CSS 11000 Clients' Src IP replaced with VIP's IP

Dear all,
Topology:
10.1.101.X/24 ---CSS11000--- 10.1.103.X/24(Server Farm)
Configuration:
########### Service ###########
service LBS_AP-11:11111
ip address 10.1.103.11
keepalive type tcp
keepalive port 11111
port 11111
active
service LBS_AP-12:11111
ip address 10.1.103.12
keepalive type tcp
keepalive port 11111
port 11111
active
########### Owner ###########
owner Customer-6
content LBS_AP-10:11111
vip address 10.1.103.10
add service LBS_AP-11:11111
add service LBS_AP-12:11111
port 11111
protocol tcp
active
Problem:
We notice that the traffic's Src IP address from the Client side(10.1.101.X)has been replaced by the CSS's VIP address = 10.1.103.10 (through Sniffer)
Is that correct or reasonable ?
The configuration was implemented by another Cisco Partner.
Our customer wants me to find out why they cannot see the Client's IP address as the Src IP address when the traffic is from 101.X to 103.X
Is there still anything that I have to provide to you experts, plz let me know this.
Appreciate ^__^
CSS# show version
Version: ap0610107a (6.10 Build 107)
Flash (Locked): 6.10 Build 107
Flash (Operational): 6.10 Build 107
Type: PRIMARY
Licensed Cmd Set(s): Standard Feature Set

Dear Gilles,
Yes, we do have a group statement as follow:
########## Group ##########
group LBS
vip address 10.1.103.10
add destination service LBS_AP-11:11111
add destination service LBS_AP-12:11111
active
The question is . . . when we remove the group statement as mentioned above, the patron can finally see the traffic definitely from the client side(101.X/24) and destined to the VIP(10.1.103.10).
But, unfortunately, there are some DB servers on the same side of the Server Farm(103.X) having no access to the VIP(10.1.103.10).
(They could & did access to the VIP when the group statment was configured.)
What can I do now for this situation?
I am totally confused with "sourcegroup", "one-armed scenario",& "ACL".
The patron said they want to see the true Src IP addresses from 101.X and still have the DBs on the 103.X network access to the VIP 10.1.103.10.
DBs IP Addresses range from 10.1.103.15 to 10.1.103.20, etc.
If there is still anything that I should provide to you experts, plz let me know that.
Appreciate ^__^
########## Relevant Configuration ##########
circuit VLAN101
redundancy
description "SC-SAA-3548 VLAN101"
ip address 10.1.101.30 255.255.255.0
circuit VLAN103
redundancy
description "SC-SAA-3548 VLAN103"
ip address 10.1.103.254 255.255.255.0
acl 20
clause 10 permit tcp any destination any
clause 20 permit any any destination any
apply circuit-(VLAN101)
apply circuit-(VLAN103)
Best Regards
Sincerely,

Similar Messages

CSS One Arm Configuration with VIP(non-shared)/IP Interface Redundancy

With Reference to the following CCO documentation;
1). "How to Configure the CSS to Load Balance Using 1 Interface"
In this example, the Real Server's (10.10.10.2 etc) gateway are pointed to the router's gateway(10.10.10.1) and used the 'add destination service' command to NAT the RealServer's IP address back to the VIP (10.10.10.6).
2). "Understanding and Configuring VIP and Interface Redundancy on the CSS11000".
In the interface redundancy configuration, the gateway of the Real Server are configured as the CSS11000's Interface Redundancy Address (192.168.1.1), not the Router's gateway.
Can anyone help to advise on the preferred one arm configuration with VIP/IP redundancy?
(i). Is the reason for configuring the gateway of the Real Server to CSS11000's Interface Redundancy Address in 2) same as using 'add destination service' command in 1)? That is to make sure that the return path from Real Server back to Client passes through the CSS and is NAT back to the VIP.
(ii). To configure VIP(non-shared)/IP Interface redundancy(Active/Backup Mode) in a one arm configuration, my understanding is that there are 2 methods of configuration. Is it correct? Which method is preferred?
Method a)
1.Configure the Real Server's gateway to Router's Gateway
2.Configure 'add destination service' command on the CSS to NAT the RealServer's IP address back to the VIP
3.Configure VIP(non-shared) redundancy for the VIP on the CSS
4.IP Interface Redundancy on the CSS is not required as the Real Server's gateway is already pointing to the Router's gateway. (Assuming that HSRP redundancy is already running on the Router)
Method b)
1. Configure the Real Server's gateway to the CSS's IP Interface Redundancy IP Address
2. Configure IP Interface Redundancy on the CSS (as the Real Server's gateway)
3. Configure VIP(non-shared) redundancy for the VIP on the CSS

if you use method a) (server gateway is the router) you need the CSS to nat
the source ip address of the client in order to force the server to send traffic back to the CSS.
The issue then is that the server does not see the IP address of real client.
The server only see connections with source IP address = CSS ip address.
With method b) you don't have the above problem, but connection initiated by the servers are sent to the CSS that will then send it to the router.
You have a performance issue because the traffic will cross 2 times the one-armed interface.
If this is a new design, it is strongly recommended not to use one-armed setup.
Regards,
Gilles.

Css is it possible to use two VIPs with one source group?

I have separate VIPs defined for balancing dns and radius. Both services are being balanced behind the CSS between two servers running both services. Is there a way, using source groups, to have the outbound dns udp lookups go out the associated dns VIP and a client's returning radius udp traffic sourced from the associated radius VIP?
Just a note for clarity: both services defined for dns and radius have the same ip addresses. I can only define one of the services(i.e. dns) in a single source group which automatically associates the other service (i.e. radius) to that group.

If I understand your question correctly, you want to have the same real server respond with a different source address based on with VIP was used to get to it.
You can only put on instance of the server's ip address into a source group. That is you can't add the service name used for one rule into one group, and the service used in the other rule into another group, since the CSS only looks at the source address when it is determining to use the source group based on the service named in it. In order to have the same server use two different source groups, you would need ACL clause with the sourcegroup option, like
permit any 10.0.0.1 eq 53 dest any sourcegroup
permit any 10.0.0.1 dest any sourcegroup
Michael

6500 w/csm client talking with vip gets direct to real

We got a small server farm with four real servers and one vserver. when the client initiate a connection with the vserv it opens up an RPC at a certain point and starts talking directly with one ofthe real servers totally bypassing the vserver and if we take down that real server, then the connection hangs and it does not get re-directed to another server. CSM is setup in bridge mode and the servers are being used for a document management application by Hummingbird. Has anyone seen that kind of behavior?
Any help would be welcomed has we are going live with this project at the end of the week.

what is the concern ?
That the client goes directly to the real or that disconnecting the real does not redirect the connection ?
For the later, you should use the command 'failaction purge' under the serverfarm definition.
This will force the CSM to kill the connection if the real goes down.
For the other concern, your application is probably sending at some point its server ip address.
Each server will therefore send its own ip address and the client will go directly to it.
You should see if there is a way for your application to return a "configured" ip address that would be your vip.
You could also try to configure the vip as a loopback ip address on every real server and tell your application to advertise this address.
Hope this helps.
Gilles.

In Each field space should be replaced with @ symbol in DME File

Hi,
I configured DME file it good, but client wants in each field SPACE should be replaced with @ symbol
i created new DME file with DMEE transaction code
here it example
we have a bank account number filed length is 20 Digits but bank account no is 15 digits only remaing 5 filelds should be replaced with @ symbol
Kindly advice me on this
Thanks in advance
Regards
Kumar

Hello,
i could follow the link below. More or less my requiremnt is same
http://wiki.sdn.sap.com/wiki/pages/viewpage.action?pageId=201066680&focusedCommentId=247136560&#comment-247136560
Howeevr, the changes in my requirement are
The location field has to be populated with account name and the address of that account. In this scenario, i have the acoount name from the same page, but the account address is stored in account. i need to retrieve the data from account and append it with the account name and display it in location.
Please help me on this.
REGARDS
CHANDRAKANT KULKARNI

Logo replaced with "No items found" after testing a form submission

I'm quickly coming to the conclusion that Business Catalyst is written by the programmers, for the programmers, to be primarily used by the BC programmers to set up the initial web sites for end users and once everything is customized, the end user /site owner can then update product pages and other content, without knowing any code. IMHO, it was not written for Web designers who know how to build static web sites, but who also need added functionality.
Moreover, I thought the propose of BC was to build a professional looking and properly performing interactive web sites without knowing any coding. Even with knowing HTML, CSS, and some Javascript, it is one confusing mess, that does not perform as advertised, IN MY OPINION. You not only have to thoroughly understand how BC does things, and I seriously doubt that a custom site could be effectively built without knowing programming, or at least a working knowledge of Javascript, which most web designers have not mastered. Javascript is NOT easy, but neither is Business Catalyst.
Even the sample starter sites do not function smoothly, and the BC Manage site interface is NOT intuitive, so unless you want a web site that basically looks and functions just like one of the templates, you're out of luck. Maybe someone on this forum can explain how, and why, my header logo got 'replaced' with the words, "No items found"? All I did was attempt to set up a module form and then tested it. Next I was unable to log into the site with any accounts that I had set up as a User and/or member for testing purposes, which worked just fine before then.
I have just spent the better part of the last two-three week trying to figure out how to use Business Catalyst and slightly modify one of the provided BC sites to meet my needs. No such luck. I am a long time Adobe customer and have spent thousands of dollars on Adobe Software over the last ten plus years, but BC is a LOOSER. I'm NOT a stupid person, and have designed some nice responsive HTML5 web sites, but Business Catalyst has thrown me for a loop, even though I have tried diligently to figure out how all the pieces fit and work together, to little avail.
Why doesn't Adobe provide some programming help (for a reasonable programming fee) instead of forcing us to go with the independent BC programmers/site designers who do know how to make it work, but they charge the big bucks to do so? I had one BC site designer tell me that web sites cost $10,000 - $15,000. (and that was for a BC site) which I thought was quite unreasonable until you consider how few people truly know how to use BC well enough to customize a web site, and then you have to need a site very similar to the one already created. There in an inherent lack of simple functionality, and customization, for sites that are not retail product sites.
Frankly, I am very disappointed, frustrated, and now looking for a programmer to build a straightforward interactive site for my modest needs. Who cares about all those reports if you can't get the site to function properly, and are unable to troubleshoot the problems when everything is hidden in content holders with no access, and no list of all the modules that are even being used on the site I was last trying to modify. The Announcement module was not to be found anywhere, except in the code that somehow managed to switch out the site logo in the header with search results. Doubt if I could duplicate the problem if I tried.
BC is too complex on the backend, and doesn't make much common sense on the front management end. It tries to be all things to all retail selling sites, but all those functions, bells & whistles aren't much good if a user can't get the site off the ground.
At the very least, give us access to the all the modules uses on the sample sites (not al are available within the site management), the module names, and a brief description of what they do and how to access them when they are nowhere found in the module templates directory. And would someone PLEASE write some decent directions for using the management interface, instead of glibly showing how easy it is to do this or that, without any coding, but also without any real walk-throughs of exactly how to do something specific.
My apology to EVERYONE on this forum for my venting and rant out of sheer frustration ( and deadlines that are not being met) and I do NOT fault the forum moderator for NOT POSTING my thoughts, but I do hope this message, written in utter frustration, is FORWARDED to someone at Adobe who needs to know the truth of the matter regarding Business Catalyst, from at least my own VERY BAD USER EXPERIENCE, thus far, spent trying to get results creating a simple interactive web site using Business Catalyst.
I'm guessing some of you are frustrated and struggling as well. I wish you the best and every success in using Business Catalyst. Typically I am patient, and will keep on trying... but only to a point, at which it's time for me to move on to plan C, because the real 'help' I need is with all the little stuff that doesn't work and tutorials are definitely lacking unless you have that same problem or are trying to duplicate what is being explained - I've tried BG Gurus videos, Lynda.com training, and other Youtube BC resources.
Sincerely,
Heidi Wurst

the need for both a "testing" and "remote" server for the site and that the information in the 'add server form' needed to be correct.
You do not need both, you only need the the server that you want to use. I have a test site that I only use locally, so that is the server that I have setup, thus no remote server.
how many ftp addresses can I expect to have!
Just one per site, the correct one.
Gramps

Fonts are replaced with Adobe Sans in PDF

Receive PDF files from a client every month, 3 of the fonts in the file (Fortis Helvetica Bold, Fortis Helvetica Light Bold, and Fortis Helvetica Light) are not embedded. Fonts have been supplied and are installed in C:\WINDOWS\Fonts and C:\Program Files\Adobe\Acrobat 8.0\Resource\Font folders.
This has been working fine for over a year, all fonts load up in acobat, but for some reason now, the font "Fortis Helvetica Bold" is not loading up in Acrobat and is being replaced with Adobe Sans.
Any help would be appreciated.

It may also be that they have changed to a different version of the font. Just because it has the same name as one on your system does not mean they are compatible. In reality, your customer should embed all fonts. Have them change to a press or print job settings file and that should resolve the problem by embedding the fonts.

Not able to connect to RAC Database with VIP entries

Hi All,
My RAC database run with Physical Host entries in listener and tnsnames files.
But VIP services are running in both nodes.
Now i want to use VIP enties to connect to the RAC database from client side.
I have modified the both the listener and tnsnames files with VIP entries and bounced the instance.But It didn't work.
Please suggest what could be done in this issues.

Hi,
It is 10.2.0.3 and remote_listener is set to LISTENER_Hostname and Remote listener is configured.
Thanks

ABAP interfaces build using BDC and BAPIs can be used/replaced with the XI?

Hi,
We have develeloped our interfases using BDC and BAPIs. Now our client has decited to implement XI. Now could you please help in finding whether these interfaces can be used/replaced with the XI.
If yes, please let us know how?
Thanks and Regards,
Shweta

Singh,
Check this threads where they have discussed on how to use them with XI:
import BAPI into XI
Re: interface of xi with bapi
Re: BDC
Regards,
---Satish

Numbers replaced with X-Boxes

Hey everyone...
I'm not sure if this is in the right forum, but the documents originate in InDesign so I figured it was a good place to start.
I'm having an issue where I place a PDF of an article into a proof, and then export that to a PDF. When I (or anyone else in my department) views the PDF on our systems, they look fine. But, about 30% of the clients we send these to report that all the numbers (only the numbers) have been replaced with a box with an "x" in it. Occasionaly they send them back and I can see it.
I've looked everywhere for a solution to this and I can't find anything about it. Does anyone know something to try?
InDesign CS4, Adobe Acrobat, Adobe Reader, Windows 7 (on my end)
I've changed back and forth between old-style numerals and the regular ones, I've set subset fonts to both 0% and 100%.
Any help would be greatly appreciated!

The placed PDF is created in InDesign as well.
I layout the text in InDesign, export the PDF, place the PDF into a different InDesign file (the proof template we send to our clients), export that to PDF, and then the numbers don't show up in the placed document in its new PDF. Numbers that are in the proof template part of the PDF have their numbers showing just fine.
Also, the typeface in the placed PDF (where the numbers disappear) is Adobe Caslon Pro.
The typeface for the proof template is Arial (and the numbers always show).

Have Pixus and 3rd gen Airport extreme. Unable to replace with 5th gen airport extreme

I have Pixus and a 3rd generation Airport extreme . Unable to replace with 5th generation airport extreme. Problem?

Ok, thanks for the clarification. I assume that Pixus has provided you with a modem that provided an Ethernet connection to your 3rd Gen AirPort Extreme Base Station (AEBSn) ... correct? If so, then anytime you change networking hardware, it is a good idea to completely recycle power on all of the networking components.
Please try the following:
Power-down the Pixus modem, AEBSn, and computer(s); leave them powered off for at least 10-15 minutes.
Power-up the modem; wait at least 10-15 minutes to allow it sufficient time to initialize.
Power-up the AEBSn; wait at least 5-10 minutes or until its status light is a solid green. (Note: It may continue to flash amber. This is ok, as it may just require some additional configuration settings, like wireless security to attend to.)
Power-up the computer(s).
Network clients connected to the AEBSn, either by wire or wireless, should now be able to access the Internet through the Pixus modem. Please post back your results.

Can a touch screen be replaced with a non-touch screen? Still struggling to Find the answer

Can a touch screen be replaced with a non-touch screen? Still struggling to Find the answer.
My son has a 3 month old laptop with a touchscreen. Unfortunately he cracked the screen. The actual picture is fine, but the screen cover is cracked. After much searching we found the replacement cost…..all in is some $500. I am trying to find out if the screen can be replaced with a non touch screen. This will save him $250. I cannot seem to get the answer from HP, despite having been a client for many years.
He ordered the HP Pavilion dv6t Select Edition customizable Notebook PC. The product number is XC102AV.
It also shows a product number ww146av . The connector is on the bottom left of the screen.
I am pretty sure that the part number, per the manual, is 631019-001
I had been getting helpful replies from “Erico”, but have not heard back on this issue.
http://h10032.www1.hp.com/ctg/Manual/c02657339.pdf
Thanks

Hi,
I am still waiting for an answer as well. I haven't forgotten you. Since it is just after the holiday period perhaps an answer will come reasonably soon.
Best regards,
erico
****Please click on Accept As Solution if a suggestion solves your problem. It helps others facing the same problem to find a solution easily****
2015 Microsoft MVP - Windows Experience Consumer

User name replaced with ,#,#,#,#

Over the fall, we upgraded our sharepoint 2007 site to sharepoint 2010. We only updated the platform and back end though, we left it set up with the same 2007 sharepoint look and feel. Once we upgraded, we started to come across several problems, one of
the more annoying ones is users with all but full admin permissions to sites getting locked out of pages they have access to and edit capabilities to. Sharepoint allows the user to edit a page but when they try to check it in, their username is replaced with
",#,#,#,#" and then they get denied access because no user named ",#,#,#,#" has access to our site. Has anyone else experienced this problem or has a suggestion of where to start looking
to solve it? It happens on every page

Hi,
Let’s verify the following:
Make sure that all the Master page, CSS files, any other files that are required are published. If there are files that are required in the master pages and are not published, users will get access denied even if they have full control on the site.
Provide global read access to the master page library. Site actions > site settings > Master Page and page layouts > Library tab > Permissions. Add All authenticated users to READ ONLY.
Here is a similar post, refer to it:
http://sharepoint.stackexchange.com/questions/60699/user-with-full-control-permission-is-getting-access-denied-message
whether the issue persists in any other site collection within the same web application. Add a new "User Policy" for the web application that allows "All Authenticated Users" the permissions "Full Read" on the desired zone.
http://underthehood.ironworks.com/2011/05/sharepoint-2010-access-denied-for-users-that-have-full-control-on-the-site.html
http://technet.microsoft.com/en-us/library/ff758656.aspx
Best Regards,
Lisa Chen
Lisa Chen
TechNet Community Support

Problems with Photoshop CS2 I originally purchased this software several years ago. At time I was running Microsoft Windows XP. This computer recently was replaced with a Dell running Windows 8.I reloaded my CS2 on this computer & it ran fine with a few

Problems with Photoshop CS2
I originally purchased this software several years ago. At time I was running Microsoft Windows XP.
This computer recently was replaced with a Dell running Windows 8.I reloaded my CS2 on this computer & it ran fine with a few exceptions as follows;
when the software comes up initially I get a message that says “could not complete your request because of program error”. Hitting OK allows me to continue using the software .
When I try to activate a function using CTLR or ALT keys I get this message “required application failed to load and the product cannot continue. Please reinstall the application”. This causes the application to abort.
Reloading my CS2 continues to generate the same messages when I depress the CTLR or ALT keys.

Your original copy is obsolete and Adobe is offering a free replacement you are entitled to. Download and use that and that should clear it up for you.
https://helpx.adobe.com/x-productkb/policy-pricing/creative-suite-2-activation-end-life.ht ml
Download this copy of CS2 and use the serial number provided next to the download link.

Windows Update Client failed to detect with error 0xc8000247 after using Lenovo System Update 5

My Windows 7, SP1 was running fine, until I installed few updates on 10/15 using Lenovo System Update 5 then Windows Update stopped working, shows as RED:
{CE3119AD-35EF-41CF-9C21-C7698FEB8393}   2013-10-14 21:53:00:256-0700   1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates   Success   Software Synchronization   Windows Update Client successfully detected 4 updates.
{EB17A01A-EB6E-49FF-9EA2-AA0DD063B4B1}   2013-10-15 04:15:54:069-0700   1   162   101   {C61A0D00-3E51-48AC-B0AF-1D3E02B9E5D3}   201   0   AutomaticUpdates   Success   Content Download   Download succeeded.
{77DAE88F-2795-4258-8BBF-8D27E53662CF}   2013-10-15 12:10:38:196-0700   1   193   102   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates   Success   Content Install   Restart Required: To complete the installation of the following updates, the computer must be restarted. Until this computer has been restarted, Windows cannot search for or download new updates: - Security Update for Windows 7 for x64-based Systems (KB2862330)
{1398F777-3AEF-4D1D-BE4C-407EC4AEAD4C}   2013-10-15 12:15:25:676-0700   1   183   101   {C61A0D00-3E51-48AC-B0AF-1D3E02B9E5D3}   201   0   AutomaticUpdates   Success   Content Install   Installation Successful: Windows successfully installed the following update: Security Update for Windows 7 for x64-based Systems (KB2862330)
{A220898A-E5FE-4FE7-8413-2B0C7B4013D0}   2013-10-15 12:15:25:766-0700   1   202   102   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates   Success   Content Install   Reboot completed.
{A5400FF2-33ED-4A47-8409-13E5DFE16A6D}   2013-10-15 19:29:31:486-0700   1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   ChkWuDrv   Success   Software Synchronization   Windows Update Client successfully detected 0 updates.
{43C533EE-775D-445E-A652-06648B72DE65}   2013-10-15 19:29:49:702-0700   1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   ChkWuDrv   Success   Software Synchronization   Windows Update Client successfully detected 0 updates.
{D6AAAFFB-7F18-4A7E-B39D-1BA09CDC5E6D}   2013-10-15 19:30:05:744-0700   1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   AutomaticUpdates   Success   Software Synchronization   Windows Update Client successfully detected 3 updates.
{4E73B1C1-5BA2-415D-AB34-92F7AB3DB418}   2013-10-15 19:30:08:753-0700   1   147   101   {00000000-0000-0000-0000-000000000000}   0   0   ChkWuDrv   Success   Software Synchronization   Windows Update Client successfully detected 0 updates.
{51248882-41AC-4E59-B813-87AD326310AD}   2013-10-15 20:00:05:044-0700   1   183   101   {DBD3B4E9-0357-47DA-8317-D0CF2163BFE6}   501   0   wusa   Success   Content Install   Installation Successful: Windows successfully installed the following update: Hotfix for Windows (KB2661796)
{FB2B8E5E-442C-4E76-B23D-6A41B4324C9D}   2013-10-16 00:11:39:832-0700   1   148   101   {00000000-0000-0000-0000-000000000000}   0   c8000247   AutomaticUpdates   Failure   Software Synchronization   Windows Update Client failed to detect with error 0xc8000247.
Lenovo Thinkpad W500, Intel (R), Windows 7, SP1, latest updates as of Oct 15
(1) Checked Setting, set to automatic update whenever, even changed to never update, rebooted the OS and changed back to automatic update and rebooted the OS.
(2) Stopped Windows Update Services, renamed SoftwareDistribution folder and started the window update services and rebooted.
(3) Ran MS FIXIT
(4) Ran System File checker Scan (sfc /scannow)
(5) Ran CHKDSK /F
(6) Installed "Intel Rapid Storage Technology" drivers from Lenovo site
(7) Ran Update for Windows 7 for x64-based Systems (KB971033)
None of the above possible recommended solutions were able to fix the issue yet and now I am getting a message your Window is Not Genuine!
Any help or guidance is appreciated.
Solved!
Go to Solution.

The Lenovo System Update installed the "Intel Matrix Storage Manager driver 8.9.2.1002" right before the Windows Upgrade got broken. So in the Device Manager under IDE ATA/ATAPI Controllers, I choose Intel ICH9M-E/M SATA AHCI Controller, on the Driver Tab, I choose the option "Roll Back Driver" and after rolling back the driver and restarting the OS, now Windows Update is working like a Champ!
The End!

CSS 11000 Clients' Src IP replaced with VIP's IP

Similar Messages

Maybe you are looking for