Load balancing imbalance in ACE

We are facing slowness an http application which is due to connection imbalance. This setup has one set of Load balancer and a proxy in DMZ where the connections gets terminated from the users and a load balancer inside LAN which load balances between the end point servers. All user connections terminate on the DMZ load balancer / proxy and proxy connects back to the internal load balancer VIP. (By collating a number of connections to very few - default proxy behavior) . Internal load balancer VIP does load balancing based on the number of connections in a least loaded manner and this load balancer doesn’t see how many sessions are beneath each connections and it distributes each connection to server underneath. Thus if one connection has around 100 sessions, another may have only a few and each of this gets forwarded to the end server causing the imbalance.
Is there a way that this imbalance can be tackled in this setup.
Users --> Proxy ---> Load balancer (Cisco ACE) --> Server 1
                                                                                                Server 2
                                                                                                Server 3
Least Connections predictor
HTTP Cookie insert sticky

Hi,
Persistance rebalance should solve the issue for you.
The persistent-rebalance function is required if you have proxy users and the proxy shares one TCP connection between multiple users.
With this behavior, inside a single connection you will see different cookies. Therefore, for each cookie, ACE needs to first detect the new cookie and then loadbalance to the appropriate server.
this is from the admin Guide :
The following example specifies the parameter-map type http command to enable HTTP persistence after it has been disabled:
host1/Admin(config)# parameter-map type http http_parameter_map
Host1/Admin(config-parammap-http)# persistence-rebalance
Please refer the following link for more info :
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_2_0/configuration/slb/guide/classlb.html#wp1062907
hope that helps,
Ajay Kumar

Similar Messages

  • SIP load balancing issue with ACE 4710

    SIP Load balancing Issue with ACE 4710
    I have a Cisco ace 4710 with vesion Version A4(2.2). i configued simple SIP load balancing first without stickiness. without stikeiness we are having a problem because bye packet at the was not going to the same server all the time that left our port in used even though user hang up the phone. its happen randmly. i have a total 20 licenced ports and its fill out very quickly. so i dicided to use the stickiness with call-ID but still same issue. below is the config
    rserver host CIN-VOX-31
      ip address 172.20.130.31
      inservice
    rserver host CIN-VOX-32
      ip address 172.20.130.32
      inservice
    serverfarm host CIN-VOX
      probe SIP-5060
      rserver CIN-VOX-31
        inservice
      rserver CIN-VOX-32
        inservice
    sticky sip-header Call-ID VOX_SIP_GROUP
      timeout 1
      timeout activeconns
      replicate sticky
      serverfarm CIN-VOX
    class-map match-all CIN_VOX_L4_CLASS
      2 match virtual-address 172.22.12.30 any
    class-map match-all CIN_VOX_SIP_L4_CLASS
      2 match virtual-address 172.22.12.30 udp eq sip
    policy-map type loadbalance sip first-match CIN_VOX_LB_SIP_POLICY
      class class-default
        sticky-serverfarm VOX_SIP_GROUP
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
      class CIN_VOX_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    interface vlan 20
      description VIP_DMZ_VLAN
      ip address 172.22.12.4 255.255.255.192
      alias 172.22.12.3 255.255.255.192
      peer ip address 172.22.12.5 255.255.255.192
      access-group input PERMIT-ANY-LB
      service-policy input GLOBAL_DMZ_POLICY
    could you please help me on this...
    thanks
    Rakesh Patel

    I mean there should be one more statement-
    class-map type sip loadbalance match-any CIN_VOX_LB_SIP_POLICY 
    match sip header Call_ID header-value sip:
    and that will be called under-
    policy-map multi-match GLOBAL_DMZ_POLICY
       class CIN_VOX_SIP_L4_CLASS
        loadbalance vip inservice
        loadbalance policy CIN_VOX_LB_SIP_POLICY
        loadbalance vip icmp-reply
    is that missing in your config ?

  • How can ftp service on non-standard port be load balanced using Cisco ACE.

    How can ftp service on non-standard port be load balanced using Cisco ACE.For example ftp service required on tcp 2000 port

    Hi Samarjit,
    you can do this by specifying the port number in the class map that you create . Please find the below mentioend config guide where you can specify the tcp/udp port , range or ports or even the wild card to match the port.
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/administration/guide/mapolcy.html#wp1318826
    Regards
    Abijith

  • Two isp load balancing on cisco ACE(load balancer)

    I don't know much about load balancer(ACE).
    Is this is possible to load balance two isp's on load balancer (ACE). If so, how i can do so , any configuration example, or cisco document.

    Wrong forum, post in "Datacenter". You can move your posting with the Actions panel on the right.

  • Timeouts on non load balanced traffic thru ACE

    I have a backend server creating a connection to a db server outside the ACE environment. This traffic is using the L3 function of the ACE and is not being load balanced. The connection is timing out after 1 hour. I have normalization disabled on the backend server VLAN but not on the front side VLAN of the ACE.
    2 Questions:
    - With normalization disabled do I still need to change the tcp inactivity timeout for this traffic? Or with normalization disabled shouldn't the non load balanced traffic be L3 routed and not effected by the tcp timeout value?
    - Also do I need to disable normalization on the front side VLAN of the ACE?
    thanks,
    kurt

    As per
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/security/guide/tcpipnrm.html#wp1075741
    "Disabling TCP normalization affects only Layer 4 traffic. TCP normalization is always enabled for Layer 7 traffic."
    By disabling TCP normalization the following Layer 4 connection parameters are ignored.
    exceed-mss-----Configure behavior if a packet exceeds MSS
    random-seq-num-disable----Disable TCP sequence number randomization
    reserved-bits-----Configure Reserved bits in TCP header
    syn-data-----Configure behavior for a SYN packet containing data
    tcp-options-----Configure TCP header options
    urgent-flag-----Allow/Clear Urgent flag
    I think you will need "Set timeout inactivity xxxx" command even if "no normalization" command is defined.
    Syed Iftekhar Ahmed

  • Lync 2010 and ACE load balancing

    Hi there,
    Has anyone deployed [or will be deploying] Lync 2010 utilising the ACE as a hardware load balancer. The ACE is not {yet] on the Microsoft list of supported devices for this product, but I am told this because of lack of documentation from Cisco.
    The consensus from a few colleagues is that it should work as it did for OCS, which we have already deployed, so assuming that the set up and operation is similar, there shouldn't be much difference in the configurations.
    regards,
    Glenne.

    Hey Glenne,
    It seems you got that working already but I wanted to share this simple sample:
    parameter-map type http PARAMETER
      set header-maxparse-length 65535
      set content-maxparse-length 65535
    ============================================
    interface vlan 112
      ip address 10.198.16.71 255.255.255.192
      alias 10.198.16.124 255.255.255.192
      peer ip address 10.198.16.72 255.255.255.192
      mac-sticky enable
      access-group input anyone
      nat-pool 25 10.198.16.125 10.198.16.125 netmask 255.255.255.0 pat
      service-policy input ANS-MGT
      service-policy input VIPS
      no shutdown
    ============================================
    policy-map multi-match VIPS
      class LYNC_VIP
        loadbalance policy  LYNC_POLICY
        ssl-proxy server SSL_LYNC_TERMINATION
        loadbalance vip icmp-reply active
        nat dynamic 25 vlan 112
        appl-parameter http advanced-options  PARAMETER
    ============================================
    class-map match-all LYNC_VIP
      2 match virtual-address 10.198.16.125 tcp eq https
    ============================================
    ssl-proxy service SSL_LYNC_TERMINATION
      key tac-key
      cert tac-cert
      chaingroup tac-chaingroup
    ============================================
    policy-map type loadbalance first-match LYNC_POLICY
      class class-default
        sticky-serverfarm LYNC_COOKIE
    ============================================
    sticky http-cookie ACE_COOKIE LYNC_COOKIE
      timeout 30
      replicate sticky
      serverfarm LYNC_FARM
    ============================================
    serverfarm host LYNC_FARM
      rserver LYNC_SERVER1 80
        inservice
      rserver LYNC_SERVER2 80
        inservice
    ============================================
    rserver host LYNC_SERVER1
    ip address 10.198.16.93
    inservice
    rserver host LYNC_SERVER2
    ip address 10.198.16.113
    inservice
    ===========================================
    Jorge

  • Regarding ACE load balancing

    Hi,
    I have one server application with two physical servers clustered with one virtual IP address . I have total six ip addresses for one server : details are given below
    Cluster IP’s :
    Node 1 :
    NIC 1 : 10.10.x.x : physical IP address
    NIC 2 : 172.16.x.x : heartbeat address used in between server
    Node 2 :
    NIC 1 : 10.10.x.x : physical ip address
    NIC 2 : 172.16.x.x : heartbeat address used in between server
    Cluster IP : 10.10.x.x : clustered IP address used to access server
    SQL IP : 10.10.x.x : clustered IP address used to access SQL application .
    now i want to achieve server load-balancing using ACE module. Please suggest to me fulfil this requirement. how to do this ?
    whether i need to remove the virtual IP and directly bind two physical ip to ace virtual ip add.
    How do i check ace server load-balancing configuration with live server .... do we have any tool to check the packet behaviour to confirm that load-balancing is happening properly in between two physical servers :
    Please guide me and share the knowledge .....................

    Hi Vinod,
    You are correct. In order to achieve load-balancing with an ACE blade, you need to configure the addresses of the two severs separately. If you look at the documentation page on cisco.com for ACE (http://www.cisco.com/en/US/products/ps6906/tsd_products_support_model_home.html) you will find sample configuration for the most commont topologies.
    As for how to verify if the load-balancing is working correctly, you can use the command "show serverfarm ", which will list you all the servers in a serverfarm, along with the current and total connection numbers for each of them.

  • ACE Routing Load-Balance problem

    I'm trying to configure a routing load-balance with Cisco ACE Module based on the following scenario:
    local users has a router (R1) as it default gateway, this router (R1) has a default route to the VIP that represent the serverfarm with two linux servers that should be used for Data Shaping over the WAN. I need to balance the traffic over the two linux servers and not necessary over the WAN.
    The problem is that when I set up the local network router default route to VIP the routing process simply stop work ! If I change the route to the real server ip address everything start working again without any problem.
    Follow the configs:
    Local network Router - Static route
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ip route 0.0.0.0 255.255.255.0 10.0.0.1 (VIP address)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Follow the ACE configs:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    access-list 100 line 8 extended permit ip any any
    rserver host rout001
    ip address 10.0.0.32
    inservice
    rserver host rout002
    ip address 10.0.0.31
    inservice
    serverfarm host BLC_ROUTING
    predictor leastconns
    rserver rout001
    inservice
    rserver rout002
    inservice
    class-map match-any VIP
    2 match virtual-address 10.0.0.1 any
    class-map type management match-any mgmt
    2 match protocol icmp any
    3 match protocol telnet any
    4 match protocol ssh any
    policy-map type management first-match access
    class mgmt
    permit
    policy-map type loadbalance first-match INT_router
    class class-default
    serverfarm BLC_ROUTING
    policy-map multi-match VIP
    class VIP
    loadbalance vip inservice
    loadbalance policy INT_router
    loadbalance vip icmp-reply
    interface vlan 6
    bridge-group 10
    access-group input 100
    service-policy input access
    service-policy input VIP
    no shutdown
    interface vlan 8
    bridge-group 10
    access-group input 100
    service-policy input access
    service-policy input VIP
    no shutdown
    interface bvi 10
    ip address 10.0.0.5 255.255.255.0
    no shutdown
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    I tried to change some parameters like "transparent" at serverfarm config and change the "predictor" method to "hash address source" but there was no good results at all.
    Anyone has any idea why this process is not working ?
    Is there any special configuration for this scenario ?
    Regards,
    Ricardo

    Ricardo,
    What is this route ??
    ip route 0.0.0.0 255.255.255.0 10.0.0.1 (VIP address)
    You can't have 0.0.0.0/24.
    You must be missing something ?
    Also, since the vip is part of a vlan with subnet 10.0.0.0/24 you don't need to add a static route to reach that vip.
    It should normally be directly connected to your router.
    With the static route, do you see traffic coming to the ACE module ?
    Does it loadbalance to the server ?
    'show service-policy detail' check the packet counters
    Gilles.

  • Finesse Load Balancing

    In normal case, if the agent is already logged to Finesse primary server. If the primary server goes down, the finesse client would be re-directed to finesse secondary server.
    In this scenario, if an agent tries to access Finesse primary server URL he will get error on his page. He has to again manually try secondary finesse server URL. To avoid this scenario, we are planning to implement load balancing (similar to ACE). In this case, agent will access only virtual IP provided to them to access finesse URL. The load balancer would perform health check of both primary and secondary Finesse servers and route the request.
    Is there any documentation, which discuss about this scenario. Or any one have implemented this.

    I wasn't thinking load balancing in the sense of distributing the load across the two servers.  The idea would be similar to what Venkatesh described above, simply a health check of the primary finesse server and only redirect to the secondary server when the primary server was down.  
    Correct me if I am wrong here, but if the primary finesse server is down agents will only be able to connect to the secondary server if they have the URL correct?  There must be a solution other than providing agents two separate URL's to connect to.

  • Cisco ACE - Firewall load balancing

    I am using two sets of ACE load balancers for load balancing traffic across two firewalls (firewall load balancing).
    The solution works fine. I have a virtual address of 0.0.0.0 in either direction to match traffci going from the internal users to the internet and vice versa.
    The problem is that when I try to manage the load-balanced firewalls (either using SSH (or) HTTPS) from outside, then that connection also gets load balanced and when I try to connect to FW1 then sometimes this connection ends up on FW2 and vice versa and the connection gets dropped. I have a workaround in place where i am using a virtual address per firewall to connect to the real IP address of the firewall.
    Is there any other way of managing firewalls (which are defined as real-servers) in a FWLB setup.
    Attached is the configuration of the external ACE which has the two firewalls defined as the real-servers.
    access-list ALL line 8 extended permit ip any any
    probe icmp ICMP-Probe
      interval 15
      passdetect interval 60
    rserver host FW1-ASA
      ip address 10.11.71.10
      inservice
    rserver host FW2
      ip address 10.11.71.11
      inservice
    serverfarm host Firewalls
      transparent
      predictor leastconns
      rserver FW1-ASA
        inservice
      rserver FW2
        inservice
    serverfarm host Firewalls-NO-LB
      rserver FW1-ASA
        inservice
    serverfarm host Firewalls-NO-LB1
      rserver FW2
        inservice
    sticky ip-netmask 255.255.255.255 address source new-sticky
      timeout activeconns
      serverfarm Firewalls
    This is my workaround for connection to the IP address of the firewalls (for management)
    class-map match-any FW-Real
      2 match virtual-address 10.11.71.254 any
    class-map match-any FW-Real2
      2 match virtual-address 10.11.71.253 any
    class-map type management match-any Remote-Access
      201 match protocol telnet any
      202 match protocol http any
      203 match protocol https any
      204 match protocol ssh any
      205 match protocol snmp any
      206 match protocol icmp any
    class-map match-any fwlb
      2 match virtual-address 0.0.0.0 0.0.0.0 any
    policy-map type management first-match Remote-Management-Policy
      class Remote-Access
        permit
    policy-map type loadbalance first-match FWLB-No-LB
      class class-default
        serverfarm Firewalls-NO-LB
    policy-map type loadbalance first-match FWLB-No-LB1
      class class-default
        serverfarm Firewalls-NO-LB1
    policy-map type loadbalance first-match FWLB-l7slb
      class class-default
        serverfarm Firewalls
    policy-map multi-match Firewall-No-LB
      class FW-Real
        loadbalance vip inservice
        loadbalance policy FWLB-No-LB
    policy-map multi-match Firewall-No-LB1
      class FW-Real2
        loadbalance vip inservice
        loadbalance policy FWLB-No-LB1
    policy-map multi-match int70
      class fwlb
        loadbalance vip inservice
        loadbalance policy FWLB-l7slb
    interface vlan 70
      description "Client side"
      ip address 10.11.70.2 255.255.255.0
      no icmp-guard
      access-group input ALL
      access-group output ALL
      service-policy input Remote-Management-Policy
      service-policy input Firewall-No-LB --> connect to the real IP address of the firewall for management
      service-policy input Firewall-No-LB1  --> connect to the real IP address of the firewall for management
      service-policy input int70
      no shutdown
    interface vlan 71
      description "Firewall side"
      ip address 10.11.71.2 255.255.255.0
      mac-sticky enable
      no icmp-guard
      access-group input ALL
      access-group output ALL
      service-policy input Remote-Management-Policy
      no shutdown

    Hello,
    as i know, there is no others ways.
    You can only reduce your configuration by puting all your class undert the same policy-map:
    policy-map multi-match int70
      class FW-Real
        loadbalance vip inservice
        loadbalance policy FWLB-No-LB
      class FW-Real2
        loadbalance vip inservice
        loadbalance policy FWLB-No-LB1
      class fwlb
        loadbalance vip inservice
        loadbalance policy FWLB-l7slb
    interface vlan 70
      description "Client side"
      ip address 10.11.70.2 255.255.255.0
      no icmp-guard
      access-group input ALL
      access-group output ALL
      service-policy input Remote-Management-Policy
      service-policy input int70
      no shutdown

  • ACE load balancing servers on different subnets...

    Hello,
    I have the following issue.... need to load balance traffic between two servers already working in two different subnets (vlans), at this point is highly desirable to avoid changing IP addresses. Is it possible to accomplish this goal using ACE? routed or bridged mode? is it strictly necessary to have all servers belonging to a serverfarm in the same subnet?
    Thanks in advanced for your support.

    Hi,
    You can do this, but you have to use client-NAT (Source-NAT) to force the return traffic to pass back through the ACE. You also then need static routes in the ACE context to point at each server. PBR is an alternative approach but I have not implemented that in a live network. The important thing is that the ACE sees both sides of the conversation.
    The following extract from a configuration shows the basic principle:
    rserver host master
    ip address 10.199.95.2
    inservice
    rserver host slave
    ip address 10.199.38.68
    inservice
    serverfarm host FARM-web2-Master
    description Serverfarm Master
    probe PROBE-web2
    rserver master
    inservice
    serverfarm host FARM-web2-Slave
    description Serverfarm Slave
    probe PROBE-web2
    rserver slave
    inservice
    class-map match-any L4VIPCLASS
    2 match virtual-address 10.199.80.12 tcp eq www
    3 match virtual-address 10.199.80.12 tcp eq https
    policy-map type management first-match REMOTE-MGMT-ALLOW-POLICY
    class REMOTE-ACCESS
    permit
    policy-map type loadbalance first-match LB-POLICY
    class class-default
    serverfarm FARM-web2-Master backup FARM-web2-Slave
    policy-map multi-match L4POLICY
    class L4VIPCLASS
    loadbalance vip inservice
    loadbalance policy LB-POLICY
    loadbalance vip icmp-reply active
    loadbalance vip advertise
    nat dynamic 1 vlan 384
    service-policy input L4POLICY
    interface vlan 383
    description ACE-web2-Clientside
    ip address 10.199.80.13 255.255.255.248
    alias 10.199.80.12 255.255.255.248
    peer ip address 10.199.80.14 255.255.255.248
    access-group input ACL-IN
    access-group output PERMIT-ALL
    no shutdown
    interface vlan 384
    description ACE-web2-Serverside
    ip address 10.199.80.18 255.255.255.240
    alias 10.199.80.17 255.255.255.240
    peer ip address 10.199.80.19 255.255.255.240
    access-group input PERMIT-ALL
    access-group output PERMIT-ALL
    nat-pool 1 10.199.80.20 10.199.80.20 netmask 255.255.255.240 pat
    no shutdown
    ip route 0.0.0.0 0.0.0.0 10.199.80.9
    ip route 10.199.95.2 255.255.255.255 10.199.80.21
    ip route 10.199.38.68 255.255.255.255 10.199.80.21
    HTH
    Cathy

  • ACE 4700 load balancing Issue

    Hi,
    I am new in ACE 4700. I have configured ACE 4700 for load balancing the FAX servers. Probe, ServerFarm, Real server, Virtual server, VIP state every thing is up and in service. But I am not able to access the real server using VIP IP address.
    Below is the running configuration. Please help me to troubleshot the problem.
    HOB-ACE-1/Admin# sh run
    Generating configuration....
    no ft auto-sync startup-config
    boot system image:c4710ace-mz.A3_2_0.bin
    hostname HOB-ACE-1
    interface gigabitEthernet 1/1
      description Man_HOB_1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      description VIP_HOB_1
      switchport access vlan 24
      no shutdown
    interface gigabitEthernet 1/3
      description HA_HOB_1
      switchport access vlan 180
      no shutdown
    interface gigabitEthernet 1/4
      shutdown
    [7m--More-- [m
    access-list ALL line 8 extended permit ip any any
    probe icmp ICMP_PROBE1
      interval 15
      faildetect 4
      passdetect interval 60
      passdetect count 5
      receive 5
    rserver host MFREFSAS497
      description MAAFAXSERVER
      ip address 10.16.12.148
      conn-limit max 4000000 min 4000000
      inservice
    rserver host MSHOFCFS489
      description HOBFAXSERVER
      ip address 10.26.12.130
      conn-limit max 4000000 min 4000000
      inservice
    [7m--More-- [m
    [K
    serverfarm host SFHOBACE-1
      description SFHOBACE-1
      predictor hash header Accept
      probe ICMP_PROBE1
      rserver MFREFSAS497 80
        conn-limit max 4000000 min 4000000
        inservice
      rserver MSHOFCFS489 80
        conn-limit max 4000000 min 4000000
        inservice
    class-map match-all VSHOBACE-1
      2 match virtual-address 10.26.24.242 any
    class-map type management match-any remote_access
      201 match protocol xml-https any
      202 match protocol icmp any
      203 match protocol telnet any
      204 match protocol ssh any
      205 match protocol http any
      206 match protocol https any
      207 match protocol snmp any
    [7m--More-- [m
    [K
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match VSHOBACE-1-l7slb
      class class-default
        serverfarm SFHOBACE-1
    policy-map multi-match global
      class VSHOBACE-1
        loadbalance vip inservice
        loadbalance policy VSHOBACE-1-l7slb
        loadbalance vip icmp-reply
        nat dynamic 1 vlan 24
        nat dynamic 1 vlan 1000
    service-policy input global
    interface vlan 24
      description "Client VLAN"
      ip address 10.26.24.243 255.255.255.0
    [7m--More-- [m
      access-group input ALL
      no shutdown
    interface vlan 1000
      ip address 10.26.12.132 255.255.255.0
      peer ip address 10.26.12.133 255.255.255.0
      access-group input ALL
      service-policy input remote_mgmt_allow_policy
      no shutdown
    ft interface vlan 180
      ip address 192.168.180.2 255.255.255.248
      peer ip address 192.168.180.3 255.255.255.248
      no shutdown
    ft peer 1
      heartbeat interval 300
      heartbeat count 10
      ft-interface vlan 180
    ft group 1
      peer 1
      priority 140
      associate-context Admin
    [7m--More-- [m
      inservice
    ip route 0.0.0.0 0.0.0.0 10.26.12.1
    snmp-server contact "HOB_ACE"
    snmp-server location "HOB"
    snmp-server community FAXSERVER group Network-Monitor
    snmp-server user administrator Network-Monitor
    snmp-server trap-source vlan 1000
    username admin password 5 $1$GtO1e504$eGuyxxDcXck7SkxqBfRkI.  role Admin domain
    default-domain
    username www password 5 $1$N5ClX7jy$kDhGgN.uukWQKvQMd3pY.1  role Admin domain de
    fault-domain
    ssh key rsa 1024 force
    Thanks and Regards,
    Ashfaque

    Hello Hossain,
    Applying the policy globally on the box is commonly not the prefered way to go, you can use instead a single multi-match policy per SVI for easier managent; this will also also help to narrow down problems to a specific policy and VIP while T-Shooting.
    Use the
    ACE/Admin(config)# no service-policy input global
    ACE/Admin(config)# interface vlan 24
    ACE/Admin(config-if)# service-policy input global
    Also you want to remove the NAT from the multi-match policy, you're running in routed mode so NAT should not be required; if it was required then you don't have any natpool configured or as Ahmad mentioned it was truncated from the configuration.
    Something that caught up my attention is that your default route is pointing to the server VLAN that happens to be also your management VLAN, I'll have to lab it up but my first impression is that either the traffic coming to the VIP on vlan 24 should be always NAT'd to an IP of 10.26.24.X/24 before it gets to the ACE or else there will be a routing loop that will not allow the flow to complete correctly.
    Do you happen to have a quick logical diagram of this piece of the network?
    Thnx
    Pablo

  • ACE Load Balancing Problem

    Hi,
    I have ACE 4701 with c4710ace-mz.A3_2_2.bin image. In the current setup ACE is located in the center of network where all the WAN, Intenret and LAN is connected and ACE has default towards Internet and All other segment has default route towards ACE appliance. ACe is only redirecting the port 80 traffic to my Proxy server and bypass my lan subnet on port 80.
    Internet
    i
    i
    i
    i
    i
    ACE--------------------------------WAN
    i
    i
    i
    i
    LAN
    I want to use ACE for the load balancing of two servers. Today I did the load balancing configuration but as soon as I applied the policy map on the interface vlan 200 and 300, my complete network reachability went down. When I remove the policy my network came back to normal.
    192.168.200.66  FAX Server-1
    192.1168.200.67 FAX Server-2
    192.168.200.65   Virtual IP address
    Attached is the configuration that I did on ACE for the load balancing and below is the current configuration of the ACE appliance.
    access-list acl-in remark ACCESS LIST FOR ACE-INSIDE
    access-list acl-in line 1 extended permit ip any any
    access-list acl-out remark ACCESS LIST FOR ACE-OUTSIDE
    access-list acl-out line 1 extended permit ip any any
    access-list acl-proxy remark ACCESS LIST FOR PROXY SEGMENT
    access-list acl-proxy line 1 extended permit ip any any
    access-list acl-wan remark ACCESS LIST FOR WAN SEGMENT
    access-list acl-wan line 1 extended permit ip any any
    probe tcp PROBE_5050
    port 5050
    interval 15
    passdetect interval 60
    open 1
    probe tcp PROBE_5101
    port 5101
    interval 15
    passdetect interval 60
    open 1
    probe tcp PROBE_TCP
    port 80
    interval 15
    passdetect interval 60
    open 1
    parameter-map type http PARAMAP_CASE
    case-insensitive
    no persistence-rebalance
    rserver host RS_BCPR01
    ip address 192.168.0.103
    inservice
    rserver host RS_BCPR02
    ip address 192.168.0.104
    inservice
    rserver host RT_fax1
    description Right Fax Server-1
    ip address 192.168.200.66
    rserver host RT_fax2
    description Right Fax Server-2
    ip address 192.168.200.67
    serverfarm host SF_BCPR
    transparent
    probe PROBE_5050
    probe PROBE_5101
    probe PROBE_TCP
    rserver RS_BCPR01
    inservice
    rserver RS_BCPR02
    inservice
    serverfarm host SF_RT_fax
    rserver RT_fax1
    rserver RT_fax2
    sticky ip-netmask 255.255.255.255 address source STICKY-SOURCE
    replicate sticky
    serverfarm SF_BCPR
    sticky ip-netmask 255.255.255.255 address source FAX-STICKY
    replicate sticky
    serverfarm SF_RT_fax
    class-map type management match-any CM_ALL
    2 match protocol snmp any
    3 match protocol http any
    4 match protocol https any
    5 match protocol icmp any
    6 match protocol telnet any
    class-map match-any CM_BYPASS_FOR_LAN
    3 match virtual-address 100.1.1.0 255.255.255.0 tcp eq www
    8 match virtual-address 10.0.0.0 255.0.0.0 tcp eq www
    9 match virtual-address 172.16.0.0 255.255.0.0 tcp eq www
    10 match virtual-address 192.168.0.0 255.255.0.0 tcp eq www
    class-map match-any CM_BYPASS_SUBNET
    9 match virtual-address 100.0.0.0 255.0.0.0 tcp eq www
    13 match virtual-address 10.0.0.0 255.0.0.0 tcp eq www
    14 match virtual-address 172.16.0.0 255.255.0.0 tcp eq www
    15 match virtual-address 192.168.0.0 255.255.0.0 tcp eq www
    class-map match-any CM_IM
    2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 5050
    3 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 1080
    4 match virtual-address 0.0.0.0 0.0.0.0 tcp eq 5101
    class-map match-all CM_SF_BCPR
    255 match virtual-address 0.0.0.0 0.0.0.0 tcp eq www
    class-map match-any RT_FAX
    2 match virtual-address 192.168.200.65 0.0.0.0 any
    policy-map type management first-match PM_ALL
    class CM_ALL
    permit
    policy-map type loadbalance http first-match PM_L7_BYPASS_FOR_LAN_HTTP
    class class-default
    forward
    policy-map type loadbalance http first-match PM_L7_BYPASS_HTTP
    class class-default
    forward
    policy-map type loadbalance first-match PM_LB_RT_FAX
    class class-default
    sticky-serverfarm FAX-STICKY
    policy-map type loadbalance http first-match PM_LB_SF_BCPROXY
    class class-default
    sticky-serverfarm STICKY-SOURCE
    policy-map multi-match PM_BYPASS_FOR_LAN_HTTP
    class CM_BYPASS_FOR_LAN
    loadbalance vip inservice
    loadbalance policy PM_L7_BYPASS_FOR_LAN_HTTP
    policy-map multi-match PM_BYPASS_HTTP
    class CM_BYPASS_SUBNET
    loadbalance vip inservice
    loadbalance policy PM_L7_BYPASS_HTTP
    policy-map multi-match PM_MAIN_BCPROXY
    class CM_SF_BCPR
    loadbalance vip inservice
    loadbalance policy PM_LB_SF_BCPROXY
    loadbalance vip icmp-reply active
    appl-parameter http advanced-options PARAMAP_CASE
    class CM_IM
    loadbalance vip inservice
    loadbalance policy PM_LB_SF_BCPROXY
    policy-map multi-match PM_RT_FAX
    class RT_FAX
    loadbalance vip inservice
    loadbalance policy PM_LB_RT_FAX
    service-policy input PM_ALL
    interface vlan 100
    description FW-INSIDE CONTEXT RACK1
    ip address 192.168.0.5 255.255.255.224
    alias 192.168.0.11 255.255.255.224
    peer ip address 192.168.0.6 255.255.255.224
    mac-address autogenerate
    no icmp-guard
    access-group input acl-out
    no shutdown
    interface vlan 200
    description WAN-VLAN CONTEXT RACK1
    ip address 192.168.0.33 255.255.255.224
    alias 192.168.0.43 255.255.255.224
    peer ip address 192.168.0.34 255.255.255.224
    mac-address autogenerate
    access-group input acl-wan
    service-policy input PM_BYPASS_HTTP
    service-policy input PM_MAIN_BCPROXY
    no shutdown
    interface vlan 300
    description ACE-INSIDE CONTEXT RACK1
    ip address 192.168.0.65 255.255.255.224
    alias 192.168.0.73 255.255.255.224
    peer ip address 192.168.0.66 255.255.255.224
    mac-address autogenerate
    access-group input acl-in
    service-policy input PM_BYPASS_FOR_LAN_HTTP
    service-policy input PM_BYPASS_HTTP
    service-policy input PM_MAIN_BCPROXY
    no shutdown
    interface vlan 301
    description BC-VLAN CONTEXT RACK1
    ip address 192.168.0.97 255.255.255.224
    alias 192.168.0.107 255.255.255.224
    peer ip address 192.168.0.98 255.255.255.224
    mac-address autogenerate
    access-group input acl-proxy
    no shutdown
    ft track interface TRACKING_FOR_FT_VLAN
    track-interface vlan 300
    peer track-interface vlan 300
    priority 255
    peer priority 255
    ip route 0.0.0.0 0.0.0.0 192.168.0.1
    Please help me out what i am missing. Is there any limitation on policy map or my bypass subnet list is creating problem. 

    I did these changes this time nothing disconnected but I am not able to do the Remote desktop on the virtual IP address. Real IP has Remote desktop enabled even VIP is not ping able for me.
    rserver host RT_fax1
      description Right Fax Server-1
      ip address 192.168.200.66
      inservice
    rserver host RT_fax2
      description Right Fax Server-2
      ip address 192.168.200.67
      inservice
    serverfarm host SF_RT_fax
      rserver RT_fax1
        inservice
      rserver RT_fax2
        inservice
    policy-map type loadbalance rdp first-match PM_LB_RT_FAX
      class class-default
        serverfarm SF_RT_fax
    policy-map multi-match PM_RT_FAX
      class RT_FAX
        loadbalance vip inservice
        loadbalance policy PM_LB_RT_FAX
        loadbalance vip icmp-reply active
    interface vlan 200
      description WAN-VLAN CONTEXT RACK1
      ip address 192.168.0.33 255.255.255.224
      alias 192.168.0.43 255.255.255.224
      peer ip address 192.168.0.34 255.255.255.224
      mac-address autogenerate
      access-group input acl-wan
      service-policy input PM_BYPASS_HTTP
      service-policy input PM_MAIN_BCPROXY
      service-policy input PM_RT_FAX
      no shutdown
    interface vlan 300
      description ACE-INSIDE CONTEXT RACK1
      ip address 192.168.0.65 255.255.255.224
      alias 192.168.0.73 255.255.255.224
      peer ip address 192.168.0.66 255.255.255.224
      mac-address autogenerate
      access-group input acl-in
      service-policy input PM_BYPASS_FOR_LAN_HTTP
      service-policy input PM_BYPASS_HTTP
      service-policy input PM_MAIN_BCPROXY
      service-policy input PM_RT_FAX
      no shutdown
    But nothing is working for me. Please help me out. This time i didnt configure the sticky. But in real I will go with sticky and complete IP protocol will be use a VIP. Please help me out.

  • ACE load-balancing-Cookie problem

    In our other load-balancing environments the load-balancer-cookie contains the encrypted (real) servername or ip-address.
    We think it's the same on the cisco, for that reason it's in theory not possible, that there are two 'green'-cookies with different values in the same request.
    There are only two possibilities how this could happen:
    a) The healthmonitor (http_probe) fails, the loadbalancer 'thinks' that the realserver is down and redistributes the traffic.
    But in that case we would expect, that the old cookie will be overwritten by the new one and not simply added to the http-header.
    b) The predictor in the serverfarm chooses a new realserver within the same request.
    If that is really the cause of that problem this would be bug in the cisco ace.
    What we found out, is that the loadbalancer performs a 'Set-Cookie'-Operation an every request even if the client submits the cookie correctly.
    For example:
    GET /ips-opdata/scripts/jquery.js HTTP/1.1
    Host: www.xxxxx.com
    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15
    Accept: */*
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 115
    Connection: keep-alive
    Referer: http://www.xxxxx.com/
    Cookie: green=R339366665; JSESSIONID=28D91FC6FD62A3921354BB36826294C4
    HTTP/1.1 200 OK
    Set-Cookie: green=R339366665; path=/; expires=Tue, 29-Mar-2011 06:33:00 GMT
    Server: Apache-Coyote/1.1
    X-Powered-By: Servlet 2.4; JBoss-4.2.2.GA (build: SVNTag=JBoss_4_2_2_GA date=200710221139)/Tomcat-5.5
    ETag: W/"72181-1298537508000"
    Last-Modified: Thu, 24 Feb 2011 08:51:48 GMT
    Content-Type: text/javascript
    Content-Length: 72181
    Date: Mon, 28 Mar 2011 06:15:19 GMT
    As you can see the cookies: green=R339366665 is transmitted from the client, but the loadbalancer does a Set-Cookie Operation of the same cookie once again. This is an unexpected behaviour.
    We hope that this helps you to figure out the reason of the problem.

    The cookie is sent by the ACE on each response to refresh the timeout value on the client. The value of the cookie doesn't change. This is the expected behaviour and shouldn't break anything in the application / browser.
    For browser-based applications, don't forget to add the "browser-expire" parameter to your cookie-based stickyness config.

  • FTP Load Balancing on ACE 4710

    Hi,
    I have two ACEs working in ROUTED-MODE. In the servers there are HTTP content and FTP content.
    - The load balancing is working in correct form.
    Now, I have a problem: The client wants to performs a FTP request to server in Internet from server belong to server farm configured in the ACE.
    In simple words, now the server belonging to the farm will be the client for the FTP server in Internet. The client can connect to the Internet FTP, he enter his username and password, but when he want to transfer data (command as ls, get, put) the connection is closed.
    - When the client makes the FTP comes with the VIP address 200.29.72.226 to the intenet FTP.
    - I have a capture when is performing the command "ls" and the connection was closed: The ACE stated:
    12:42:11.079794 00:08:74:4e:d4:67 > 00:0b:fc:fe:1b:01, ethertype 802.1Q (0x8100), length 79: vlan 2, p 0, ethertype IPv4, IP (tos 0x0, ttl 128, id 28479, offset 0, flags [DF], length: 61) 10.3.2.1.1911 > 200.54.172.202.21: P [tcp sum ok] 37:58(21) ack 161 win 16400
    12:42:11.079957 00:0b:fc:fe:1b:01 > 00:e0:b6:04:14:49, ethertype 802.1Q (0x8100), length 79: vlan 2, p 0, ethertype IPv4, IP (tos 0x0, ttl 128, id 28479, offset 0, flags [DF], length: 61, bad cksum a77 (->57b)!) 200.29.72.226.39292 > 200.54.172.202.21: P [bad tcp cksum 7d15 (->4ce)!] 37:58(21) ack 161 win 16400
    12:42:11.080088 00:e0:b6:04:14:49 > 00:0b:fc:fe:1b:01, ethertype 802.1Q (0x8100), length 79: vlan 46, p 0, ethertype IPv4, IP (tos 0x0, ttl 128, id 28479, offset 0, flags [DF], length: 61) 200.54.172.202.21 > 200.29.72.226.39292: R [tcp sum ok] 161:182(21) ack 37 win 16400 [RST PORT 10,3,2,1,7,191\015\012]
    12:42:11.079212 00:0b:fc:fe:1b:01 > 00:08:74:4e:d4:68, ethertype 802.1Q (0x8100), length 79: vlan 46, p 0, ethertype IPv4, IP (tos 0x0, ttl 128, id 28479, offset 0, flags [DF], length: 61, bad cksum 57b (->a77)!) 200.54.172.202.21 > 10.3.2.1.1911: R [bad tcp cksum 4d2 (->7d19)!] 161:182(21) ack 37 win 16400 [RST PORT 10,3,2,1,7,191\015\012]
    I atached a diagram of situation and actual configuration.
    I appreciate your help
    Thanks and regards,
    Jaime.

    Thanks Gilles! 
    I applied the commands you told me. I performed laboratory tests and it worked fine.
    Then I apply in the ACE of client and the results were positive.
    Thanks you very much again.
    Jaime.

Maybe you are looking for