Im trying to configure an ACE 4700 so that SSL termination is done on the ACE and HTTP reaches the weblogic server instance. I have a working setup of a Apache reverse proxy doing SSL offloading and using a weblogic module and that works fine Was reading [URL]. Any working config example for doing this with the ACE4700
View 2 RepliesWe are evaluating the one-arm design for the ACE 4700 and need some clarifications:
1. Are there any limitations in the one-arm design and the SSL offloading
2. Can the ACE be configured with an IN and an OUT vlan to the router
CLIENT -> Router -> ACE IN -> ACE OUT -> Router -> Server Vlan
so that the SSL and the clear text traffic is in a separate Vlan?
3. In some sample configuration i saw SNAT configuration on the ACE to modify the client IP. This i assume is for instructing the return traffic from the server to go through ACE? Using SNAT we eliminate the requirement for NAT or PBR on the router? Will i still be able to insert the client IP address after the SSL offload?
We are planning to deploy a Application Controle Engine - ACE family - and need to close the gap related to OWASP threat list masures.for what i could find in the information about ACE solution it seems that ACE does'nt have OWASP relations and need to deploy a IPS (Intrusion Prevention System) which seems to hold and apply to OWASP threat list vulnerabilities.question is it possible to deploy a ACE 4710 with a IPS 4200 as one or a inline deployment scenario ?
View 1 Replies View RelatedI'm running an ACE 4700 appliance, i have a 4 server serverfarm setup, non-ssl, with leastconns predictor...i have tried round robin as well, and nothing...
I've taken each rserver out of service, and placed back in, and still, the traffic is handed off only to 1 server...
I do have sticky persistence (IP subnet)...
we configued An ACE 4710 with SSL termination on Oracle Aplication Server 10g (10.1.2.0.2) ,so that SSL termination is done on the ACE and HTTP reaches the Oracle Aplication Server 10g (10.1.2.0.2) then we configure the ACE to enabled client authentication with Pkcs#11 smart card token certificate and this don succfully my problem need do this client certificate authentication for only the [URL] not for all SSL proxy service how can do that.
View 3 Replies View RelatedI am tasked to Configure an ACE 4700 for SLB. This has been done and working. Am also further tasked to create a secure communication between tha ACE and Exchange server. I need the breakdown of steps required to Import certificate from the exchange server, and how to verify that things are working.
View 3 Replies View RelatedI have a client that I recently replaced their GSS's for and last evening I cut them over to an HA pair of ACE 4700's. After about an hour, it looks like the GSS and ACE stopped communicating with each other. When this happened, they switched back over to the old CSS appliances and everything came back up fine. Apparently this happened the last time they tried to cutover to the ACE and they contacted TAC. TAC told them the issue happened because the GSS's they were running at the time were EOL. So now, with brand new GSS's, they are experiencing the same issue.
As of now, the ACE's are offline and I cannot get into them to see what the issue may be. We tested the sites out last night after the cutover and everything seemed fine. There was one minor problem that I resolved quickly, but that was it and then we left. The client started getting emails about an hour later about their main website being down. They do have the ACE logging to a syslog server, so we will look at that to see if there is anything relavent. I suggested that we bring up a test site to use through the GSS/ACE and see what happens. They have another CSS that they can run their sites through, so this option will work without taking down all of their other sites.
How to configure a redirection on the ACE from HTTP to HTTPS using specific URL example [URL] to [URL], the SSL certificates were installed on the servers.
View 7 Replies View Relateddo you know what happens if you reach the limit of, for instance 100 Mbps, compression. I know that if you reach the bandwidth limit ACE will drop packets but if you configure compression what happens if you have 110 Mbps.
I supossed that ACE will compress 100 Mbps and leave 10 Mbps without compression but I don't find this information anywhere.
I've configure two ACE 4700 in a SLB modus http to a web server.To understand how the ACE works and to see if all are ok, I want to test it? but how?
How do I do to initiate a http connection between my test pc to the webserver through the ACE?
Currently running an ACE 4710, which is handling all of our inbound SSL connections and then forwarding requests thru to backend web servers. This all works fine.
My question is this..Right now we are not load balancing any of the backen web servers. But I now have a requirement that should a web server crash or become unavailable I need to redirect that backend connection to another web server.
Scenario is more like I have 2 web servers both serving same content, but I want one server to take all the connections unless it fails, at that point have all the connections forwarded to 2nd server.Is there a way to setup the load balancing where the 1st server gets all the connections until a failure happens ?
I am having two sites, at one site the ISP is terminated on 2900 Router and at one site ISP is terminated on 3500 L3 Switch. Now need to configure the IP SLA on this. In the current setup I am having two 2900 routers at one location and 3500 L3 switches which by point to point link.
View 1 Replies View RelatedI have a problem configuring URL redirect on ACE 30 (Version A4(1.0)).When a user enters IP address or a name of a service [URL], the ACE module should redirect him to the page [URL]. Here is my non-working config:
access-list OUTSIDE line 8 extended permit tcp any any eq https access-list OUTSIDE line 16 extended permit tcp any any eq www access-list OUTSIDE line 24 extended permit icmp any any
probe http Test_HTTP_1 port 80 interval 60 passdetect interval 30 passdetect count 2 request method head url /index.html expect status 200 200 open 1
rserver redirect URL_Redirect_01 webhost-redirection [URL] 302 inservicerserver host S1 ip address 10.0.0.2
inservicerserver host S2 ip address 10.0.0.3
[code]....
it works, ACE load balances to rservers. Of course, user must enter full url.With redirection configured, user recieves HTTP url redirect message with correct address [URL], but his browser does not display the page. Even directly entered full url does not display it while redirection is configured.Alternatively, does ACE30 already support url rewrite?
I have 2 ACE4710 in HA enviroment, they receive connection from Internet. What I need to configure is following:
The ACE have configured two URL, with the same port and VIP Address, for example:
URL-1: www.xxxxx.com
URL-2: www.xxxxx.com/Admin
VIP Address: 10.10.10.10
Port: 8443
All clients point to unique VIP and Port configured, I need to know if I can apply any filter or rule that allows me to distinguish when a customer goes to the URL1 or URL2.If any client try to access to URL-2, your traffic must be deny.In summary, from Internet I should be able to go only to URL-1.
We are deploying a Microsoft Exchange 2010 server environment, which will have a ACE 4710 front end. What we are finding is that if a server goes down, a client will need to re-authenticate to a new server. The server team has informed me that if they use Microsoft SLB this does not happen. They have also mentioned that we are getting basic authentication, rather than NTLM. As a result I have read several posts/articles which mention forcing NTLM on the ACE, but none go into real detail.
A couple of official Cisco documents point to having the Exchange Server, and Client both set to use NTLM. So on the server you do not need to select MAPI encryption. I am told this is not an option here, because a multitude of clients are supported, from Outlook 2003, through to 2010.
I have a request to configure an ACE30 for Oracle Hyperion utilizing SSL termination at the SSL offloader(ACE30). Any sample configuration or template of some sort that could guide me through what needs to be configured. We have many applications on the ACE#) but this is the first time we are going to try SSL termination.
View 3 Replies View RelatedWe are using an ACE20 module running version A2(3.2).I have a question regarding IP stickyness and the timeout parameter.I found this in the "Server load balancing configuration guide" (in a section entitled: "Configuring a Timeout for IP Address Stickiness"):
"The sticky timeout specifies the period of time that the ACE keeps (if possible) the IP address sticky information for a client connection in the sticky table after the latest client connection terminates. The ACE resets the sticky timer for a specific sticky-table entry each time that the module opens a new connection or receives a new HTTP GET on an existing connection that matches that entry."
The parts in bold seem to point to the fact that the timeout is an "inactivity timeout" as the counter is reset on every new connection.The next section in the documentation is entitled: "Enabling an IP Address Sticky Timeout to Override Active Connections" and says:
"By default, the ACE ages out a sticky table entry when the timeout for that entry expires and no active connections matching that entry exist. To specify that the ACE time out IP address sticky table entries even if active connections exist after the sticky timer expires, use the timeout activeconns command."
This seems to contradict the previous statement.So my question is: is the IP stickyness timeout an "inactivity timeout" or not?
I need configure HTTP Compression by hardware on CSS 11503. I make config like this [URL]
My config:
service s1
ip address 10.1.66.11 (web server)
keepalive type none
[Code].....
I have trouble with new installation LB ACE 4710 for Oracle application load balance. Problem: Unable to PING VIP - 10.11.10.55 / 24
Below are the simple configuration parameters:
1. ACE 4710 is connected with Cisco 3560 Switch - L2 Trunk (Channel Group)
2. Cisco 3560 Switch is connected with Cisco 6500 Switch (Core) also L2 Trunk
3. There are 3 Vlans,(255, 310, and 370), Vlan 255 is management Vlan
4. Real Servers and Virtual IP are part of Vlan 310
- VIP - 10.11.10.55
- Real Server1 - 10.11.10.46
- Real Server2 - 10.11.10.47
5. Gateway is 10.11.10.1 (vlan 310), 10.11.70.1 (Vlan 370)
I put multiple rservers in multiple server farms?
So for example rserver1 and rserver2 are put in serverfarm production1 and are in use with particular sticky and load balancing settings.
Can I then create serverfarm test_production and put both rserver1 and rserver2 in it? Then play around with the sticky and load balancing settings as a test without affecting the production serverfarm.
I'm trying to design a CSS configuration that allows servers in the same vlan to be the source and destination of load-balanced traffic. My thought is to add two new vlans, one for the VIPs and one for the servers, then NAT the source IPs going from the LB to the servers.
Is this the right way to do it?I've never NATted using CSSs, so I wanted to verify what I'm thinking.Our current config trunks the vlans -
interface 1/1
trunk
vlan 1
default-vlan
vlan 555
[code]....
Does anyone have or know of a tried and true method of configuring a Windows Server 2008 box to provide authentication/accounting services for Cisco devices. I've read a few websites already and a lot of them seem to be geared toward VPN and some of the settings each site goes through are different.I've got NPS installed and a RADIUS client configured with the shared key. Right now I'm in the process of creating the Network Policy which only allows a Windows "admin" group to log in. Curious about the "Constraints" section where the NAS Port Type is selected and the "Settings" section where the service-type and vendor specific options are configured.
View 18 Replies View RelatedIm trying to configure remote access VPN on ASA5505. I configured it as local CA server, installed digital certificate on remote station and everything looks fine as far as i can see. I'm using cisco VPN client 5.0 on remote station. when i initiate VPN session it fails while trying to connect. Looks like im missing some configuration but i cannot figure out what it is. Currently i have firewall configured to use group authentication and everything works fine. I want to switch it to use certificate authentication, and if possible, confiure firewall to use main mode instead of aggressive mode for better security.
View 4 Replies View Relatedi have a new server but the ISP gave me this address
IP 41.221.92.150
S/Mask 255.255.255.252
Gateway 41.221.92.145
P/DNS 41.221.87.2
A/DNS 41.221.81.132
how should I configure my server and the client cpu?
I have cisco router model 1921 , how can i terminate my existing pppoe connection to 1921, so that my other LAN users can use internet.
1- One cable (RJ45) which is comming from ONT has connected with Integrated WAN Port on router.
2- One cable (RJ45) which going to my LAN switch has connected with Integrated LAN Port on router.
Now i need to configure my router, so that i can give internet access to my LAN users. I red cisco's guides but not clear regarding configurations, because in guides they use modules to configure pppoe. But i am not using any module, i am simply connecting one cable for WAN and one for LAN.
Our HQ Location dont support high bandwidth pipe served by ISP, so will go ahead with 3 different ISP at 2MB each.Goal is to provide Email / Application access to Remote office using site to site VPN.In Total will have 10 to 15 Branch offices each with around 25 to 35 users
Each ISP will give
/29 subnet of public IPCopper Interface for WANdefault Gateway and Two DNS server IP will be provide Existing hardware we got are Cisco 2821 Router with 2 FastEthernet ports ( not in use )24 port switch 2900 series ( not in use ) Can we use the above hardware to terminate all 3 ISP link and use the Router for site to site VPN.
Our Lan Core is Cisco 3560 which is uplink to 3X2950 user switch?how should we terminate the link and use each ISP for VPN.
I have a Hp 4700 all in one wireless printer. I am able to print with no problem. I just can't copy or scan. when you first turn the pritner on it comes up with a scan/copy error. I have tired everything and nothing works.
View 1 Replies View RelatedI have a small lan of around 10 computers in my office which are connected through a switch connected to a airtel broadband connection. I want to configure a network server so that I could manage an control the internet traffic used by all the workstations in the lan through that server. All the workstations have either WinXP or Windows 7 on it. I haven't purchased a server. I want to use a desktop(having some good configuration) as my network server.
View 6 Replies View RelatedConfigured a DP-G310 Print Server to work with the DIR 655? I have upgraded the firmware so I have WPA Security. I have typed in the WPA key in the DP-G310 setup. The DIR 655 sees the DP-G310 but it won't assign it an IP address. I can see the DP-G310 MAC address in the DIR 655 wireless status page but the IP is 0.0.0.0 and it disappears and reappears in the wireless connections list.
View 3 Replies View RelatedI read in the Cisco IOS ASA documentation (8.x) that some group-policy attribues are only available for soft-VPN clients while some are available for both soft-VPN clients and L2L VPN clients. Cisco didn't clearly specify which attributes were available for which clients.
To aid me in troubleshooting my L2L VPN setup could someone indicate if the order of events (listed below) is correct for ASA 5520 with IOS 8.x and if the attributes selected are available for L2L VPN clients?Also, are there "show" commands to reveal more details about tunnel-groups, group-policy, etc. when used with VPNs?
We are going to purchase a Device , thte sites and also VPN server for remote access ( EzVPN), Should we use ASA or should we use Cisco 1800 series router with security software. The main purpose of this device is to terminate all VPN connections ( Site-to-site) and remote access.
View 1 Replies View RelatedWe have recently installed Cisco for our wireless solution. We are an education and are looking to let staff and pupils bring their own devices. The route that we are planning to take to let them join the school's WiFi is to implement a RADIUS server so that they can authenticate with their Active Directory username and password. I have tried to test the solution but so far without any success. I am using a Windows Server 2008 R2 as my NPS server, I have setup the Cisco controller as per below:
Security Tab | RADIUS | Authentication - I added my windows server there and the preshared key, the Network User and Management is ticket and the server responds to a ping command,In the WLANs Tab, I selected my test WLAN and under Security | AAA Servers I selected the RADIUS server that I configured in the Security TabI then try to logon to my test WLAN and on the Cisco WLAN controller I get the following error: AAA Authentication Failure for UserName:test User Type: WLAN USER
Before trying to tinker with policies on the Windows Server I was wondering if the RADIUS is correctly setup on the Controller or have I missed something obvious?
I want to configure ad agent on windows server 2008 R2 SP1 with all need patch installed.When i try to connect to DC with adacfg dc list, status is UP. Log ADOBserver's don't show any errors. But when try to do command "adacfg cache list", result - empty. In what may be the problem? Perhaps it is related to the language of the OS?
View 4 Replies View Related