Cisco Application :: ACE 4710 - Source Base Policy

Jul 22, 2012

I hav ACE 4710, I am trying to configure a policy in which when specific Client tries to access the specific Destination. ACE should not send the traffic to load balancing. It should directly send to the next Hop.
 
I configred the below but didnt able to achieve my object.
 
access-list source_IP line 8 extended permit ip host 192.168.146.123 host 198.xx.xx.2
class-map match-all CM_BYPASS_SOURCE  2 match access-list source_IP
 
policy-map type loadbalance http first-match PM_L7_BYPASS_SOURCE  class class-default    forward
 
But I am not able to reach to destination. MY source traffic is still diverting to the Load balancing server. I dont want it to redirect to LB server

View 17 Replies


ADVERTISEMENT

Cisco Application :: ACE 4710 Balance For Source?

Jun 12, 2011

I have a Cisco ACE with a server farm "intranet" with real servers rsrv1 and rsrv2 (round robin) and i have two sites A (IP Address A) and B (IP Address B) in the WAN. I want to that Site A conect to ACE 4710 via VIP, but this connection will be to srv1 and Site B conect to ACE 4710 via VIP, but this connection will be to srv2.

View 3 Replies View Related

Cisco Application :: ACE 4710 Source Ip Address In Logging

Mar 21, 2013

I've configured the ACE4710 to bring the logging to a syslog server! Here's the configuration

[...]
logging enable
logging fastpath

[Code]....
 
I saw to log with connection on the syslog server but It would be interesting to know the "source ip address" and my question is : It may be possible to configure for the logging a kind of "transparent pass through"?

View 2 Replies View Related

Cisco Application :: ACE 4710 Farm Selection Based On Source IP?

Jul 5, 2011

I have a requirement to select a farm based on source IP address.  I tried creating a match all class-map that matches on the virtual-address and source address but I get this message.LB01/Admin(config-cmap)# match source-address x.x.x.75 255.255.255.255 Error: Only one match virtual-address is allowed in a match-all class-map and it cannot mix with any other match type To me this is the only place where it makes sense to set the source match criteria.

View 2 Replies View Related

Cisco Application :: 4710 - Bypass Traffic With Source And Destination From Loadbalancing

Jul 30, 2012

I have a requirement to  bypass some specific traffic (with particular source to specific internet destination) in ACE 4710.
 
All the webtraffic (http and https) is configured to loadbalance to my proxies , i need to configure some specific traffic with source and destiantion to internet to byepass from this loadbalancing and directly got to outside interface .

View 1 Replies View Related

Cisco Application :: ACE 4710 Policy Is Not Working

Jun 16, 2011

I have ACE 4710 in context mode. I am doing internet browsing (Port 80) redirection to two proxy servers (Transparent Proxy) as well as I am using this ACE box for multiple other servers load balancing.
 
I have multiple policies applied on my LAN interface (VLAN 300) where all the users and servers are connected.
 
Now I am facing problem with one application (PLATTS) which is oil company related application. This application is working fine while directly connected with Internet (extrenal internet connection) or by giving explicit proxy in the user browser.
 
But In transparent proxy This application is not working and my company policy only allow the transparent proxy not explicit proxy.
 
Now if on my interface vlan 300 i will remove the service-policy input PM_MAIN_BCPROXY my application will start working but i cant redirect the port 80 traffic to my proxy servers which is also my requirement.
  
interface vlan 300
description ACE-INSIDE CONTEXT RACK1
ip address 192.168.0.65 255.255.255.224

[Code]....

This application use multiple destinations for connectivity and I have even tried by passing the destination IP addresses by making bypass policy but still no luck.
 
I want this application to work as well as redirection of port 80. I even try re-ordering the policy sequence but no luck. this application to work as well as redirectino of port 80 for Internet.

View 4 Replies View Related

Cisco Application :: 4710 ACE Source-address Matching In Nested Class-maps Not Working

Sep 6, 2012

Im having a (from google-fu) seemingly unique issue with load balancing. So for background, I am running the ACE 4710 device in "on a stick" mode, so I am using NAT and all that good stuff. I am also utilizing class maps and host header matching so I can save on IP space. [code]

Basically, as soon as I add that ACL_CLASS_beta.mainsite.com class map, all I get back from the ACE is RST packets and it comes back with an L7 LB Policy Miss.
 
It SEEMS like it should work, but it doesnt seem to like matching on those source addresses at all.

View 1 Replies View Related

Cisco Application :: 4710 Maximum 10 Http Header Map Is Allowed Per Policy

Nov 9, 2011

We are migrating from ACE 20 module to an ACE 4710 appliance. [code] When pasting in the config on the ACE 4710 running A4(2.1) code, I get the subject error message when trying to enter in the highlighted sticky-serverfarm command above.  Again, this config works on the older hardware and older code.

View 1 Replies View Related

Cisco Application :: Application Slowness Through ACE 4710

Mar 27, 2013

Report run via Individual Web server URL’sThe report takes less than 20 minutes (average 15 minutes) to fetch and return the data. This is observed 9 out of 10 times.Report run via ACE Load Balanced URLThe report keeps on running for more than 20 minutes and never completes. The front end keeps showing report is running.The data in general when tested directly by running queries against the database (bypassing the platform) completes in 15-18 minutesThe network connectivity for each and every ports involved (Loadbalancer/Servers) have been throulgly checked.

View 6 Replies View Related

Cisco Application :: CSS11500 Balance Using IP Source?

Jun 13, 2011

I am not able to find information of how to configure a balance in CSS11500 depending of the IP source. I want to do the next:
 
Site A : 192.168.1.0/24
Site B : 192.168.2.0/24
 
Both sites access to the same VIP: http://vip_balnace_IP but depending of the source the should be balanced to diferentes servers.
 
Site A -> VIP_balance -> server1
Site A -> VIP_balance -> server2
 
how to do that?

View 2 Replies View Related

Cisco Application :: Hairpinning On CSS 11503 When Using Source Groups?

Jun 26, 2011

I'm not sure if my terminology is correct when using hairpinning but i was wondering if there is any special config needed when you try to access a content rule VIP from a server that's configured as a member of a source group on the same CSS?
 
So say i have a content rule with a VIP 20.20.20.20 and i also have two servers 192.168.1.1 and 192.168.1.2 that are part of a source group with VIP of 20.20.20.21. My problem at the moment is if from the servers 192.168.1.x i try to ping the other VIP 20.20.20.20 that's configured on the same CSS then it doesn't work and ping fails. The same happens with HTTP traffic to the 20.20.20.20 VIP.
 
I would have thought that the NAT of the source group would happen before the routing so the 192.168.1.x IP's would be natted to 20.20.20.21 and then passed over for routing where the CSS would see that the VIP 20.20.20.20 is local and it would send it on it's way.
 
I thought it might be ACL related but i increased the verbosity of acl logging and couldn't see anything in the logs.The source group works fine on it's own and from the CSS itself i can ping the 20.20.20.20 VIP fine. It just seems that from the source group members i can't ping the VIP.

View 1 Replies View Related

Cisco Application Networking :: ACE A2 (3.4) - Set A Rate-limit Connections Per Sec From Any Source IP

Jan 28, 2012

ACE A2(3.4). Is it possible to set a rate-limit connections per sec from any source IP. For example, if a client is trying to GET a web page 10 time per sec I will send a reset or drop that connection.

View 1 Replies View Related

Cisco Application :: Does CSS 11500 Support Stickiness Based On Source IP

Oct 29, 2012

i don't know why cu need this feature, he want stickiness based on source ip and source port.  Does CSS 11500 support stickiness based on source IP and source port?or is there any other method to support stickness based on source ip and sourceport?

View 12 Replies View Related

Cisco Switching/Routing :: 7600 Router Performance / Policy Base Routing?

Mar 6, 2012

When mutiple Policy based routing configured on 7600 routers, did the router performace degraded with the number of policy based routing rules?Also, did 7600 running 12.x use per-flow based routing or per packet based routing?

View 1 Replies View Related

Cisco Application :: ACE20-MOD-K9 With Base Licenses In FT Configuration In Layer2 Mode

Oct 6, 2011

During high throughput times (nightly, when backup runs) we see packet drops on the network. We think it's the ACE module that  drops. We use 2 ACE 20-MOD-K9 with base licenses in a FT configuration in Layer2 Mode.Now I found an interesting statistic on the ACE: [code] How to reset this counter?

View 4 Replies View Related

Cisco Application :: How To Install New 4710 Ace

Feb 2, 2013

i'm looking for a recommendation for a setup guide including ft i've had a quick look a wiki and i can get basics but i'm not sure about if i need to setup additional contexts etc when i'm the only one using the appliance?

View 2 Replies View Related

Cisco Application :: DNS Rewrite On ACE 4710?

Aug 26, 2012

I have an issue with a customer that wants to update a server behind the ACE. The problem is that when the application wants to update the server it does it with the name.Doing some research I found that you can rewrite the record DNS based on the static NAT you set up on the ACE. The feature is called DNS inspection. Is the same feature as the ASA (DNS doctoring).I apply it to the outside interface and it did not work.

View 1 Replies View Related

Cisco Application :: ACE 4710 / What Are These Ports Used For

May 7, 2013

What are these ports used for? What can I do with them?

View 2 Replies View Related

Cisco Application :: ACE 4710 - What Does The Ip-netmask Mean

Feb 12, 2013

I am trying to configure sticky on an ACE 4710 and don't understand what the netmask part of the sticky ip-netmask netmask address {source | destination | both } name command.
 
Some examples use 255.255.255.255 and others use 255.255.255.0 but I don't know what the significance is or what it does?
 
I am going to configure for both source IP and destination IP (both).

View 2 Replies View Related

Cisco Application :: ACE 4710 Lic Performance

Mar 19, 2012

With the current (A5) ACE 4710 lic setup, does the "X gigabit per second appliance throughput" that is licensed affect: -
 
A)  Only "appliance" i.e. load balancing traffic, any other normal routed traffic is not included in the limit
 
 or
 
B) Is it an overall throughput limit on the interfaces i.e. includes all traffic not only load balancing traffic but also normal routed traffic crossing the appliance
 
Looking at a scenario where the lic size I need for HTTP load balanacing would be one size if  A) but would need to be much larger is B) to accomodate out of hours routed backup traffic crossing the ACE 4710

View 1 Replies View Related

Cisco Application :: ACE 4710 Not Booting?

Aug 27, 2012

I've just run the ACE 4710 and it seems that is booting up well but it stops when 'Setting up dynamic memory size' message appears.
 
INIT: version 2.85 booting
b4 lspci
1 Cavium device(s) found.

[Code]....

View 2 Replies View Related

Cisco Application :: ACE 4710 - SSL Over Port 80

Aug 11, 2012

I've got a web app that the owners want to run over port 80, but also using SSL to secure private data in transit.  The architecture is an ACE 4710 in SSL termination mode->Apache (port 2000)->Back-End app server.
 
I've got two VIPs set up already - one on port 443 and one on 2000 - both of which do the SSL termination quite nicely, but using the 3rd VIP set up on port 80, the connection steadfastly refuses to be HTTPS (i.e. doesn't show the padlock).
 
I've done all the set-up through the web interface so far, can this be done? If so, how?

View 1 Replies View Related

Cisco Application :: ACE 4710 Upgrade To A4 (2.1)?

Jul 19, 2011

I am currently running A3(2.6) and evaluate the possibility of upgrading to A4(2.1). The Instal & Upgrade Guide A4(2.0) mentions that A4(2.0) does not include all features of A4(1.1). Does this apply to A4(2.1)? The Release Notes mentions a list of features merged from A4(1.1) to A4(2.1) but does not clarify if there any features not merged.

[URL]

View 1 Replies View Related

Cisco Application :: ACE 4710 With A5(1.1) With SSL Termination

Nov 13, 2012

we  configued An ACE 4710  with SSL termination on Oracle Aplication Server  10g  (10.1.2.0.2) ,so that SSL termination is done on the ACE and HTTP reaches the Oracle Aplication Server  10g  (10.1.2.0.2) then we configure the ACE to enabled client authentication with Pkcs#11 smart card token certificate and this don succfully my problem need do this client certificate authentication  for only the [URL] not for all SSL proxy service how can do that.

View 3 Replies View Related

Cisco Application :: ACE 4710 - MSS Mismatch

Dec 5, 2011

I'm receiving a lot of these messages in a ACE4710 cluster. 192.168.100.1:80 is the VIP, 193.126.127.28:56380 is the client. Already tried to set the mss with this:
 
parameter-map type connection my map set tcp mss min 0 max 1380
 
policy-map multi-match L4_policymap
class vip_PRDWEB_http
loadbalance vip inservice
[code].....
 
But it doesn't work.

View 4 Replies View Related

Cisco Application :: ACE 4710 A3 (5) Logging New Connections?

Jul 31, 2011

We have recently transitioned one of our Ecommerce products to a new data center, at which we now use a one-armed load balancing approach rather then the routed load balancing approach we used previously. This is casuing us some issues as we generally log the source IP address a user comes in on when he fills out an application. Now the logs only show the natted ip address recieved by the load balancer, which does us no good. Any way to log the source IP address when a new connection is created to a particular vip?

View 3 Replies View Related

Cisco Application :: ACE 4710 Take An Action When A Server Goes Down

Jun 2, 2011

If we use an ACE4710 to load balance two real servers, obviously it will use health checks to determine if a server is down.When it detects a server is down, it will not send it any more traffic.But can we also have it take any other action?  For example maybe email an admin, or send an SNMP trap?  Or better yet, can we use a custom TCL script to do other things, like launch some custom activities?

View 2 Replies View Related

Cisco Application :: ACE 4710 To Manage The Ports

Jan 24, 2012

I am new to the 4710 appliance.Apart from the 4 GE 'data' ports, there are 2 Ethernet 'management' ("console") ports.  I find the description in the "quick start guide"somewhat confusing. URL, Is a first-time serial connection (at least to run the initial config. script) mandatory?  Or can you obtain the same result via one of the 2 Ethernet management ports and using a default ip address (192.168.1.10 ? When running the initial config. script (only possible from the serially connected console i suppose), you have to select your management port. Why does the system in step 5 proposes  you 4 ports, and not just 2? I suppose the intended port for management is one of the 2 management ports, not one of the 4 data ports?

View 1 Replies View Related

Cisco Application :: Cannot Telnet To ACE 4710 After Upgrade To A4(2.3)

Jun 29, 2012

I have a pair of ACE 4710s with 12 contexts sharing the load, running A4(2.1). esterday I upgraded one of them to A4(2.3) now I cannot telnet to the Admin context.Pings ok. I can telnet to other contexts on the box and everything seems to be working ok   when i do a " sh telnet" comes back with
 
No Session Information is available
sh telnet maxsessions
telnet maxsessions 16

View 1 Replies View Related

Cisco Application :: ACE-4710-K9 API Is Invalid Or Non-existent

Dec 14, 2011

ACE# sh script code NORDICID_PROBE.Error: Called API is invalid or non-existant.Hardware is ACE-4710-K9 and software A3(2.7)The probe itself is functioning ok according to show probe detail.However show script script_name probe_name -counters all remain at zero for some reason. This wasn't the case on the previously use ACE software.To my recollection the command show script code has worked successfully before on the same ACE software. Not 100% sure though, but it definitely worked on the previous software we ran on the ACE.

View 2 Replies View Related

Cisco Application :: ACE 4710 To Reset The Settings

Jan 30, 2012

the ACE 4710 is running 3.2.5 and I need to put it in another environment.Is there a way to reset its settings?

View 3 Replies View Related

Cisco Application :: ACE 4710 FT IP Address Change

Aug 22, 2011

Any document that details the steps to change the FT ip addresses of a pair of Cisco  4710 whilst they are running in a production environment without causing an outage?

Would the steps be:
On the secondary unit:
hbs-syd04-lb01ft interface vlan 417 ip address 172.30.254.221 255.255.255.252 peer ip address 172.30.254.222 255.255.255.252

Then on the primary unit:
hbs-syd04-lb01ft interface vlan 417 ip address 172.30.254.221 255.255.255.252 peer ip address 172.30.254.222 255.255.255.252

Or Vice Versa?

View 1 Replies View Related

Cisco Application :: High Connections Within Ace 4710?

Oct 23, 2011

Is this normal to have millions of current connections within an ace 4710? There is only 3 current connections but shows a high number?

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved