Design question: ACE module connected to 2 different L3 engine while in bridge mode

fellow engineers,
i have been working on a design model , where the ACE mldule will provide SLB for both virtual and real servers. we have been deploying several UCS systems and the customer would like to use the ACE as our Enterprise SLB layer
configured in bridcge mode.
the msfc within the 6509 provide the L3 routing. however we may extends multiple vlans (v160-v163) via nexus switch layer (7k,5k,2k) to a FW appliance which now is the svi interface for the extended vlans. these vlans will be configured on a dedicated context.
the extension is based on the bridge mode operation as follow:
need help with the following:
1) if i have 4 bvi's configured, do i need to have default route configured?
2) my total count for vlans are: v160-v163 for server vlans, and v101 is the management vlan. the svi for this vlan is on the msfc card. the server GW are pointing to each dedicated svi's on the FW+L3 apliance.
3) if my default route on the context is pointing to the v160 svi on the FW+L3 engine, will that prevent the return traffic for other vlans ( v161-v163) from the ace toward the client?
4) is default route neccessary if you hae the ace in bridge mode.
it was brought to my attention that if you have multiple vlans configured in bridge mode pointing to another L3 engine, then each vlan would have to be configured on seperate context since you can only have one default route per context.
i appreciate any feedback on this inquiry. if you need additional information please le me know.
thanks and best regards,
raman azizian

Hi Raman,
You can have up to eight default routes in one context. What the ACE is doing with the entries is to create a ARP-entry with the name GATEWAY. If you need more then eight entries, just declare gateway as rservers. In that case the ARP-entry is stored as RSERVER instead of GATEWAY. The trick is to tell ACE to learn the MAC-address for the IP-address and store it int the ARP-table. The ACE never learn for itself a MAC-address. Don't forget mac-sticky enable on vlan's facing gateway.
I'm running one context in bridge mode and have 18 bvi's with FW and Router 6509 as gateways.
Exampel:
Interface to ROUTER 6509
interface vlan 300
bridge-group 300
no normalization
mac-sticky enable
access-group input BPDU
access-group input alla
access-group output alla
service-policy input lb-int-vlan300
no shutdown
rserver host 300GATEWAY
ip address 164.135.121.47
inservice
A#1/prod1# sho arp | i 164.135.121.47
164.135.121.47 00.08.e3.ff.fc.14 vlan300   RSERVER    4775   239 sec      up
A#1/prod1#
Interface to FIREWALL
interface vlan 802
bridge-group 802
no normalization
mac-sticky enable
access-group input BPDU
access-group input alla
access-group output alla
service-policy input lb-int-vlan802
no shutdown
rserver host 802GATEWAY
ip address 192.168.137.1
inservice
192.168.137.1   00.23.33.6a.bf.80 vlan802   RSERVER    4785   5 sec        up
Regards
Mats

Similar Messages

Design question for database connection in multithreaded socket-server

Dear community,
I am programming a multithreaded socket server. The server creates a new thread for each connection.
The threads and several objects witch are instanced by each thread have to access database-connectivity. Therefore I implemented factory class which administer database connection in a pool. At this point I have a design question.
How should I access the connections from the threads? There are two options:
a) Should I implement in my server class a new method like "getDatabaseConnection" which calls the factory class and returns a pooled connection to the database? In this case each object has to know the server-object and have to call this method in order to get a database connection. That could become very complex as I have to safe a instance of the server object in each object ...
b) Should I develop a static method in my factory class so that each thread could get a database connection by calling the static method of the factory?
Thank you very much for your answer!
Kind regards,
Dak
Message was edited by:
dakger

So your suggestion is to use a static method from a
central class. But those static-methods are not realy
object oriented, are they?There's only one static method, and that's getInstance
If I use singleton pattern, I only create one
instance of the database pooling class in order to
cionfigure it (driver, access data to database and so
on). The threads use than a static method of this
class to get database connection?They use a static method to get the pool instance, getConnection is not static.
Kaj

ACE module connection drops

I am facing an issue with Cisco ACE module. Have 5 servers serving the connections for applications. However, during peak hours there is lot of dropped connections.
Also have lot of fragment reassemble.
Please help how to go ahead troubleshooting the issue.

it is on the cisco site. In the ACE datasheet to be exact. But I'm talking about the appliance. Not sure about the module. But should be the same. Only thing I was not sure was whether the same limits apply to the base license package, or are the figures lower for the base license. Cisco says that the numbers are the same for the base package.
however I'm yet to verify it on the field

I have a new comcast modem i have connected to Time Capsule with cable, TC in double NAT. As when I tried it in bridge mode I cannot use Sonos, the units will not connect to the wifi network? I thought Bridge mode would make the wifi signal better??

I have the TC connected to the comcast modem, with TC in Double NAT mode. I set up the sonos music players ok. But I read that to incresae the wifi signal the TC should be in Bridge mode. Then I cannot get any of the Sonos units to connect to the wifi network.
So two questions, does the Bridge mode give a better wifi signal then double NAT?
Why will sonos not connect to the network when in Bridge mode?

A PC can have more issues connecting than a Mac.
But it really should not matter.. so just try it in situ.. press and hold the reset.. once it starts up, it will return to default IP, 10.0.1.1 the PC should then be able to find it via the airport utility.
If not drag it over to the Mac and plug in there by ethernet.. or since it is a laptop, really should not be that difficult to drag the Laptop and plug it into the TC.
Important thing is to get access to the TC.
The Mac if it is running lion, then you MUST download and install 5.6 airport utility to do anything useful.
http://support.apple.com/kb/DL1482

Configuring ACE Module for Redundancy

Hi Sir,
I'm configuring fault tolerance between two ACE modules installed on two different Catalyst 6513 switches. I have one Admin context and 3 user contexts.
Do I need to configure 4 "ft group", i.e. one context per group? E.g. config:
ft group 1
peer 1
priority 110
peer priority 105
associate-context Admin
inservice
ft group 2
peer 1
priority 110
peer priority 105
associate-context ace-context1
inservice
ft group 3
peer 1
priority 105
peer priority 110
associate-context ace-context2
inservice
ft group 4
peer 1
priority 105
peer priority 110
associate-context ace-context3
inservice
Can you also explain the purpose of configuring an alias IP address on the client-facing VLAN interface? I understand we need an alias IP address on the server-facing VLAN interface to provide a virtual gateway address to the servers. But what's the use of an alias IP on the client-side?
Thank you.
B.Rgds,
Lim TS

Hi Gilles,
I have configured FT for all user contexts as well as for the admin context. It works. My FT config is identical to the one I posted in this thread. Of course, one has to define the "ft interface vlan" and "ft peer" before configuring FT groups.
I noticed a few things:
(1) After the initial FT config, subsequent FT groups just need to be configured on the active Admin context and it will be replicated to the standby ACE, with the priority correctly reversed.
(2) You will get the message "NOTE: Configuration mode has been disabled on all sessions" when you log in to a standby context.
(3) The hostname of the active Admin context is not synced to the standby ACE. Do you know why?
One issue I encountered in one of the user contexts is as follows:
ace1/ace-context-1# sh run int
Generating configuration....
interface vlan 950
description *** Client-Facing VLAN ***
ip address 10.1.35.5 255.255.255.0
alias 10.1.35.4 255.255.255.0
peer ip address 10.1.35.6 255.255.255.0
access-group input ACL_VL950_IN
service-policy input REMOTE_MGMT
service-policy input MY_LB
no shutdown
interface vlan 951
description *** Connection to Real Servers ***
ip address 10.1.36.2 255.255.255.0
alias 10.1.36.1 255.255.255.0
peer ip address 10.1.36.3 255.255.255.0
access-group input ACL_VL951_IN
service-policy input NAT_REAL
no shutdown
This is the active context. It can ping to 10.1.35.4 (alias) and 10.1.35.6 (peer) over VLAN 950 (client-side). It can ping alias 10.1.36.1 over VLAN 951 (server-side) but can't ping to peer 10.1.36.3. The ACL_VL951_IN permits ip any any. Do you know why?
Secondly, I can remotely ping to alias 10.1.35.4 but can't telnet to it (I'm expecting it to telnet to the active context). I have to telnet to 10.1.35.5. Is this normal behavior?
Please advise.
Thank you.
B.Rgds,
Lim TS

ACE; Dynamic SNAT in bridge mode without Dnat (VIP) needed

Hi,
We are interested about the ACE NAT performance. We would like to use this module just for the SNAT feature and only in bridge mode (to facilitate the ACE integration in the current network).
the configuration could be similar to this one:
class-map PrivateSource
match source-address 10.0.0.0 255.0.0.0
policy-map multimatch SourceNat
class PrivateSource
nat dynamic 1 vlan X
interface vlan X (incoming traffic from the source)
bridge-group 1
service-policy in SourceNat
nat-pool 1 publicIP netmask A.B.C.D pat
interface vlan Y
bridge-group 1
Could anyone confirm if this feature is supported on the ACE and if the above configuration could be a good one?
Many thanks for your help.
Regards/Ludovic.

Ludovic,
ACE does not NAT bridged traffic.
You could catch it with a catch-all-destination class-map
ie:
class-map all
match virtual 0.0.0.0 0.0.0.0 any
And use a transparent serverfarm sending all traffic to a unique default gateway.
That would work.
Gilles.

EA4500 - Won't connect in bridge mode.

Any idea why Cisco Connect Express won't work if your EA4500 router is in Bridge mode?

Grouts wrote:
Yes.. but why does the Express App not work while in Bridge mode ?
obviously not all functionality would work, (same as the web management) !
but why should the App not recognise the wireless router just because it is in Bridge mode ?
Hello Grouts,
I’ve read as well your previous post. Did you try setting the router to DHCP? Is it working? What about the firmware of your router? I haven’t tried this though.

Can i connect hard drive to airport extreme in bridge mode

I just bought a hard drive and want have it connected to my airport extreme which is in bridge mode so that I can use it with U verse. Will I be able to backup my files on my macbook without connecting the usb on the hard drive to the macbook itself?

Will I be able to backup my files on my macbook without connecting the usb on the hard drive to the macbook itself?
This all depends on what you mean by backup your files.
Apple does not support Time Machine backups to a drive at the USB port of the AirPort Extreme, so if you are planning to use Time Machine, the better strategy would be to connect the drive directly to your Mac.
If you want to drag/drop or copy/paste regular data files to the hard drive, that should work OK
Remember that the drive should be formatted in Mac OS Extended (Journaled) as most store bought drives will come pre-formatted for Windows NTFS.
The USB port at the AirPort Extreme is under powered, so you almost always have to use a powered USB hub with a hard drive here....even if the drive has its own power supply.

Off Bridge Mode Question

Trying to determine how my Airport Extreme went into off-bridge mode....noticed my A.E. was blinking the amber light...after determining it was not an update alert, I unplugged the box from the socket, and detached all wires from the back of it...replugged, greenlight eventually came back on, but could not get onto the internet....called the 1-800 Apple number....tech determined I was indeed in off-mode, we fixed it, I'm back onto to the internet...forgot to ask her if unplugging the unit was what made it go into off-bridge...don't want to call back....but will if commnity can't answer the question....that is he question...did unplugging the unit, reset it into off bridge mode, or did I manipulate it within the dialogue box, and inadvertantly did something to put into off-bridge? Thanks for any and all hlep

Recycling power to the base station should NOT make any configuration changes. However, performing any of the potential resets can. The default mode of all of the Apple routers is NOT to be in bridge mode.

Connect and 4200 in bridge mode

Can connect be used when the router is in bridge mode with FIOS router as the main router? Seems when I try to install it can't find the 4200. Thx!
Solved!
Go to Solution.

Let me know that FIOS router is working as a modem in bridged mode? What is the IP address through FIOS router? Is FIOS router connected to the Internet port or Ethernet port on E4200 router?
Connect the FIOS router to the Internet port of E4200 router. Connect the computer to Ethernet port 1 on the router. Press and hold the reset button on the router for 30 seconds. Release the reset button and wait for 10 seconds. Power cycle the router and try to run the Cisco connect on your computer.
Once the Cisco connect software is installed successfully, you will be able to go online.

Design ? about SNMP operation in ACE module ... Traps sent to different Mgmt Stations

Good Day everyone,
I searched the site, and I could not find the answer I was looking for, so If anyone happens to know or point me to a link I would greatly appreciate it.
Topic:
Can ACE module sent different Traps (oid) to different management station? Split decision processing to send specific traffic to specific stations, based on the alert it has detected.
Scenario:
Our network equipments have a demarc point on what devices are managed via SNMP (Traps, syslog, EMS, etc...); Routers, Switches, ACE modules, and so forth.
However, we are not responsible for the App Servers assigned to various broadcast domains.
Customer would like to receive Notification from the ACE module when a Real Server is taken out of rotation , when specific probes have failed.
My team manages the ACE module, so any alerts from the ACE will be sent to the management station configured in our network.
Unfortunately I do not have a Test Lab to test my theory, so any help would be greatly appreciated before I submit my Production configs.
Design Requirements:
Customer would like the following traps generated and sent to their management station:
1) Real Server host name
2) TCP port
3) Real Server IP address
4) If capable, percentage threshold for each real server, based on the prediction configured for each Server Farm
5) Can a NetIQ agent be download on the ACE module to communicate with the NetIQ management station?
As always thank you for any help you can provide, and if you happen to be around Huntsville Alabama/USA.. you got a cold beer waiting for you!!!!
Cheers,
-raman

Gilles,
Thank you for your prompt answer.
When you have time please look over the following question and let me know if it is possible to implement, if the Proxy server is not an option?
Can a Custom TCL script be executed to sent an notification via SMPT if a health probe fails?
The SMTP message will contain the server info (IP address, Host name, TCP port).
The script procedure will execute certain actions based on the returned result.
Thanks,
raman
P.S
Sorry about not being up to speed on TCL. I am reading up on the TCL capability, and trying to provide some options to my customer.

Ace module dropping assymetric layer 2 connections

Hi we had a situation in where the ACE would randomly drop certain tcp connections, and all ICMP packets from a certain windows server. The server in question was using Transmit Load Balancing with Fault Tolerance.
The server has one Nic connected to Access switch1, and the other nic connected to Access switch2. Each access switch connects up to a pair of 6509's, which is active on Core1 on both switches.
I am guessing If the server sends on Nic 2, core1 knows it came in on the downstream trunk port to Switch2, it must reply to these packets based on the teamed mac of the layer 3 address(no idea who is arping for the destination - the ace?), and send them back out the downstream trunk port to switch1. The ace module is in transparent mode. When contacting a server on the other side of the ace, the ace drop packets that came from the second nic - and I am wondering how it "knows" that the return path is out of different downstream port. Does it share some kind of layer 2 RPF check with the 6500 ?
Please note there is no routing involved here. The destination server is just on another vlan on the same subnet, on the other side of the ace.

Bryan,
As long as the server replies back to the ACE the client should only be commmunicating with the VIP address in either of your two examples.
In your first example the flow will look like this.
client > VIP after the ACE client > rserver
the reply would be
rserver > client after the ACE VIP > rserver
In your second example using client nat it will look like this
Client > VIP After ACE Natpool > rserver.
the reply would be
rserver > Nat-pool after ACE VIP > client.
The ACE by default will always nat the vip to the server ip unless you use the command "transparent" under the serverfarm. When using this command we send the packet to the MAC address of the server leaving the destination IP of the VIP. The server would need to have the VIP address configured under the loopback interface.
Regards
Jim

ACE/FWSM design question

Hi - I'm designing the network topology for a multi tiered application using a 6509 with ACE and FWSM. Each tier will be in it's own VLAN and IP subnet and communications between tiers needs to be firewalled and in some cases loadbalanced.
I propose to do this by using a different context on both the ACE and the FWSM and using bridging mode within each context on both the FWSM and ACE as per Cisco's verified design for ACE/FWSM. It's perfectly feasable that a connection could be made for example to a server in the web tier, which would then need to make a connection to a server in the Application tier, which would in turn need to make a connection to a server in the database tier.
As far as I can see, the design I've proposed should work. Is anyone in a position to comment on whether there is anything wrong with this design, or a better way to do it?
There is no NAT to consider within this network
I've attached a JPG showing an example of the sort of connectivity that could be expected.
Many Thanks in advance

Thanks for your responses. I'm half way through implemeting this and there have been no problems so far.
With regards design & config notes for this, this document has most of what you need - http://www.cisco.com/application/pdf/en/us/guest/netsol/ns376/c649/ccmigration_09186a008078de90.pdf

ACE Module Cookie Parsing causes Reset Connection

I am trying to upgrade my ACE Modules from A2(1.3) to A2(3.2) . Unfortunately, the cookie parsing breaks when there are illegal characters and causes a connection reset (RST) when there is an invalid cookie, but only on code later than A2(1.3).
The cookie in question is being passed by a third party so making them change the cookie is not necessarily do-able. The cookie has the following value:
Cookie: CurrentUser={"UserKey":{"Key":"anonymous"},"LastUpdated":"10/13/2010 1:35:52 PM"}
We are using the following parameter map:
parameter-map type http CASE_PARAM
case-insensitive
persistence-rebalance
set header-maxparse-length 20480
length-exceed continue
On the older code, the request is passed on to the server.
Is there a setting similar to "length-exceed continue" that I can give the ACE to tell it to ignore cookies it cannot parse?

HTTP inspection is not enabled.
Did you mean adding a class-default to the policy-map?
Adding it to the policy-map does make it match the class-default. Unfortunately, cookie parse errors result in the inability to parse both the cookie and the host header as well. It seems that rather than just failing to parse the cookie and being unable to do sticky matching - it completely fails the entire header parsing.
Here's our setup:
rserver host test1
ip address 192.168.1.101
inservice
rserver host test2
   ip address 192.168.1.102
   inservice
rserver host test3
   ip address 192.168.1.103
   inservice
rserver host test4
   ip address 192.168.1.104
   inservice
serverfarm host auto
probe HTTP-diagnostic
rserver test1
    inservice
rserver test2
    inservice
serverfarm host news
probe HTTP-diagnostic
rserver test3
    inservice
rserver test4
    inservice
sticky http-cookie autoCookie auto-cookie
cookie insert browser-expire
replicate sticky
serverfarm auto
sticky http-cookie newsCookie news-cookie
cookie insert browser-expire
replicate sticky
serverfarm news
class-map type http loadbalance match-any auto
2 match http header Host header-value "www.auto.local"
3 match http header Host header-value "auto.local"
class-map type http loadbalance match-any news
   2 match http header Host header-value "www.news.local"
   3 match http header Host header-value "news.local"
class-map match-all prod_VIP
2 match virtual-address XXX.XXX.XXX.XXX tcp eq www
policy-map type loadbalance first-match prod_POLICY
class auto
    sticky-serverfarm auto-cookie
class news
    sticky-serverfarm news-cookie
class class-default
    sticky-serverfarm auto-cookie
policy-map multi-match aggregate-slb-apps
class prod_VIP
    loadbalance vip inservice
    loadbalance policy prod_POLICY
    loadbalance vip icmp-reply active
    loadbalance vip advertise
    appl-parameter http advanced-options CASE_PARAM

Database Connection design question

Hello, I have a design question. Awhile back I needed to create a database connection to SQL Server, so I created a class to do it
import java.sql.*;
import java.io.*;
import java.net.MalformedURLException;
import org.w3c.dom.Document;
import org.w3c.dom.*;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
public class SQLServerConnection
     private static Connection connection = null;
     public SQLServerConnection(String user, String password, String dbName) throws java.sql.SQLException
          getDBConnection(user, password, dbName);
     public SQLServerConnection(String configFileName) throws java.sql.SQLException
          getDBConnection(configFileName);
     private void getDBConnection(String user, String password, String dbName) throws java.sql.SQLException
         DriverManager.registerDriver(new com.microsoft.jdbc.sqlserver.SQLServerDriver());
         connection = DriverManager.getConnection(
              "jdbc:microsoft:sqlserver:" + dbName, user, password);
     private void getDBConnection(String configFileName) throws java.sql.SQLException
          String user;
          String password;
          String dbName;
          try
               DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
               DocumentBuilder db = factory.newDocumentBuilder();
               Document doc = db.parse(configFileName);
               doc.getDocumentElement().normalize();
               // get the configuration information
               password = getConfigParameter("password", doc);
               user = getConfigParameter("username", doc);
               dbName = getConfigParameter("databasename", doc);
               getDBConnection(user, password, dbName);
          catch (MalformedURLException murle)
               System.out.println("Unable to connect to: " + configFileName + " -- " + murle);
               System.exit(1);
          catch (FileNotFoundException fnfe)
               System.out.println("Configuration file " + configFileName + " not found.");
               System.exit(1);
          catch (IOException ioe)
               System.out.println("IOException: " + ioe);
               System.exit(1);
          catch (javax.xml.parsers.ParserConfigurationException pce)
               System.out.println ("Parser Configuration Error: " + pce);
          catch (SAXException saxe)
               System.out.println ("SAXException: " + saxe);
     private String getConfigParameter(String paramName, org.w3c.dom.Document doc)
          NodeList nl = doc.getElementsByTagName(paramName);
          if(nl != null)
               Node n = null;
               for (int i = 0; i < nl.getLength(); i++)
                    n = nl.item(i);
                    if(n.hasChildNodes())
                         NodeList children = n.getChildNodes();
                         return ((Node)children.item(0)).getNodeValue();
          else
               System.out.println ("nl is null");
          return "";
     public void setCatalog(String catalogName) throws java.sql.SQLException
          connection.setCatalog(catalogName);
     public Connection getConnection()
          return connection;
     public void closeConnection()
          try
               connection.close();
          catch(java.sql.SQLException sqle)
               System.err.println ("SQL Server Connection failed to close: " + sqle);
}Later on, I needed to do the same thing for MySQL, so I created a class for that, MySQLServerConnection which is exactly the same as above, except for:
private void getDBConnection(String user, String password, String dbName) throws java.sql.SQLException
          try
               Class.forName("com.mysql.jdbc.Driver").newInstance();
               connection = DriverManager.getConnection(dbName, user, password);
          catch(java.lang.ClassNotFoundException cnfe)
               System.out.println (cnfe);
          catch(java.lang.InstantiationException ie)
               System.out.println (ie);
          catch(java.lang.IllegalAccessException iae)
               System.out.println (iae);
     }Later, on, I did the same thing with OracleServerConnection. My question is, I know this is probably not optimal code. For example, I didn't originally have a close connection method, so I had to go in and code one for all 3. I'm assuming that an interface would be a good idea so that if I have to code another database connection class I make sure and include all of the appropriate methods. I'm also assuming that it would have been smart to have a master class, maybe something like DatabaseConnection and extended these classes from that. Am I on the right track? Totally offbase?

@nclow - I will work on trying the Factory Pattern for this over the weekend and post when I finish to see what you think.
@abillconsl - just to make sure I understand, you're saying that I just try to connect and it will cycle through the different database connection possibilities and connect when it finds the right one? If it fails all 3, log an appropriate message. One question I have about this is, I thought I was being object oriented by separating the different types of db connections (Oracle, SQL Server, MySql) into different classes. Am I missing the point of OOP by what I was/am trying to accomplish? Going overboard? Also, does your way try and connect to all 3 even if I connected to one already?
Thx, Grantarchy
Edited by: grantarchy on May 9, 2008 9:50 PM

Design question: ACE module connected to 2 different L3 engine while in bridge mode

Similar Messages

Maybe you are looking for