CSS 11501 web timeout

Hi,
I have a CSS11501 running 8.10.0.02 software. I have 2 windows 2003 web servers that connect to a backend database. I am recieving complaints that intermittently the end user is getting a session timeout.
I set the flow multiple to 2700 so the flow would be active for 12 hours, but when I issue the show flows command I see flow disappearing after just a few minutes.
Is this normal behavior?
Does my config look correct otherwise?
service A
ip address 192.168.248.17
keepalive type http
active
service B
keepalive type http
ip address 192.168.248.18
active
!*************************** OWNER ***************************
owner test1
content web
port 80
protocol tcp
add service A
add service B
vip address 192.168.248.16
balance aca
advanced-balance sticky-srcip
sticky-inact-timeout 720
flow-timeout-multiplier 2700
active
Thanks
Frank

Frank,
if the client or the server closed the connection, it will disappear.
Sniff the traffic on both side of the css and see which device is closing the connection.
Don't forget that servers also come with an idle timeout which is usually far less than 12 hours.
Gilles.

Similar Messages

NAT and Servers behind CSS 11501

All,
Please forgive my asking this question again. I was injured shortly after asking the last time and out of work for a long period of time.
My problem stems from needing to allow my web servers to initiate traffic to the outside world from behind our CSS boxes.
The web servers sit behind a pair of CSS 11501 content switches in Active-Passive ASR with fate sharing. We are only interested at this time with load balancing HTTP and HTTPS.
Everything works inbound no problem.
What I need to do is setup some type of NAT for my 3 web servers to initiate HTTP/HTTPS for patches, send SMTP from the web apps, and initiate HTTPS for credit card validation.
I have setup NAT on PIX units and routers no problem, but I seem to be unable to do it on these boxes. :(
In reality something as simple as a PAT translation on the outside of the CSS boxes should be sufficient.
Is this possible with our setup? Does anyone have some code examples?
Thanks in advance.
Addresses changed to protect the innocent:
Load Balancer 1:
!*************************** GLOBAL ***************************
bridge spanning-tree disabled
sntp server 1.1.1.41 version 1
snmp community noway read-only
snmp community noway read-write
app session 1.1.1.252
app
logging subsystem netman level info-6
dns primary 2.2.2.41
dns secondary 2.2.2.42
ip route 0.0.0.0 0.0.0.0 1.1.1.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
description "Connect to Primary DMZ 1 3550 Switch"
interface e2
bridge vlan 2
phy 100Mbits-FD
description "Connected to Primary LB Server Switch"
interface e8
description "Inter Switch Communication (ISC) Port"
isc-port-one
!************************** CIRCUIT **************************
circuit VLAN1
description "DMZ 1 Subnet (1.1.1.x/24)"
ip address 1.1.1.251 255.255.255.0
ip virtual-router 1 priority 254 preempt
ip redundant-interface 1 1.1.1.250
ip redundant-vip 1 1.1.1.161
ip redundant-vip 1 1.1.1.162
ip redundant-vip 1 1.1.1.70
ip redundant-vip 1 1.1.1.71
ip redundant-vip 1 1.1.1.72
ip critical-service 1 upstream_downstream
circuit VLAN2
description "Load Balanced Servers Subnet"
ip address 2.2.2.2 255.255.255.0
ip virtual-router 2 priority 254 preempt
ip redundant-interface 2 2.2.2.1
ip critical-service 2 upstream_downstream
Various Services, Owners and Content
Load Balancer 2:
!*************************** GLOBAL ***************************
bridge spanning-tree disabled
sntp server 1.1.1.41 version 1
snmp community noway read-only
snmp community noway read-write
app session 1.1.1.251
app
logging subsystem netman level info-6
dns primary 2.2.2.41
dns secondary 2.2.2.42
ip route 0.0.0.0 0.0.0.0 1.1.1.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
description "Connect to Secondary DMZ 1 3550 Switch"
interface e2
bridge vlan 2
phy 100Mbits-FD
description "Connected to Secondary LB Server Switch"
interface e8
description "Inter Switch Communication (ISC) Port"
isc-port-one
!************************** CIRCUIT **************************
circuit VLAN1
description "DMZ 1 Subnet (1.1.1.x/24)"
ip address 1.1.1.252 255.255.255.0
ip virtual-router 1
ip redundant-interface 1 1.1.1.250
ip redundant-vip 1 1.1.1.161
ip redundant-vip 1 1.1.1.162
ip redundant-vip 1 1.1.1.70
ip redundant-vip 1 1.1.1.71
ip redundant-vip 1 1.1.1.72
ip critical-service 1 upstream_downstream
circuit VLAN2
description "Load Balanced Servers Subnet"
ip address 2.2.2.3 255.255.255.0
ip virtual-router 2
ip redundant-interface 2 2.2.2.1
ip critical-service 2 upstream_downstream
Various Services, Owners and Content.

Gilles,
I added the following commands, and things seem to be working.
To circuit VLAN1
ip redundant-vip 1 1.1.1.80
!*************************** GROUP ***************************
group natout
vip address 1.1.1.80
add service nat_web_servers
active
service nat_web_servers
ip address 192.168.1.10 range 3
active
I do have a question about the above service commands.
I have 3 servers behind the CSS. Let's call them 192.168.1.10, 192.168.1.11 and 192.168.1.12. Am I correct in my thinking that adding range 3 then allows a match on all 3 of those servers and the CSS will then PAT these servers from the VIP address assigned to the group?
Otherwise, I think you have resolved this problem for us. Thank you.

CSS 11501 Load Balancing Issue

Hi,
We are facing some issue in load balancing in cisco CSS 11501 as we are not able to access the application through virtual IP. Below is the ruuning configuration of the CSS:
CSS11501# sh running-config
!Generated on 10/06/2010 16:51:34
!Active version: sg0810106
configure
!*************************** GLOBAL ***************************
ip route 0.0.0.0 0.0.0.0 132.186.199.1 1
!************************** CIRCUIT **************************
circuit VLAN1
ip address 132.186.199.145 255.255.255.0
!************************** SERVICE **************************
service Server1
ip address 132.186.199.243
port 5001
protocol tcp
keepalive port 5001
active
service Server2
ip address 132.186.199.246
protocol tcp
port 5001
keepalive port 5001
active
!*************************** OWNER ***************************
owner L5_Owner
content L3_Rule
    vip address 132.186.199.146
    protocol tcp
    port 5001
    add service Server1
    add service Server2
    active
content L5_Rule
    vip address 132.186.199.146
    add service Server1
    add service Server2
    protocol tcp
    port 5001
    url "//132.186.199.146:5001/emi"
    active
CSS11501#
Observation : We are able to telnet on VIP: 132.186.199.146 on port 5001, but not able to access the application.
In Actual scenarion customer access application by accessing URL: http://132.186.199.243:5001/emi and once he enter this URL in web browser the request redirects ( by server itself) to URL: https://132.186.199.44:6002/cas/login?service=http%3A%2F%2F132.186.199.243%3A5001%2Femi%2Findex.jsp&acceptStrength=BASIC on backend server for user authenticaton and once user is authenticated then it again redirect to main URL ( http://132.186.199.243:5001/emi ) to access the application but when we are trying to access the application through VIP ( URL: http://132.186.199.146:5001/emi) we are not getting the login page as the request is not gettting redirected to backend server for user authentication.
Please suggest a solution here.

The problem is that you are in one-armed mode.
So you need to configure client nat.
Without nating the client ip address, the server response goes back directly to the client and bypasses the CSS.
Therefore the client receives a response from an unknown server ip address (not the vip).
So configure a group.
For example
group Client
    vip address 132.186.199.146
    add destination service Server1
     add destination service Server2
    active
Also, remove the url command from your content rule.
It is useless in your case and will just make performance worst.
Gilles.

CSS 11501 and SSL

Hi,
I have a few questions regarding the CSS and SSL certificates.
I have 2 CSS 11501 and 3 web servers, how many SSL certificates do I need?
I want to configure the CSS as active - active, is this supported using the SSL accelleration module? If it is, is it configured the same way as a standalone CSS. The documentation only mentions configurations using single module and 2 modules in the same CSS.
And a clarificacion: Does the term Backend in the CSS SSL config refer to servers on a different subnet (in our case physically separated). Our config is 2 FW -> 2 CSS -> 3 Web servers -> 2 backend FW -> 6 Backend servers (app and DB). Am I correct in assuming that Backend refer to this backend? (This might seem like a silly question but the documentation has me confused)
Any help is much appreciated.
Thanks,
Niels

Niels,
there is currently an ASK THE EXPERT event.
Please join us if you have more questions.
Regarding the certificate, you could just use one.
Get 1 certificate for your VIP and upload it on both SSL module.
However, you might have to get 2, because certificate providers usually say it's one per physical device.
If you plan on doing SSL on the servers as well, you need 3 more certificates. Or you coul use a single certificate if this is allowed by the company that will give it to you.
Backend refers to server behind the CSS.
Like a firewall defines inside and outside interfaces, the CSS define the frontend and the backend.
The frontend is the client side and the backend the server side.
When you say active/active, what do you want to achieve exactly ?
You can indeed have 2 Vip and one is active on CSS1 while the other is active on CSS2.
However, if the CSS shares the same set of servers, you need to be careful that the return traffic from the server to the client goes back to the same server. This may require client nat (group config).
Regards,
Gilles.

CSS 11501 Trouble shooting data throughput

I have two groups of servers that talk to each other through the Load Balancer. It appears that on certain transactions where there is a "get", "head" or "trace" in the actual http data, the transaction is not forwarded through the CSS 11501. This happens maybe once in 11,000 transactions. It appears the word get, head or trace has to be in a certain part of the data payload to cause this problem too occur. Has anybody heard of such an issue? If so, do you have a work around? If not, any suggestion on how I can further isolate the issue. FYI I have a TAC case open but it does not appear to be going any where any time soon.

is it happening in the middle of a persistent connection or with the first request ?
There are 2 possibilities I can think off.
First one would be a flow timeout and the next request is just dropped because the css reclaim the fcb.
The 2nd option is that by default the CSS does not support the "TRACE" http method.
It must be enabled.
See info at :
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_command_reference_chapter09186a008040c3cf.html
So, configure a flow-timeout-multiplier and enable parsing of rfc2518 methods.
Gilles.

CSS 11501 DNS

Do I need a live internet/DNS environment to test this switch? I have bridged vlan2 to e1. my VIP is set to X.X.X.47 and I have to services set to X.X.X.45 and .46. They both say active. The e1 port is up but my vlan2 is down. I am assuming that the circuit is my problem.
When you define a vlan IP address, the manual says that this is the IP address that the CSS will recieve traffic from, so that would be the virtual IP .47 that links to either .45 or .46 right?
I am suppose to configure 1 web server ip per port on the CSS switch? I currently connect the 2 web servers to a 8 port 10/100 switch and I have a straight ethernet cable from that 10/100 switch to port 1 (e1) on the css Switch.
Are all my port numbers suppose to be configured to 80 since they are being used for HTTP? Am I to use the HTTP keepalive function as well?
I guess any additional info would be great. I guess this isn't a click, click, and go switch like someone said.

Ok. Thanks for the tip on the examples. I have tried to follow them as much as possible and have made progress, but I am still having problems with a few things that i can;t seem to find answers for.
CSS 11501 = IP 10.0.0.49 Subnet 255.255.255.0 Gateway 10.0.0.1
Srv01 = IP 10.1.0.45 Subnet 255.255.255.0 Gateway NONE
Srv02 = IP 10.1.0.46 Subnet 255.255.255.0 Gateway NONE
Dell 2708 = IP 10.0.0.13 subnet 255.255.255.0 Gateway 10.0.0.1
Client = IP 10.0.0.113 subnet 255.255.255.0 Gateway 10.0.0.1
I have Srv01 and Srv02 plugged into the CSS 11501 with IP address listed above. They reside in e7 and e8.
I have a cable from e1 to the dell 2708.
I have a laptop with a cable to the dell 2708.
I have configured a vlan (VLAN10) which includes ports e7 and e8 with an IP interface of 10.1.0.1. Status is active (GREEN)
I have configured two services with Srv01 and Srv02 and the status of both are active (Green)
I have created a content rule which includes both srv01 and srv02 with a VIP of 10.1.0.25. Status is active (green)
So I go to one of the web servers that is plugged into e7 or e8 and I can ping 10.1.0.25 sucessfully on both boxes. But I can only ping each servers IP address on its own box. In otherwords I can't ping cross server. When I try to access 10.1.0.25 from the servers the page doesn't come up. I know the VIP works because I can ping it.
I have also configured a VLAN (VLAN5) for e1 which goes to the dell 2708 with an IP of 10.0.0.48. But the status is down.
I am doing something wrong and can't seem to figure it out. any suggestions? I can diagram a picture in visio if you need a visual aid. I might consider Cisco University after all this.

Getting logs for DOS Attack:Sync Attack on cisco CSS 11501 frequently.

Hi ,
Since couple of weeks , i am getting below DOS attack logs on cisco CSS.Can anyone help me out about how can we avoid this? and how to deal with it.
04/23/2011 17:27:28:Enterprise:DOS Attack:SYN Attack -> 10 times
04/23/2011 17:30:15:Enterprise:DOS Attack:SYN Attack -> 10 times
04/24/2011 11:20:32:Enterprise:DOS Attack:SYN Attack -> 11 times
04/24/2011 11:24:48:Enterprise:DOS Attack:SYN Attack -> 12 times
04/24/2011 15:30:42:Enterprise:DOS Attack:SYN Attack -> 10 times
Thanks
Manish

Hi Nicolas,
Why i am asking about DOS attack as i am facing some issues for the 2 VIPs configured in cisco CSS 11501.
Can you help me troubleshooting the issue?
I have coming across some Load Balancing issues for the 2 VIPS configured on Cisco CSS11501.
We have cisco CSS 11501. We have 2 VIPs configured on it for FE and BE servers.Now Client calls to FE VIP and LB forwarding it to server and then FE server calls the BE VIP which goes through the same LB and forward to BE server under the VIP.When we start load test, we have observed after 2 hour test, application team getting HTTP timeout.As this application is used by Call center so getting timeout is bad.
Need to troubleshoot this issue if there is any problem from LB End.
Please find the attached file for VIP configs.

CSS 11501 - wildcard certificate with subject alternative names

Hi,
I generated a wildcard certificate for my company type *. mycompany.com in a CSS 11501.
For the site sub-domain1.mycompany.com worked fine, for the site sub-domain2.sub-domain1.mycompany.com didn't worked.
I read on the web that should generate a wildcard certificate with subject alternative names. Is it possible in CSS? how can I do it?
Thank you very much,
Cláudio Soares

Hi,
The CSS is indifferent to the Common Name in an SSL certificate used for SSL termination,
so using a wildcard certificate would be no different than using a standard certificate.
If using the CSS to generate the Certificate Signing Request, just enter the Common
Name with the leading asterisk for the subdomain portion of the hostname. Example:
Common Name (your domain name) [www.mycompany.com]*.domain.com
The only difference in configuring SSL termination would be that you could
reuse the SSL certificate (in the ssl-proxy-list) for all the different vips that the
subdomains resolve to without having to worry about pop-up warnings on client's browsers
(example attached). Or, if your subdomains resolve to the same vip, the CSS configuration
wouldn't be any different.
Regards,
Siva

CSS 11501S GSLB DNS

Hi
I am in the process of planning for a GSLB failover solution for a web site. I have attached a very basic diagram showing an example of the topology.
The aim is to have two sites. A primary site and a DR site to be used as a failover solution.
The main site has two web servers that will need to be load balanced and the failover DR site will only have 1 web server.
My initial plan was to use 2 Cisco CSS 11501S devices as I believe this would provide the load balancing and GSLB functionality I require.
To achieve this I was going to use the CSS's as the primary and secondary name servers for the domain. This has raised a few question marksâ¦.
Both of our sites are connected to a private WAN (with private IP ranges). See attached diagram. Our internet access is provide through a third party âFirewall Portâ directly off the WAN. We don't manage the firewall that connects to the internet. This third party firewall provides the NAT for our public facing services (web servers, mail servers, ftp servers etc).
So my questions areâ¦
* Because the CSS's and web servers are located on a private network will the CSS's be able to respond to the DNS requests with the PUBLIC IP address (as seeen from the internet) of the servers as apposed to the private IP address of the servers? If the firewall in front of the CSS's was connected to the internet this could be done via DNS doctoring but our firewall is on a private subnet!
* Is it possible to get the CSS's to respond to DNS requests for other domain devices that do not reside behind the CSS - E.g. a MX record for a mail server that resides on another 'private' network?
*Is there a better way to achieve this?
Any assistance would be much appreciated!!

Thanks for the reponse Gilles. When you say
"If you configure the css to answer with the public ip address, you can't access your vip from the internal network anymore."
Do you mean that you will only get the public ip address from a DNS query and therefore this won't work locally?
If I have a host file entry providing the private address resolution for my internal hosts will this work?
"Also, be aware we do not support GSLB on the CSS anymore.
So, if this is a new install, it is better to start with a solution that we support - GSS"
Why is this no longer supported? Are there a lot of problems with GSLB on the CSS? It is pretty hard to justify the cost of a solution including 2 GSS's for GSLB and 1 CSS for server load balancing when comapred to the price of 2 CSS's with the enhanced license for both GSLB and server load balancing.
I have one client that wants to use their existing CSS's for a solution like this and another that is starting from scratch.
Thanks

Local director 417 replacement? CSS 11501 software 8.20

Hi,
i would like to ask if CSS 11501 (software 8.20) is still the replacement hardware for local director 417? currently we use this local director to load balance http and https traffic using a flat network implementation meaning virtual IP is in the same netwoork as the physical server. will CSS 11501 can support this implementation?
Current Local Director setup example
web server virtual IP   10.10.10.1
real server ip 1   10.10.10.2
real server ip 2   10.10.10.3
rgds,
mc.malinao

local director is well before my time, so I can't comment on those and their official replacement.
I'd say you're better off going straight to ACE modules or appliances.
They're the latest generation of Cisco's load balancers.
We're very happy w/ our ACE-20 modules.

Cabling the CSS 11501

I have never worked with Content service switches so here's my question: Are my 2 web servers that I am trying to load balance suppose to be plugged into the CSS 11501?
The way I have it now is the servers are both plugged into a switch and the switch has a cable to the CSS. Plus I have the cable from the ethernet management port in the switch to for web interface access. Is this correct?

the servers can be connected the way you did.
Just make sure you have ip connectivity between css and servers.
You'll also want another cable between the CSS and your switch for client vlan (or internet side vlan).
I personally avoid the use of the management vlan. Too many restrictions there.
Gilles.

How to reset password on Cisco CSS 11501?

Hi,
I have changed the password for the Admin user (which was SuperUser) but when I changed it I forgot to add "SuperUser" at the end, now I don't have SuperUser access to the CSS 11501.
Can anyone shade some light on this problem and explain how can I reset the password for a SuperUser?
Thanks in Advance,
Shai

Hi Shai,
You need to reboot the CSS. When prompt, hit any key to go into the Offline Diagnostic Menu.
When you get in the menu, you will go to Administrative options and create an additional Admin user. When you do this, DO NOT use "admin", use something totally different.
Get out of the Offline DM and reboot the CSS. When the CSS comes up, login as the new user (which will have Superuser rights) and run the "username" cli to change the password of "admin" and add the superuser part this time.
Regards
Pete Knoops
Cisco Systems

CSS 11501 StartUp Problem

Hi all,
After i boot up for the first time, the CSS asked for change User/Pass, wich i perform a well known ones.
After that it's always impossible to login.
Is there any way of return to factory default Settings?
or
Is there any password recovery procedure?
or
What are the default User/Pass of the equipment?
I already done a Power Off/On on it with no results.
Best Regards,
Petr?nio

Hi,
I perform the password recovery, as it was documented and then its always getting the "CSS 11501 Offline Diagnostic Monitor menu (OffDM)" Menu, even if i dont press the Y key in the bootup question "Would you like to access the Offline Diagnostic Monitor? (Y)"
Any ideias?
How can i test the login i changed before?
Here is the bootup logging that appear's.
I'm not pressing any key.
******** Boot UP ********
CSS 11501 Offline Diagnostic Monitor menu (OffDM)
Version: 08.10.1.06
M A I N M E N U
Enter the number of a menu selection:
1* Set Boot Configuration
2. Show Boot Configuration
3* Advanced Options
4. Reboot System
> 4
Are you sure you want to reboot? (y/n) [n] y
Rebooting....
BootRom...booting
Copyright (1998-2002), Cisco Systems, Inc
Locked boot flash.
Validating operational boot flash, please wait...
Operational boot flash valid. Jumping to operational boot flash.
Copyright (1998-2002), Cisco Systems, Inc
Operational boot flash.
Attaching interrupt handlers...Done.
Built Mar 9 2006 @ 17:56:32
Version 08.10.1.06
Press to enter the Diagnostic Monitor
Ran 1 times, 24 tests. Detected 0 errors.
Booting OffDm @ 0xbff00000
SCM:MASTER Other:NOT-PRESENT
Initializing the disk...OK
Reading configuration records...
No Primary or Secondary Boot Record Found
FAILED
MGMT disabled, network port not active
Would you like to access the Offline Diagnostic Monitor? (Y)
Booting(-) ...
Transferring to menu...
Waiting for commands..
CSS 11501 Offline Diagnostic Monitor menu (OffDM)
Version: 08.10.1.06
M A I N M E N U
Enter the number of a menu selection:
1* Set Boot Configuration
2. Show Boot Configuration
3* Advanced Options
4. Reboot System
>

CSS 11501 Load Balancing with X-forwarded-for

Hi,
We have a pair of CSS 11501,
Currently it is using source ip for load balancing and 5 servers as backend , however we have users loggin in using http and based on its source IP (ISP PROXY) , it is forwarded to SERVER A.
However, we have a SSL page and when the client switches over to SSL , it is forwarded to SERVER B/C/D/E based on its source IP ( REAL CLIENT IP) .
This will cause the user to be terminated as the 5 servers are independent and not running in a cluster.
Is there any way that we can use the X-Forwarded-For address to load balance so that when users loging , they are sent to SERVER A (Based on X-Forwarded-For Header IP which translate to REAL CLIENT IP).
This way we are able to also send it back to the same server when it uses SSL.
I believe that we should be able to load balance using X-Forwarded-For IP or to rewrite the X-Forwarded-For IP into client source IP
Regards

Hi,
Unfortunately CSS does not support X-Forwarded-For, and even if CSS supports that, this wont work if you are not using SSL termination.
One option that you can use here, is using SSL termination, so you can manage the SSL traffic on HTTP on the CSS, in this way you can use the same HTTP content rule which is the one currently working.
In summary, you will have an SSL content rule that will decrypt the traffic, and this one will use the same content rule that already exist for HTTP, in case that the server is the one doing the redirect to SSL, but this is something that requires testing since depending on the redirect behavior we might have a redirect loop, but without details it is kind of hard to confirm that you will face this with this option.
Another option, which is less complex, is to use a portless content rule, so this content rule will match port 443 and 80 at the same time, and using sticky or balance based on source IP, you will get the same result with less config. The downside is the troubleshooting, but in this way you will have what you want.
content HTTP-HTTPS
    vip address 10.198.44.70
    advanced-balance sticky-srcip
    add service server1
    add service server2
    add service server3
    add service server4
    add service server5
    protocol tcp
    active
Here the content rule is not looking for the destination port, it is just looking for the source IP, and HTTP and HTTPS will end all the time on the same server.
Thanks,
Rodrigo

CSS 11501 - SNMP sysname

Hi All
Had a basic query on SNMP polling for CSS 11501..
Im polling a CSS through Ethernet Management Interface, and the SNMP servers are detecting the system name as "Support" instead of the hostname of the device..
SNMP get sysname from x.x.x.x with ****
.1.3.6.1.2.1.1.5.0 = Support
Is there a way to alter the SNMP sysname, to be identical to the hostname of the device ? I dont have issues with other components like routers, switches etc..
Raj

Hi Sachin,
Use the snmp name command to set or modify the SNMP name for this system.
You can specify only one name.
The syntax for this global configuration mode command is as follows:
snmp name "name"
Enter the SNMP name as the unique name assigned to a system by the administrator.
Enter a quoted text string with a maximum of 255 characters.
The standard name convention is the system's fully qualified domain name (for example, [email protected]).
For example:
(config)# snmp name "[email protected]"
To remove the SNMP name for a system and reset it to the default of "Support", enter:
(config)# no snmp name
Best regards,
Sachin Garg

CSS 11501 web timeout

Similar Messages

Maybe you are looking for