Cisco Application :: ACE 4710 - FT Pair IP Alias Address
May 8, 2012
I have recently configured a pair of ACE 4710 appliances in a FT group. The ACE's are deployed in one-arm mode, using Source NAT, with all routing to and from being done by a pair of PIX firewalls.
My configuration does not include the use of an "alias" IP address on the data VLAN interface within each of my contexts.
My understanding is that the "alias" IP address is similar to a HSRP address and if the ACE is deployed in Routed mode the default gateway for the servers can be configured with the "alias" address so as this is always available even if a fail over occurs.
if this is a correct interpretation and of use of the "alias" IP address and if so whether it is required when using a one-arm mode topology?
I'm trying to configure Fault Tolerance on a pair of 4710s. I followed the doc, and configured int gi1/4 as the fault tolerance interface, using vlan 12. However the GUI is saying FT Vlan Down
The troubleshooting wiki said check the physical connectivity, but everything there looks good. Each ACE can ping it's own IP, but not the router on that VLAN, or the peer. They're connected to a dedicated VLAN in a switch, and I even tried a crossover cable to directly connect the two. [code]
Any document that details the steps to change the FT ip addresses of a pair of Cisco 4710 whilst they are running in a production environment without causing an outage?
Would the steps be: On the secondary unit: hbs-syd04-lb01ft interface vlan 417 ip address 172.30.254.221 255.255.255.252 peer ip address 172.30.254.222 255.255.255.252
Then on the primary unit: hbs-syd04-lb01ft interface vlan 417 ip address 172.30.254.221 255.255.255.252 peer ip address 172.30.254.222 255.255.255.252
I have a problem with an ACE 4710 regarding to the ping of especially one VIP address.
[code]...
At the Box I setup 10 Servcies, all with different VIP addresses, also the IP is not used duplicate somewhere in the network.
in the class defined under Policy-Map Multi-Match I setup identical to the others loadbalance vip icmp-replay active, the VIP is usable by the defined service http, the serverfarm is up and running all ok so far but this VIP does not respond to ping even the correct arp resolution was done.
I started also a capture locally on the ACE and see the ICMP - Echo coming in, but the box sends no echo-reply back.
In the access-lists Management and so on I allowed icmp and also on all interfaces the icmp guard is disabled...
I've configured the ACE4710 to bring the logging to a syslog server! Here's the configuration
[...] logging enable logging fastpath
[Code]....
I saw to log with connection on the syslog server but It would be interesting to know the "source ip address" and my question is : It may be possible to configure for the logging a kind of "transparent pass through"?
I want to use one arm infrastructure of ACE4710. But I remember it was problem for back end server can not get logging for which client/ip address access the web server.
Im having a (from google-fu) seemingly unique issue with load balancing. So for background, I am running the ACE 4710 device in "on a stick" mode, so I am using NAT and all that good stuff. I am also utilizing class maps and host header matching so I can save on IP space. [code]
Basically, as soon as I add that ACL_CLASS_beta.mainsite.com class map, all I get back from the ACE is RST packets and it comes back with an L7 LB Policy Miss.
It SEEMS like it should work, but it doesnt seem to like matching on those source addresses at all.
Report run via Individual Web server URL’sThe report takes less than 20 minutes (average 15 minutes) to fetch and return the data. This is observed 9 out of 10 times.Report run via ACE Load Balanced URLThe report keeps on running for more than 20 minutes and never completes. The front end keeps showing report is running.The data in general when tested directly by running queries against the database (bypassing the platform) completes in 15-18 minutesThe network connectivity for each and every ports involved (Loadbalancer/Servers) have been throulgly checked.
how to install a certificate (.p7b and .crf) on my second ACE in a HA pair.
On ACE01 i generated a CSR and gave the details to our SSL provider, they provided the certificates and i imported them. All good there.
How can i install the same SSL on ACE02 if i haven't generated a CSR on my backup devicde, or do i generate a CSR and import the same certificate?
Since bringing the ACE's into HA all contexts have sync'd and the backup ACE is in 'hot standby' state. But one context fails the sync and i think this is because the SSL certificate is not installed correctly on the second ACE02.
i'm looking for a recommendation for a setup guide including ft i've had a quick look a wiki and i can get basics but i'm not sure about if i need to setup additional contexts etc when i'm the only one using the appliance?
I have an issue with a customer that wants to update a server behind the ACE. The problem is that when the application wants to update the server it does it with the name.Doing some research I found that you can rewrite the record DNS based on the static NAT you set up on the ACE. The feature is called DNS inspection. Is the same feature as the ASA (DNS doctoring).I apply it to the outside interface and it did not work.
I am trying to configure sticky on an ACE 4710 and don't understand what the netmask part of the sticky ip-netmask netmask address {source | destination | both } name command.
Some examples use 255.255.255.255 and others use 255.255.255.0 but I don't know what the significance is or what it does?
I am going to configure for both source IP and destination IP (both).
With the current (A5) ACE 4710 lic setup, does the "X gigabit per second appliance throughput" that is licensed affect: -
A) Only "appliance" i.e. load balancing traffic, any other normal routed traffic is not included in the limit
or
B) Is it an overall throughput limit on the interfaces i.e. includes all traffic not only load balancing traffic but also normal routed traffic crossing the appliance
Looking at a scenario where the lic size I need for HTTP load balanacing would be one size if A) but would need to be much larger is B) to accomodate out of hours routed backup traffic crossing the ACE 4710
I've got a web app that the owners want to run over port 80, but also using SSL to secure private data in transit. The architecture is an ACE 4710 in SSL termination mode->Apache (port 2000)->Back-End app server.
I've got two VIPs set up already - one on port 443 and one on 2000 - both of which do the SSL termination quite nicely, but using the 3rd VIP set up on port 80, the connection steadfastly refuses to be HTTPS (i.e. doesn't show the padlock).
I've done all the set-up through the web interface so far, can this be done? If so, how?
I am currently running A3(2.6) and evaluate the possibility of upgrading to A4(2.1). The Instal & Upgrade Guide A4(2.0) mentions that A4(2.0) does not include all features of A4(1.1). Does this apply to A4(2.1)? The Release Notes mentions a list of features merged from A4(1.1) to A4(2.1) but does not clarify if there any features not merged.
we configued An ACE 4710 with SSL termination on Oracle Aplication Server 10g (10.1.2.0.2) ,so that SSL termination is done on the ACE and HTTP reaches the Oracle Aplication Server 10g (10.1.2.0.2) then we configure the ACE to enabled client authentication with Pkcs#11 smart card token certificate and this don succfully my problem need do this client certificate authentication for only the [URL] not for all SSL proxy service how can do that.
I'm receiving a lot of these messages in a ACE4710 cluster. 192.168.100.1:80 is the VIP, 193.126.127.28:56380 is the client. Already tried to set the mss with this:
parameter-map type connection my map set tcp mss min 0 max 1380
policy-map multi-match L4_policymap class vip_PRDWEB_http loadbalance vip inservice [code].....
We have recently transitioned one of our Ecommerce products to a new data center, at which we now use a one-armed load balancing approach rather then the routed load balancing approach we used previously. This is casuing us some issues as we generally log the source IP address a user comes in on when he fills out an application. Now the logs only show the natted ip address recieved by the load balancer, which does us no good. Any way to log the source IP address when a new connection is created to a particular vip?
If we use an ACE4710 to load balance two real servers, obviously it will use health checks to determine if a server is down.When it detects a server is down, it will not send it any more traffic.But can we also have it take any other action? For example maybe email an admin, or send an SNMP trap? Or better yet, can we use a custom TCL script to do other things, like launch some custom activities?
I am new to the 4710 appliance.Apart from the 4 GE 'data' ports, there are 2 Ethernet 'management' ("console") ports. I find the description in the "quick start guide"somewhat confusing. URL, Is a first-time serial connection (at least to run the initial config. script) mandatory? Or can you obtain the same result via one of the 2 Ethernet management ports and using a default ip address (192.168.1.10 ? When running the initial config. script (only possible from the serially connected console i suppose), you have to select your management port. Why does the system in step 5 proposes you 4 ports, and not just 2? I suppose the intended port for management is one of the 2 management ports, not one of the 4 data ports?
I have a pair of ACE 4710s with 12 contexts sharing the load, running A4(2.1). esterday I upgraded one of them to A4(2.3) now I cannot telnet to the Admin context.Pings ok. I can telnet to other contexts on the box and everything seems to be working ok when i do a " sh telnet" comes back with
No Session Information is available sh telnet maxsessions telnet maxsessions 16
ACE# sh script code NORDICID_PROBE.Error: Called API is invalid or non-existant.Hardware is ACE-4710-K9 and software A3(2.7)The probe itself is functioning ok according to show probe detail.However show script script_name probe_name -counters all remain at zero for some reason. This wasn't the case on the previously use ACE software.To my recollection the command show script code has worked successfully before on the same ACE software. Not 100% sure though, but it definitely worked on the previous software we ran on the ACE.
I have a pair of ACE 4710's running software version A3(2.0). I intend to upgrade to version A5(1.2). Can I go straight to version 5 or do I need to go to version 4 and then version 5?
We have two pairs of ACE 4710s, one pair running A3(2.4) and the other pair A3(2.0). We plan to upgarde the second pair so that they are running the same image as the first pair (we know they are not the latest, but this is the first step in a larger rollout plan, and to aid some troublshooting for a major issue we are seeing.)
I have details of the upgrade steps, but my question is with regards to the licenses which are now enforced after (2.0). We currently have the following on the first pair, but are these part of the default licenses for (2.4) or would we need to purchase these as well?
I need to use the Ace 4710 to distribute a Proxy PAC file, e.g. [URL] which will be configured in client browser using an AD group policy. Is it possible for the ACE to host and serve a file in this way?
Can the Nat Pool be on a different network that the load balanced vip? My current design uses nat pool on the same network, but the archatect wants the NATs on seperate VLAN.I will be developing on ACE MOD20, but the final configuration will be on 4710.
