "defoult
reviewers is + 'All in sequence' + 'list of reviewers'
- for each kind of document. If
you want to force users to follow a strict
methodology, and your software gives them chance to
choose whomever they want, wherever they want, use any
approval method, approve on someone behalf ... you
will finally fail. I keep
hearing that Primavera sold thousand of licenses, and
they will develop this product, I just hope they will
hurry, before users switch to other software.

Trouble installing oracle 10

Hi, I'm trying to install oracle 10 on a computer with Linux (CentOS).
After performing the pre-installation.
When executing the instruction. / runInstaller, it generates the following error:
Exception in thread "main" java.lang.UnsatisfiedLinkError: / tmp/OraInstall2011-02-02_05-14-48PM/jre/1.4.2/lib/i386/libawt.so: libXp.so.6: can not open shared object file : No such file or directory
I searched for a solution several forums but have not found anything yet, I hope I can help.
Thank you very much.

thanks Dude:
I had forgotten to make system setup, review the packages must be pre-installed, before running the oracle installer. I forgot as it had done previously but for oracle 11, then I got confused and let this pass as ready, I did not check that the packages were already installed.
Thank you very much for your response, it was just what I needed.

TRI FIRE 6950 WITH HYDRA LOGIX

i have a big bang marshall - tri fire 6950 --- > ...how do i enable hydra logic - and will it make a diff increase performance some how or not ..
or if i add another e.g gt-430 or gtx-250 to this set up will i get better performance then before
pls help

Unless somone that has actually done that can give you his/her experience with such a setup, you will not get a definite answer. My humble opinion is that your performance will probably start decreasing, as your available PCI-E lanes available on the processor have to be shared between more resources and would probably become a bottleneck, defeating the oject of any hypothetical gains.
Just search the net for 4 GPU card setups/reviews and see if there are results.

Shared Review comment server setup issues

I've been having some issues setting up a comment server/repository for Shared Reviews in Acrobat 8 (for our all-Mac network). I've done extensive research on how to set up a Network Folder and a WebDAV folder (since those are the only two supported methods in Acrobat 8).
- For the Network Folder setup, I created a folder on one of the machines on our network and shared it using SMB. When specifying that location (using smb://IPAddress/Folder/), Acrobat either 1) brings up a login screen, into which I enter the proper credentials, and after pressing OK, it says the connection could not be made, or 2) it verifies the shared folder location, but when I make comments and then choose Publish Comments, a red box appears saying something to the effect of "cannot access IPAddress, will keep trying."
- I also tried using WebDAV. Solutions I found online mostly consisted of using the Terminal to access system files and entering numerous lines of code. I pretty much had to learn about WebDAV from scratch today in order to get the Shared Reviews process set up, but I feel like there is something I'm missing regording its implementation.
I suppose this post can be boiled down to three questions:
1) What is the best way to set up a Shared Review system, and how can it be done in the simplest manner possible?
2) What am I missing from my knowledge of Network Folders and WebDAV folders in this regard?
3) Would functionality be benefited by simply upgrading to Acrobat X?
Thank you all in advance for your responses and help. If there is any more information required in order to provide a solution, please let me know.

The roundcube db schema needs to setup manually. See /usr/share/webapps/roundcube/INSTALL
Also, from your /etc/webapps/postfixadmin/config.inc.php:
$CONF['domain_path'] = 'NO';
$CONF['domain_in_mailbox'] = 'YES';
$CONF['maildir_name_hook'] = 'NO';
..which results in /var/mail/vmail/[email protected]
From your dovecot.conf
mail_home = /var/mail/vmail/%d/%u
...which results in /var/mail/vmail/domain.com/user
That doesn't fit together.

Error: Ship to/Bill To Address is Invalid. Please review the Address Setup

After Upgrading to 12.1.3, Orders are failing during Import/Scheduling with "Error: Ship to/Bill To Address is Invalid. Please review the Address Setup" whenever Tax Engine is called. And this is happening for only specific addresses (that are vaild). I will appreciate any experience/suggestion on this regard.
Thanks,
Dipanjan

--- Here's a skeleton structure of the PLSQL that you should use----
l_location_rec          APPS.HZ_LOCATION_V2PUB.LOCATION_REC_TYPE;
-----Use this to find a good address from existing TCA in Oracle, by passing only the zip code:
SELECT hgi.identifier_value,hg.geography_element4_id
                   ,hg.geography_element1 country
                   ,hg.geography_element2 state
                   ,hg.geography_element3 county
                   ,hg.geography_element4 city
                   ,hg.geography_element5 postal_code
             FROM apps.hz_geographies hg,apps.hz_geography_identifiers hgi
            WHERE hgi.geography_id = hg.geography_element4_id
              AND hg.geography_name = :pp_zip_code
              AND hg.geography_type = 'POSTAL_CODE'
              AND primary_flag='Y';
-----The Update the Location
             l_location_rec.CITY := rec_get_geo_elements.city;
             l_location_rec.COUNTY := rec_get_geo_elements.county;
             l_location_rec.STATE := rec_get_geo_elements.state;
               hz_location_v2pub.update_location (p_init_msg_list           => FND_API.G_TRUE,
                                       p_location_rec            => l_location_rec,
                                       p_object_version_number   => l_object_version_number,
                                       x_return_status           => l_return_status,
                                       x_msg_count               => l_msg_count,
                                       x_msg_data                => l_msg_data);

Using the CSM to setup a HTTPS session on non-standard ports?

Hi Guys,
One of our clients wants to setup an SSL connection on a non-standard SSL port i.e. 4444 to begin with. Here the sever handles the SSL encryption / deccryption) instead of the SSL module.
I've found the following config to work well:
serverfarm FARM-MOBS-4444
nat server
no nat client
predictor leastconns
failaction purge
real 130.194.12.81 4444
inservice
real 130.194.12.84 4444
inservice
probe MOBS-4444
sticky 108 netmask 255.255.255.255 timeout 60
vserver VMOBS-PROD-4444
virtual 130.194.11.51 tcp https
serverfarm FARM-MOBS-4444
sticky 60 group 108
persistent rebalance
inservice
With the above setup the CSM redirects the SSL connections (recieved on 443) to port 4444 on the sever and maintains this for the duration of the session.
While the above setup works, is it possible to configure the VIP to use a HTTPS port other than 443 (which is default)? This would then allow for separate HTTPS paths to be setup on non-standard ports. I ask this since the client also wants to setup a HTTPS path on port 4443 as well.
Any ideas would be useful.
thanks
Sheldon

Hi Martin,
Do you mean using the SSL module to perform the encryption / decryption? If so i've tried this and it does work without an issue.
I was just wondering if it were possible to have a VIP setup where the HTTPS port is not 443 but say 4443, where the encryption / decryption is done by the real servers themselves.
thanks
Sheldon

Cant setup itunes, I am trying to review but I am not having any credit/debit cards. So please help me in review my account and allow to download apps from itunes

Dear Sir/Madam,
Please help me in completing the review of my account with I tunes and allow me to download apps for my iPad mini 2.
Sine there is no debit/credit cards available with me, please suggest any alternative process for review my account.
Kindly help in this regard.

Unless the instructions on this page are followed when creating an account : Create an iTunes Store, App Store, or iBooks Store account without a credit card or other payment method.
then credit card details will need to be entered before the account can be used to download any item from the store.
You could see if this post by mountaingoatgirl lets you review your account without needing to enter credit card details : https://discussions.apple.com/message/24303054#24303054
If not, and as you say that you don't have a credit or debit card (though not all debit cards appear to be accepted anyway) then you will need to create a new account, and use the instructions on the about 'create an iTunes ...' page when creating it.

New Install Pending, please review setup

Hello Everyone:
I'm posting this to get feedback on a proposed installation of OS X Server SL running on the on the newer mac mini platform. My main area of concern is to ensure that the DNS settings are correct from the get go. The server is actually already in production mode, but there are all kinds of problems with it and that's why my client found me, so the problems can disappear.
In evaluating the server it looks like most of the issues are related to bogus DNS settings and it looks like the server is too far along to be fixed without a reinstall, so I want to post my proposed settings ahead of time and get any feedback I can, save me as much head scratching as possible when the reinstall goes down.
Firstly, Intended Use:
The server is intended to make various lightweight services available to a group of around 10-15 users - most users spend 80-90% of their work time in office, but at least 4 users work out of the office and their homes, and 2 of these are also on the road constantly. In addition to those users there are about 5 or 6 users who a permanent teleworkers who live out of state.
The services desired to be used are:
-Open Directory management for all corporate users, local, mobile, and remote
-a contacts db shared by all users, regardless of location
-a calendaring system that everyone can read/write to, from any location (additionally some clients will not be mac/iCal clients, they will be windows based and need to participate in the calendaring service)
-Wiki site authoring to house internal documents, procedures, ETC
-file service to serve up available backup partitions to client machines (for both macs and PCs)
-VPN service for remote users, (mostly for connection to the backup service)
-Mobile Access, or else some other suitable configuration for remote users to connect to the iCal, AddressBook and Wiki services
At the moment we DON'T intend to run any mail exchanger services, nor any production websites
Initial Setup:
-Mac Mini SL Server connected via ethernet to Dual Band Time Capsule
-Time Capsule connected to broadband connection with one static IP from ISP
-Time Capsule NAT is enabled forwarding relevant ports on to Mac Mini SL Server
-Time Capsule handles DHCP:
--DHCP Reservation for MM SL Server: 10.0.1.11
--LDAP Server points to: 10.0.1.11
--DHCP pool ends at .200 (.201+ reserved for VPN clients)
-Additionally, Time Capsule DNS points to 10.0.1.11, domain name set to <Mac Mini SL Server FQDN> (to be figured out below)
Mac Mini SL Server, Network and DNS:
---One quick note, initially this company had just a dynamic IP for the broadband connection, and I was going to set up a dyndns dynamic domain name for them that pointed to their current IP via dyndns client daemon, but since I have to go for the full reinstall the company has elected to use one of its spare registered domain names
-Mac Mini's network adaptor's DNS is set to loopback, 127.0.0.1
From this point - things get rather specific:
In Server Admin under Zones, I shouldn't need a complex set of records but I have had a real hard time figuring out what the proper configuration for the primary zone and the FQDN.
On the outside of the local network where the MacMini server lives - we have an ISP provided static IP, and additionally we have a registered domain with points to the ISP static IP - since this is a registered domain part of my confusion is in whether the MacMini's FQDN ought to be the same as our registered domain on the outside. The registered domain is what folks on the outside will use to connect to the server's services on the inside.
Here I will attempt to outline my proposed DNS settings, which I am hoping some of you will be kind enough to give me feedback on:
-Registered Domain Name: thecorpteam.com
---Primary Zone
-Primary Zone Name: thecorpteam.com.
-Nameservers: Zone: thecorpteam.com. Nameserver Hostname: thecorpteam.com.
--Machine Record
-Machine Name: server
-IP Addresses: 10.0.1.11
--Machine Record
-Machine Name: thecorpteam.com.
-IP Addresses: 10.0.1.11
---Reverse Zone
-Reverse Zone Name: 1.0.10.in-addr.arpa.
-Nameservers: Zone: 1.0.10.in-addr.arpa. Nameserver Hostname: thecorpteam.com.
Additionally under the DNS Settings Tab
-Accept recursive queries from the following networks: is set to 'localness'
and
-Forwarder IP Addresses: is set to the ISP's DNS servers
These are the settings that I THINK will work, but I'm not sure by a long shot so please jump in if you see anything amiss.

So under the Nameservers for the Primary (and the Reverse that is created) the Nameserver Hostname ought to be the local server the IP for the local server should be sufficient for this?
Running through the full loop and in relatively general terms... Domains and subdomains are organized into zones. Zones have name server(s). Name servers themselves usually host names, sometimes within their own zones and sometimes within the zone of another name server or pool of name servers. Host names also have IP addresses. DNS server references within the clients will reference and will use the IP address(es) for the name servers, as they don't (yet) have a name server to translate the names.

CSM Setup Review

Similar Messages

Maybe you are looking for