Keepalive limitations on ACE 4710 & module

I wanted to find out how many times can I apply a healthcheck in a single context. I have 50 farms that are using the same port and instead of creating 50 different healthchecks, I want to just create 1 healthcheck for the 50 farms and apply it to each farm. I also need to know if the same limitations (whatever they may be) is the same for the 4710, ACE20 and ACE30.

It's doncumented in the "Configuring Health Monitoring" of the configuration guide "server load balancing".
For ACE4710 running A3 :
The ACE supports  1000 unique  probe configurations, which includes ICMP, TCP, HTTP, and other  predefined health probes. The ACE can execute only up to 200 concurrent  script probes at a time. The ACE also allows the opening of 2048 sockets  simultaneously.
You can associate the same probe with multiple real servers or server  farms. Each time that you use the same probe again, the ACE counts it as  another probe instance. You can allocate a maximum of  4000 probe  instances.

Similar Messages

  • ACE 4710 A3(2.0) and ACS - TACACS+

    Hi.
    I am having trouble getting my ACE 4710 (A3(2.0) Build 3.0) to cooperate with my Cisco Secure ACS-server. In the same environment I have it working on my ACE Module, with the same configuration.
    ACE 4710:
    tacacs-server host 10.7.50.20 key 7 "fewhg"
    aaa group server tacacs+ tacacs_server_group
        server 10.7.50.20
        deadtime 15
    aaa authentication login default group tacacs_server_group local none
    aaa accounting default group tacacs_server_group local
    aaa authentication login error-enable
    ACS is configured correctly too. I have tried with several users, both in groups, with and without attributes and so forth. The ACS installation works with other devices and with my ACE modules running A2(3.1). I have tried this on both ACS 4.2(0).124 and 4.2(1).15.
    The strange part is what I see when I set up Wireshark on my ACS-server to look at the traffic. From what I can see, the ACE only sends a request to the AAA-server if the user exists locally. But I do not get authenticated and Failed Attempts show a line with with Message-Type: "Unknown NAS".
    It seems like others have the same problem. The problem is that the link attacked in the topic beneath only leads me back to forum and not to a topic with solution.
    https://supportforums.cisco.com/thread/132445?decorator=print&displayFullThread=true#132445
    Any help is appreciated and thanks in advance!

    are you using telnet or ssh ?
    if ssh can you try telnet, allow telent on your management policy to do this. Then if it works via telnet , then try ssh again, if it now works then you have hit CSCsu36078
    http://tools.cisco.com/squish/03240

  • CSS v ACE 4710 Performance Comparison

    Am trying to verify performance figures for a CSS 11503 EOL replacement using ACE 4710
    Trying to comapre apples with apples (is a CSS SSL TPS the same as a ACE 4710 TPS etc...)
    Pulling figures from data sheets, release notes etc I have only come up with the following
    Is there any further figures available for the ACE 4710 to fill in the blanks in table?
    Am sure that ACE 4710 smokes the CSS but have to do the due diligence
    <TR style="HEIGHT: 30pt" mcestyle="height: 30pt;">
    <TD style="WIDTH: 170pt; HEIGHT: 30pt" height=40 width=226 mcestyle="width: 170pt; height: 30pt;"> Metric</TD>
    <TD style="BORDER-LEFT: medium none; WIDTH: 83pt" width=110 mcestyle="border-left: medium none; width: 83pt;"> CSS 11503
    (1xSSL Module)
    <TD style="BORDER-LEFT: medium none; WIDTH: 83pt" width=110 mcestyle="border-left: medium none; width: 83pt;"> ACE 4710</TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> SSL - Transactions per second</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 1,400/sec</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;">7,500/sec</TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> SSL - RSA operations per second</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 4,000/sec</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> </TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> SSL - Bulk encryption (ARC4)</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 256 Mbps</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> </TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> Maximum concurrent connections</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 40,000</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> </TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> Compression </TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 500 Mbps</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;">2 Gbps</TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> Sticky Table</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 128K entries</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> </TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> L4 connections/sec</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 22,500</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> </TD></TR>
    <TR style="HEIGHT: 15pt" mcestyle="height: 15pt;">
    <TD style="HEIGHT: 15pt; BORDER-TOP: medium none" height=20 mcestyle="height: 15pt; border-top: medium none;"> L7 connections/sec</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 10,000</TD>
    <TD style="BORDER-LEFT: medium none; BORDER-TOP: medium none" mcestyle="border-left: medium none; border-top: medium none;"> 
    thanks,
    Sez

    Have reposted this msg, as table format garbled by forum
    Sez

  • ACE 4710 bundle license backup

    Hello,
    Is it possible to backup ACE appliance licenses if product is bought as a bundle?
    ACE-4710-BAS-SK-K9
    Promo Bundle - ACE 4710 HW-1Gbps-1K SSL-100MbpsComp-5VC
    Following is mentioned in the ACE documentation:
    "If you need to replace the ACE, you can copy and install the license file for the license onto the replacement appliance."
    But, when we try to backup licenses, we get following results:
    ACE-1/Admin# sh license
    ACE-1/Admin# copy licenses disk0:mylicenses.tar
    Backing up license... failed: License file not found
    ACE-1/Admin# sh license status
    Licensed Feature Count
    Compression Performance in Mbps 100
    Web Optimization Concurrent Conns. 50
    SSL transactions per second 1000
    Virtualized contexts 5
    Module bandwidth in Gbps 1.0
    ACE-1/Admin# sh license usage
    License Ins Lic Status Expiry Date Comments
    Count
    ACE-AP-C-UP1 No - Unused -
    ACE-AP-C-UP2 No - Unused -
    ACE-AP-C-UP3 No - Unused -
    ACE-AP-01-LIC No - Unused -
    ACE-AP-01-UP1 No - Unused -
    ACE-AP-02-LIC No - Unused -
    ACE-AP-02-UP1 No - Unused -
    ACE-AP-04-LIC No - Unused -
    ACE-AP-04-UP1 No - Unused -
    ACE-AP-04-UP2 No - Unused -
    ACE-AP-VIRT-5 No - Unused -
    ACE-AP-500M-LIC No - Unused -
    ACE-AP-VIRT-020 No - Unused -
    ACE-AP-C-100-LIC No - Unused -
    ACE-AP-C-500-LIC No - Unused -
    ACE-AP-C-500-UP1 No - Unused -
    ACE-AP-OPT-50-K9 No - Unused -
    ACE-AP-C-1000-LIC No - Unused -
    ACE-AP-C-2000-LIC No - Unused -
    ACE-AP-OPT-LIC-K9 No - Unused -
    ACE-AP-OPT-UP1-K9 No - Unused -
    ACE-AP-SSL-05K-K9 No - Unused -
    ACE-AP-SSL-07K-K9 No - Unused -
    ACE-AP-SSL-100-K9 No - Unused -
    ACE-AP-SSL-UP1-K9 No - Unused -
    ACE-AP-SSLUP-5K-K9 No - Unused -
    ACE-AP-VIRT-020-UP No - Unused -
    I suppose licenses cannot be backuped because they are bundled and delivered with the bundle by default, and not installed...
    Does anyone know what would be the procedure for this bundled licenses in case of ACE HW replacement needed?
    Best regards,
    Jasmina

    Hi Jasmina,
    License file management is quite simple for ACE.  Two methods; save original license email or copy from disk0:.
    If you purchased and upgraded license, and followed procedure to generate it, you would have received your license via email.   We recommend per  documentation (License ordering section) that you:
    "Step 5 Save the license key e-mail in a safe place in case you need it in the future (for example, to transfer the license to another ACE). "
    Also,  to apply,  you copy the license file to disk0: on the ACE.  This *.lic file resides on disk0: thereafter.
    So if you did not happen to save the original email when you obtained the license, and the license has been installed, then you can simply copy the *.lic file off the ACE from disk0: to a safe place.  Example copying file from ACE to FTP server:
    Switch/Admin# copy disk0: ftp:
    Enter source filename]? 1ACE2009060306445454.lic
    Enter Address for the ftp server]? 10.2.3.4
    Enter the destination filename]? [1ACE2009060306445454.lic]
    Enter username]? anonymous
    Enter the file transfer mode[bin/ascii]: [bin]
    Enable Passive mode[Yes/No]: [Yes]
    Password:
    Passive mode on.
    Hash mark printing on (1024 bytes/hash mark).
    Switch/Admin#
    Administrator Guide - Licenses on ACE:
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/administration/guide/license.html#wp1010344
    Hope this helps.
    -pefrench

  • Upgrade steps for ACE 4710

    Hi Everyone
    We will be upgrading our ACE 4710s from A3(2.2) to A4(1.0). We have a pair in high availability mode. Has anyone here got any tips on how we can get a smooth upgrade without downtime? Is this even possible?
    Thanks
    A

    Of course it is possible to upgrade with no downtime!
    However it is always recommended to schedule the upgrade in a maintenance window to minimize the impact in case of any issues.
    You can normally find the documented procedure here for the upgrade:
    http://cco/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/admin/guide/upgrade.html#wp1012243
    I find in fact the best would be the following:
    1. Upgrade the stand by module first.
    2. Once reloaded, switchover to the standby and verify all services working correctly.
    3.Upgrade the new stand by module.
    4. Eventually switch over again to restore the active box as per the original configuration.
    By doing this, if for some reason the first switchover at point 2. would not work, you can switch back to a safe scenario which you are sure to work.
    Cheers,
    Domenico.

  • Rservers initiated traffic not sourcing the traffic as VIP in Ace 4710

    One of the feature of our application is that our Application Server initiate text message to our devices sourcing from UDP 1120 and device need to see the message come from a specific pubic IP (2.2.2.2) with UDP port 1120 and reply back with the same Public IP (2.2.2.2) with UDP port 1120.The problem is we can make that happen if we have only one server in our ACE Serverfarm when we do a SNAT the real servers with the VIP address (10.1.246.32) but it does not work when we have more than one server in the Serverfarm. Since we have 2 servers, i cannot nat the real servers with the VIP address, if I do a PAT, obviously it is changing the source port of the request.
    Note: This setup is working fine with the Cisco Content Switch module running on chasis 6509. When I sniff the traffic initiated from the server coming the CSM load balancer, it is sourcing the traffic as the VIP and the source port remains the same by default but this is not the case with ACE 4710
    Traffic flow as follows
    ===============
    ACE 4710                                                       FWSM (Firewall static NAT)                    Device ( configured with 2.2.2.2:1120 (udp) to snd/rcv msg)
                                                 VIP
    Rserver 1   - 10.1.104.80       10.1.246.32           10.1.246.32  < - > 2.2.2.2                              1.1.1.1
    Rserver 2   - 10.1.104.81c
    ---------------------------------------------------------->           ------------------------------->                      - traffic flow from server to the device when we send msg
    Configs:
    ======
    rserver host server1
      ip address 10.1.104.80
      inservice
    rserver host server2
      ip address 10.1.104.81
      inservice
    serverfarm host SFARM
      failaction purge
      probe ICMP
      rserver server1
        inservice
      rserver server2
        inservice
    access-list TEST-1120 line 8 extended permit udp host 10.1.104.80 eq 1120 any
    access-list TEST-1120 line 16 extended permit udp host 10.1.104.81 eq 1120 any
    parameter-map type connection UDP_TIMEOUT
      set timeout inactivity 3600
    sticky ip-netmask 255.255.255.255 address source STKY-SFARM
      serverfarm SFARM
      timeout 180
      replicate sticky
    class-map match-all CLS-SFARM
      2 match virtual-address 10.1.246.32 udp eq 1120
    class-map match-all SERVERNAT
      2 match access-list TEST-1120
    policy-map type loadbalance first-match POL-SFARM
      class class-default
        sticky-serverfarm STKY-SFARM
    policy-map multi-match POL-LB
    class CLS-SFARM
        loadbalance vip inservice
        loadbalance policy POL-SFARM
        loadbalance vip icmp-reply active
        connection advanced-options UDP_TIMEOUT
    class SERVERNAT
       nat dynamic 1 vlan 244
    int vlan 244
    ip address 10.1.246.2 255.255.255.0
    service-policy input POL-LB
    nat-pool 1 10.1.246.32 10.1.246.32 netmask 255.255.255.255
      mac-sticky enable
      no icmp-guard
    no shut
    interface vlan 2506
    ip address 10.1.104.2 255.255.255.0
    service-policy input POL-LB
      mac-sticky enable
      no icmp-guard
    no shut

    I see in CSS, they are able to nat the source ip address with VIP and port-mapping diabled. How do I implement
    portmap disable in ACE 4710
    Disabling Port Mapping
    By default, the CSS NATs source IP addresses and PATs source ports for a configured source group. If you configure the portmap disablecommand in a source group, the CSS performs NAT on the source IP addresses but does not perform PAT on the source ports of UDP traffic that matches on that source group.
    For UDP applications with high-numbered assigned ports (for example, SIP and WAP), we recommend that you preserve those port numbers by configuring destination services in source groups instead of using the portmap disable command. Destination services cause the CSS to NAT the client source ports, but not the destination ports. For information about configuring destination services,

  • ACE 4710 Can not confirm http cookie sticky connections

    We are using a ACE 4710 with A3(2.6) software release.
    I had to change our sticky load balancing method for HTTPS to cookie based.
    However while connections appear to work if I look at the sho sticky database table I can not see or confirm sticky entries for the cookie based connections.
    Here or config snippets to show the config
    sticky http-cookie ghh-www scook-ghh
      cookie insert browser-expire
      serverfarm ghh-www-443
    class-map match-all ghh-www-443_CLASS
      2 match virtual-address 172.16.1.21 tcp eq https
    class-map type http loadbalance match-any ghh-www-443_CLASSURL
      2 match http url [.]*
    policy-map type loadbalance first-match ghh-sticky-443_POLICY
      class class-default
        sticky-serverfarm scook-ghh
    policy-map multi-match POLICY
    class ghh-www-443_CLASS
          loadbalance vip inservice
          loadbalance policy ghh-sticky-443_POLICY
          loadbalance vip icmp-reply active
          appl-parameter http advanced-options CASE_PARAM

    Another point: please check whether your servers are listening only for HTTPS traffic or also for HTTP traffic:
    in the first case the ACE will have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and then re-encrypt it and send it to the server
    in the second case the ACE would have to: decrypt the traffic from the client, inspect the http header to take the loadbalance decision and send it out as it is unencrypted to the server
    the second solution would have the benefit of being easier to configure and to require less resoucerces both on the ACE (only decryption to be performed) and on the servers (no need for SSL operations at all there) but it might be that your company or business sector have requirements for which this traffic should never flow unencrypted, in which case you would have to go for the first solution.
    Here you have a config example for the first solution:
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00809c6f37.shtml
    I would not expect you to have to pay extra for importing the cert and kepair into the ace, it would be just a copy, however as Alex said that may still depend on the license agreement with the CA.
    Cheers,
    Francesco

  • ACE 4710 FT failover failure

    Hello,
    I am running redundant ACE 4710 appliances running A3(2.7).  I have five FT groups configured along with FT Tracking and when the vlans fail due to physical links being down, the contexts to do not failover.  If one of the ACE boxes fail completely, failover works fine.  I have included the FT config from one of the contexts below.  I have a case open with TAC and the Engineer is suggesting the use of a query interface in additon to FT Tracking.  We have had two incidents on separate contexts where we lost a physical interface on the primary ACE, one for the maintenance of the core switch, the other was a cable disconnect and we are unable to understand why the indivdual context didn't failover.  Any ideas would be much appreciated.  Let me know if more info/configs are needed.
    Dave
    ft interface vlan 900
      ip address 10.10.10.1 255.255.255.0
      peer ip address 10.10.10.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 20
      ft-interface vlan 900
    ft group 3
      peer 1
      no preempt
      priority 210
      peer priority 120
      associate-context XYZ
      inservice
    FT Group                     : 3
    No. of Contexts             : 1
    Context Name                 : XYZ
    Context Id                   : 2
    Configured Status           : in-service
    Maintenance mode             : MAINT_MODE_OFF
    My State                   : FSM_FT_STATE_ACTIVE
    My Config Priority           : 210
    My Net Priority             : 210
    My Preempt                   : Disabled
    Peer State                   : FSM_FT_STATE_STANDBY_HOT
    Peer Config Priority         : 120
    Peer Net Priority           : 120
    Peer Preempt                 : Disabled
    Peer Id                     : 1
    Last State Change time       : Wed Jan 11 13:14:16 2012
    Running cfg sync enabled     : Enabled
    Running cfg sync status     : Running configuration sync has completed
    Startup cfg sync enabled     : Enabled
    Startup cfg sync status     : Startup configuration sync has completed
    Bulk sync done for ARP: 0
    Bulk sync done for LB: 0
    Bulk sync done for ICM: 0
    show int
    vlan424 is up, VLAN up on the physical port
    Hardware type is VLAN
    MAC address is 00:1e:68:1e:ba:b7
    Virtual MAC address is 00:0b:fc:fe:1b:03
    Mode : routed
    IP address is 10.104.224.6 netmask is 255.255.255.0
    FT status is active
    Description:"New Server VIP and real"
    MTU: 1500 bytes
    Last cleared: never
    Last Changed: Sun Mar 11 01:13:12 2012
    No of transitions: 3
    Alias IP address is 10.104.224.5 netmask is 255.255.255.0
    Peer IP address is 10.104.224.7 Peer IP netmask is 255.255.255.0
    Assigned on the physical port, up on the physical port
    Previous State: Sun Mar 11 00:04:57 2012, VLAN not up on the physical port
    Previous State: Sun Sep 18 10:21:15 2011, administratively up
         3991888419 unicast packets input, 23734607976687 bytes
         20246934 multicast, 174801 broadcast
         0 input errors, 0 unknown, 0 ignored, 0 unicast RPF drops
         1609345958 unicast packets output, 23690663385228 bytes
         7 multicast, 55807 broadcast
         0 output errors, 0 ignored

    Dave,
    For tracking to work you need to have preempt enabled. Can you try enabling preempt under the ft group and test your tracking again? Another potential issue you may run into is if your tracking is not lowering the priority enough when it fails. The difference between the active and standby device is 100. If you are not decrementing the priority greater than this value even if priority is enabled it will not lower it enough to force the failover. If after enabling preempt on this group the tracking still does not work as expected send you whole config for us to look at.
    Regarding the query interface; This is not a bad idea. It will help prevent an active active situation if there is a problem with the ft link between the two modules.
    Thanks
    Jim

  • Need help to Configure Cisco ACE 4710 Cluster Deployment

    Dear Experts,
    I'm newbie for Cisco ACE 4710, and still I'm in learning stage. Meanwhile I got chance at my work place to deploy a Cisco ACE 4710 cluster which should load balance the traffic between  two Application Servers based on HTTP and HTTPS traffic. So I was looking for good deployment guide in Cisco SBA knowledge base then finall found this guide.
    http://www.cisco.com/en/US/docs/solutions/SBA/February2013/Cisco_SBA_DC_AdvancedServer-LoadBalancingDeploymentGuide-Feb2013.pdf
    This guide totally fine with my required deployment model. I have same deployment environment as this guide contains with ACE cluster that connects to two Cisco 3750X (Stack) switches. But I have some confusion places in this guide
    This guide follow the "One-armed mode" as a deployment method. But when I go through it further I have noticed that they have configured server VLAN as a 10.4.49.0/24 (all servers reside in it) and Client side VIP also in same VLAN which is 10.4.49.100/24 (even NAT pool also).
    My confusion is, as I have learned about Cisco ACE 4710 one-armed mode deployment method, it should has two VLAN segments, one for Client side which client request come and hit the VIP and then second one for Server side. which means besically two VLANs. So please be kind enough to go through above document then tell me where is wrong, what shoud I need to do for the best. Please this is an urgent, so need your help quickly.
    Thanks....!
    -Amal-

    Dear Kanwal,
    I need quick help for you. Following are the Application LB requirements which I received from my clinet side.
    Following detail required for configuring Oracle EBS Apps tier on HA:
    LBR IP and Name required to configure EBS APPS Tier (i.e, ap1ebs & ap2ebs nodes)
    Suggested IP and Name for LBR:
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm detail for LBR Setup
    Following detail will be use for configuring the LBR:
    LBR IP and Name :
    IP : 172.25.45.x [should be on same 172.25.45 subnet of ap1ebs & ap2ebs nodes]
    ebiz.xxxx.lk [on port 80 for http protocol accessibility]
    This LBR IP & name must be resolve and respond on DNS network
    Server Farm Detail for LBR setup:
    Server 1 (EBS App1 Node, ap1ebs):
    IP : 172.25.45.19
    Server Name: ap1ebs.xxxx.lk [ap1ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Server 2 (EBS App2 Node, ap2ebs):
    IP : 172.25.45.20
    Server Name: ap2ebs.xxxx.lk [ap2ebs hostname is an example, actual hostname will be use]
    Protocol: http
    Port: 8000
    Since my client needs to access URL ebiz.xxxx.lk which should be resolved by IP 172.25.45.21 (virtual IP) via http (80) before they deploy the app on the two servers I just ran web service on both servers (Linux) and was trying to access http://172.25.45.21 it was working fine and gave me index.html page. Now after my client has deployed the application then when he tries to access the page http://172.25.45.21 he cannot see his main login page. But still my testing web servers are there on both servers when I type http://172.25.45.21 it will get index.html page, but not my client web login page. What can I do for this ?
    Following are my latest config :
    probe http Get-Method
      description Check to url access /OA_HTML/OAInfo.jsp
      interval 10
      faildetect 2
      passdetect interval 30
      request method get url /OA_HTML/OAInfo.jsp
      expect status 200 200
    probe udp http-8000-iRDMI
      description IRDMI (HTTP - 8000)
      port 8000
    probe http http-probe
      description HTTP Probes
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      request method get url /index.html
      expect status 200 200
    probe https https-probe
      description HTTPS traffic
      interval 10
      faildetect 2
      passdetect interval 30
      passdetect count 2
      ssl version all
      request method get url /index.html
    probe icmp icmp-probe
      description ICMP PROBE FOR TO CHECK ICMP SERVICE
    rserver host ebsapp1
      description ebsapp1.xxxx.lk
      ip address 172.25.45.19
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    rserver host ebsapp2
      description ebsapp2.xxxx.lk
      ip address 172.25.45.20
      conn-limit max 4000000 min 4000000
      probe icmp-probe
      probe http-probe
      inservice
    serverfarm host ebsppsvrfarm
      description ebsapp server farm
      failaction purge
      predictor response app-req-to-resp samples 4
      probe http-probe
      probe icmp-probe
      inband-health check log 5 reset 500
      retcode 404 404 check log 1 reset 3
      rserver ebsapp1 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
      rserver ebsapp2 80
        conn-limit max 4000000 min 4000000
        probe icmp-probe
        inservice
    sticky http-cookie jsessionid HTTP-COOKIE
      cookie insert browser-expire
      replicate sticky
      serverfarm ebsppsvrfarm
    class-map type http loadbalance match-any default-compression-exclusion-mime-type
      description DM generated classmap for default LB compression exclusion mime types.
      2 match http url .*gif
      3 match http url .*css
      4 match http url .*js
      5 match http url .*class
      6 match http url .*jar
      7 match http url .*cab
      8 match http url .*txt
      9 match http url .*ps
      10 match http url .*vbs
      11 match http url .*xsl
      12 match http url .*xml
      13 match http url .*pdf
      14 match http url .*swf
      15 match http url .*jpg
      16 match http url .*jpeg
      17 match http url .*jpe
      18 match http url .*png
    class-map match-all ebsapp-vip
      2 match virtual-address 172.25.45.21 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match ebsapp-vip-l7slb
      class default-compression-exclusion-mime-type
        serverfarm ebsppsvrfarm
      class class-default
        compress default-method deflate
        sticky-serverfarm HTTP-COOKIE
    policy-map multi-match int455
      class ebsapp-vip
        loadbalance vip inservice
        loadbalance policy ebsapp-vip-l7slb
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 455
    interface vlan 455
      ip address 172.25.45.36 255.255.255.0
      peer ip address 172.25.45.35 255.255.255.0
      access-group input ALL
      nat-pool 1 172.25.45.22 172.25.45.22 netmask 255.255.255.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input int455
      no shutdown
    ft interface vlan 999
      ip address 10.1.1.1 255.255.255.0
      peer ip address 10.1.1.2 255.255.255.0
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 999
    ft group 1
      peer 1
      no preempt
      priority 110
      associate-context Admin
      inservice
    ip route 0.0.0.0 0.0.0.0 172.25.45.1
    Hope you will reply me soon
    Thanks....!
    -Amal-

  • Cannot Telnet to ACE 4710 after upgrade to A4(2.3)

             I have a pair of ACE 4710s with 12 contexts sharing the load, running A4(2.1). Yesterday I upgraded one of them to A4(2.3)
    now I cannot telnet to the Admin context.Pings ok. I can telnet to other contexts on the box and everything seems to be working ok   
    when i do a " sh telnet"
    comes back with
    No Session Information is available
    sh telnet maxsessions
    telnet maxsessions 16
    Can anybody help?

    further this post, it was not a resource problem as had allocated 5% for the Admin context.
    I up graded IOS Saturday evening, could not Telnet in, tried again on Sunday same result,
    though this morning (Monday) Can now telnet in ok very strange
    I was connecting via the AUX line of a 2851 router to the console port.
    whe I disconnected this morning I saw the following message
    INIT: id "T0" respawning too fast : disabled for  5 minutes
    not sure if this is a 2851 message or an ACE message, but after getting that message is when I was able to Telnet in
    was it a coincidence
    anybody any ideas

  • ACE 4710: Possible to allow a user to clear counters but nothing else?

    Hello all,
    Using an ACE 4710 we have a user setup with the Network-Monitor role which allows the user to view config, interface status, etc.  We would also like to allow this user to clear the interface error counters as well, but nothing else.  Is this possible?
    Thanks!

    Hello Brandon-
    Network-Monitor only lets you browse outputs, it is a not a role that allows a user to make any changes including clearing stats.  You can create custom roles and domains to get closer to what you want, but you cannot zero in on a single command like that.
    i.e.
    ACE# conif t
    ACE(config)# role MyRole
    ACE(config-role)# rule 1 permit modify feature ?
      AAA             AAA related commands
      access-list     ACL related commands
      connection      TCP/UDP related commands
      fault-tolerant  Fault tolerance related commands
      inspect         Appln inspection related commands
      interface       Interface related commands
      loadbalance     Loadbalancing policy and class commands
      pki             PKI related commands
      probe           Health probe related commands
      rserver         Real server related commands
      serverfarm      Serverfarm related commands
      ssl             SSL related commands
      sticky          Sticky related commands
      vip             Virtual server related commands
    You can create a permit or deny rule, within that, create/debug/modify/monitor each feature seperately.
    Domains allow you to create containers for objects.  You can place specific rservers, serverfarms, etc. into it - then apply it to a role so that the user assigned to it can only touch those objects.
    Regards,
    Chris Higgins

  • ACE 4710 in bridge mode not working

    I am trying to configure ACE 4710 bridge mode and I am stuck up in physical interface configuration. I have configured gig1/2 of ACE as trunk port and on layer 2 switch I have assigned that interface (gig1/2) to VLAN 11. I tried trunk port also but it got disabled due to BPDU error.
    I am not able to ping servers as well as gateway. Below are the topology and context configuration:
    Router   (vlan 13: IP 172.16.11.254)
         |
    ACE     (int gig1/2)
         |
    L2 Switch
         |
    Servers (vlan 11: IP 172.16.11.1 and 11.2)
    Admin Context
    ===========
    resource-class rc1
      limit-resource all minimum 0.00 maximum unlimited
      limit-resource sticky minimum 0.20 maximum unlimited
    boot system image:c4710ace-mz.A3_2_4.bin
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      switchport trunk allowed vlan 11,13
      no shutdown
    interface gigabitEthernet 1/3
      shutdown
    interface gigabitEthernet 1/4
      shutdown
    access-list ALL line 8 extended permit ip any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    interface vlan 1000
      ip address 172.16.16.16 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.16.254
    context test
      allocate-interface vlan 11
      allocate-interface vlan 13
      member rc1
    test Context
    =========
    access-list bpdu-fixup ethertype permit bpdu
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    rserver host srv1
      ip address 172.16.11.1
      inservice
    rserver host srv2
      ip address 172.16.11.2
      inservice
    serverfarm host srv
      rserver srv1
        inservice
      rserver srv2
        inservice
    sticky ip-netmask 255.255.255.255 address both SG1
      timeout 120
      serverfarm srv
    class-map type management match-any remote-mgmt
      201 match protocol snmp any
      202 match protocol ssh any
      203 match protocol icmp any
      204 match protocol http any
      205 match protocol https any
      206 match protocol xml-https any
    class-map match-all slb-vip
      2 match virtual-address 172.16.11.10 any
    policy-map type management first-match remote-mgmt
      class remote-mgmt
        permit
    policy-map type loadbalance first-match slb
      class class-default
        sticky-serverfarm SG1
    policy-map multi-match client-vips
      class slb-vip
        loadbalance vip inservice
        loadbalance policy slb
        loadbalance vip icmp-reply
    interface vlan 11
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      no shutdown
    interface vlan 13
      bridge-group 1
      access-group input bpdu-fixup
      access-group input ALL
      access-group output ALL
      service-policy input remote-mgmt
      service-policy input client-vips
      no shutdown
    interface bvi 1
      ip address 172.16.11.9 255.255.255.0
      no shutdown
    ip route 0.0.0.0 0.0.0.0 172.16.11.254
    Could you pls. suggest where I am doing wrong?
    Thanks,
    Pawan

    " I tried trunk port also but it got disabled"   <----- if your L2 config is not correct, nothing will work.
    What is the setup on the switch ? Trunk or access vlan ?
    What is the status of the interface ? up ? down ?
    Do you see something in your arp table ?
    Gilles.

  • ACE 4710 - show stats connection questions

    Hi,
    I have three questions regarding the "show stats connection" command in the ACE 4710:
    1. What is the criteria for a connection to be added to the "Total Connections Failed" counter?
    2. What is the criteria for a connection to be added to the "Total Connections Timed-out" counter?
    3. Is there a command to get more information why the connection was failed or timed-out (e.g. to/from which IP, url accessed etc.)?
    Thanks in advance for your help!
    Best regards,
    Harry

    Harry,
    a connection failed if the server did not respond or resonded with a RST.
    As long as the connection gets establised, it is counted as a success.
    The connection timeout counter is incremented when the connection is idle for the configured timeout value or for L7 connections if it does not complete the 3-way handshale within the embryonic timeout interval.
    Since this is clear why those counters are incrementing, the only way to get more information is to capture a sniffer trace to verify if the conditions above are met.
    Gilles.

  • ACE 4710. Unable to clear ssh sessions

    Hi.
    Once in the CLI of an ACE 4710, using the command "clear ssh session id" I am unable to clear/kill any of the remote ssh sessions established.
    According to the administration guide, the "clear ssh .." command must clear the sessions, but it does not, or maybe I am missing something?
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/administration/guide/access.html#wp1050335
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Tabla normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    ACE/CONTEXTO_A# show ssh session-info
    Session ID     Remote Host         Active Time
    13728          222.98.54.158:50556   67:43:38
    13732          200.44.158.70:46172   67:43:36
    13735          200.44.158.70:46174   67:43:36
    13737          200.44.158.70:46177   67:43:36
    ACE/CONTEXTO_A#
    ACE/CONTEXTO_A# clear ssh 13728
    ACE/CONTEXTO_A# clear ssh 13732
    ACE/CONTEXTO_A# clear ssh 13735
    ACE/CONTEXTO_A# clear ssh 13737
    ACE/CONTEXTO_A# show ssh session-info
    Session ID     Remote Host         Active Time
    13728          222.98.54.158:50556   67:43:54
    13732          200.44.158.70:46172   67:43:52
    13735          200.44.158.70:46174   67:43:52
    13737          200.44.158.70:46177   67:43:52

    Hello,
    Seems to be working for me in my tests.  Works in the Admin context and a user context, and when clearing connections from console connection or one of the SSH sessions.
    ace-appliance-15/CTX1# sho ssh sess
    Session ID     Remote Host         Active Time
    24705          161.44.77.245:1586     0: 1:42
    25100          161.44.77.245:1589     0: 0:27
    25116          161.44.77.245:1590     0: 0:16
    ace-appliance-15/CTX1# clear ssh 25116
    ace-appliance-15/CTX1#
    ace-appliance-15/CTX1# sho ssh sess
    Session ID     Remote Host         Active Time
    24705          161.44.77.245:1586     0: 2: 5
    25100          161.44.77.245:1589     0: 0:50
    What version of software are you running on your 4710?  I am running the latest A3(2.4).  Can you try this version?
    Thanks,
    Sean

  • ACE 4710 and mangled HTTP requests

    After replacing a Cisco CSS/SSL  Accelorator and PIX firewall with an ACE 4710 to do load balancing and  SSL encryption behind an ASA firewall we started seeing mangled HTTP  requests in the Apache access logs for the servers in the server farm.  Here is one example:
    XX.XX.XXX.XXX  - - [21/Oct/2012:01:42:12 -0500]  "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    Rather  than appearing just after the timestamp, the "POST /register/LServlet"  is tacked on to header information that shouldn't even appear in the  log. Also the first letter in that header information is always missing  (heckoutFlag instead of checkoutFlag in this example). 
    The  mangled request always shows up as a 501 HTTP error and shows up late  in the Apache access logs (timestamp is out of chronogical order) and  always appears with several duplicate POSTs:
    XX.XX.XXX.XXX - - [21/Oct/2012:01:42:23 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XX.XXX  - - [21/Oct/2012:01:42:12 -0500]   "heckoutFlag=true&verifyPassword=false&newsletter=false&emailaddress=&email2=&pass1=&pass2=&username=POST /register/LServlet HTTP/1.1" 501 3322 "https://www.ourwebsite.com/register/CServlet"  "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    XX.XX.XXX.XXX - - [21/Oct/2012:01:44:12 -0500] "POST /register/LServlet HTTP/1.1" 200 8537 "https://www.ourwebsite/register/CServlet" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
    This is occurring for several different URLs and not just the one above and for multiple web browsers.
    The ACE load balances to servers running Tomcat 7 with Apache HTTP server v. 2.2.14.
    A recent ACE software upgrade to A5(2.1) has not fixed the problem.
    Has anyone seen this before?
    Thanks for any insight you can provide.
    -Kari

    Hi Kari,
    Do you have a sample of the configuration which you got with the CSS?
    What is the current configuration which you got on the ACE?
    Can you shows this output: # show stats http?
    Jorge

Maybe you are looking for

  • My father has a 1.25 GHz Power PC G4 Mac Mini with 1 GB of memory. He is running 10.5.8. It is running very slowly. Should I do a clean install of his system?

    His internet is very slow though is on a cable modem. Pages take forever to download. Mail doesn't get delivered. I've tried the usual unplug, plug. Maybe it's time for a new machine. He bought his in 2006. The guy is almost 90 (old people and comput

  • DocumentBuilder.parse() fails after CLOB is updated

    I have written a java application that reads XML content stores in a CLOB column in a 9.2.0.5 database. The application works just fine until the contents of the CLOB is modified, then I get the fatal error shown below. I am using classes from the ja

  • Max. no. of Socket (TCP) Connection in Java

    Dear All, Made a java based chat program for a business application. Having serious problem, when the number of users exceeds 28 all the client sockets connected to the server throws java.io.EOFException. Tested the server in couple of machines, when

  • File Export is greyed out in after effects

    I was working on a movie project to export into flash professional but when i get to the export function its greyed out.... i've done this action a few days ago and it worked fine now i can't do it. I thought because i imported different jpegs into t

  • Tabs in Portal

    Hi, I have a number of different pages that I would like to be able to open. Please see pic: http://www.geocities.com/craigygee/screen1.jpg When I click on the links on the left, the page refreshed within the iVIEW. Would i would like it to do is lea