Cisco Application :: ACE10-6500-K9 / How Static Entry Under Sticky Performs
Jul 26, 2011
how a static entry under a "sticky" performs Configuring Static IP Address Sticky Table Entries Cisco Documentation Says When you configure a static entry, the ACE enters it into the sticky table immediately. Configuring the ACE Action on Server Failure failaction purge # The purge keyword specifies that the ACE remove the connections to a real server if that real server in the server farm fails after you enter the command. The ACE sends a reset (RST) to both the client and the server that failed. Cisco Documentation Says If you do not configure this command, the ACE takes no action when a server fails
a) Does the ACE let the connections to SERVER1 timeout(default behaviour) and then load-balance new connections coming in deom 192.168.12.15 to another server in SERVERFARM1
ORb) Does the ACE reset the connections to SERVER1 immediately and starts load-balancing new conenction coming in from 192.168.12.15 to other servers in SERVERFARM1 ?
ORc) Does the ACE just drop the current and new connections from 192.168.12.15 till SERVER1 comes back up ?
OR d) Is it dealt differently?
Question2 - Now what happens if the failed server(SERVER1) comes back up after some time?
e) Does the ACE reset any current connections from 192.168.1.15 and starts sending them to SERVER1 ?
ORf) Does the ACE leave the current connections from 192.168.1.15 to other servers in SERVERFARM1 as they are and send any new connections
from 192.168.1.15 to SERVER1?
I have ACE10-6500-K9 installed in 6513 core switch with below mentioned sh version.
Software loader: Version 12.2[121] system: Version A2(2.0) [build 3.0(0)A2(2.0)] system image file: [LCP] disk0:c6ace-t1k9-mz.A2_2_0.bin
[Code].....
I want to know that can i upgrade ACE10-6500-K9 to c6ace-t1k9-mz.A5_1_0 i.e version5 ? I tried to search cisco website but could not get proper upgrade or user guide.
It seem that ACE10 not support 12.2(33)SXJ1 IOS running on C6500. The box cannot detect the ACE module when power up. Currently the ACE10 running on system A2(30).
My challenge i have the ASA SM that compulsary to run on 12.2 (33) SXJ1 version. How to let these 2 module can running on the same C6500 box?
First of all, I want you to know that I do understand that it's not a good design at all, but I still need to implement it.My ACE20 in 6500 works in routed mode with VLAN 101 (10.0.101.0/24) as the client-side VLAN. I therefore have Vlan101 SVI (10.0.101.1/24) on 6500.I also have VLAN 200 (10.0.200.0/24) on 6500 with SVI Vlan200 (10.0.200.1/24) and I want to create a static bidirectional NAT so that clients, connecting to IP address in VLAN 200 (10.0.200.64) would be NATed to VIP (10.0.101.10).Let's say we have clients (10.0.500.0/24) connecting through gig1/0/1.Here is my current setup on 6500.
We are using several contexts for each customer in our ACE module.One of the customer contexts needs to activate XML API to control their services.I've tried to activate it, but cannot get any http response, what can be missing?ACE10 version A2(3.6a)
class-map type management match-any HTTP-ALLOW_CLASS 2 match protocol http source-address 10.110.0.0 255.255.254.0 3 match protocol http source-address 10.60.208.80 255.255.255.248 class-map type management match-any HTTPS-ALLOW_CLASS 2 match protocol https source-address 10.110.0.0 255.255.254.0 3 match protocol https source-address 10.60.208.80 255.255.255.248
I trying configure ASN traffic load balance, but doesn't works.I have one Cisco Catalyst 6509 and onde Cisco Ace10 module, in my context "PanWEB" i have the interfaces above: [code] If i try to establish a telnet session(telnet 10.96.202.10 80) i see the SYN packet passing through the ACE and going to the real server, but, the server do not response the SYN packet. I done a capture in the server using wireshark and could see that the IP address of the destination is the VIP and not the rserver ip address , this is a problem? Why can not I have the SYN + ACK from the server?
I've been using my pair of ACE-4710s for quite some time and have usually stuck to the Class C Subnet sticky settings, as that's what we migrated from in Windows NLB. In one instance of load balancing I'm trying to create an L4 inspection policy that looks for a certain payload (much like a http header) and would like to persist on this. The problem is that the client portion of the conversation starts with a 'SessionID' of 0, and the server responds with a unique 'SessionID'. If I setup the sticky policy with 'Enable Sticky For Response', I get entries populated in the sticky database, but they all go to the same server as there is a sticky session setup for the SessionID = 0. Is there a way to setup sticky entries on server response only.Currently using ACE DM v4(1.0).
I'm looking for some documentation I can share with a customer to explain why I can't configure them a back-up sticky server farm when we're not terminating SSL on the the ACE (we pass SSL from the client through to the rservers, sticking the client to the rserver by source IP address). I've not been able to find anything that addresses this particular scenario in my googling so far. I remember discussing this in my training class with the instructor, but I can't find any reference to it. Have any of you run into this and have a link they can share?
We are using a sticky serverfarm with 2 real servers, one server was down for maintenance for an extended period of time. When it came inservice again it was not getting any connections. is it because all the connections had stuck to the other server ? we want sessions to be sticky but we also want to LB?I got it working by bouncing the server that had been online all the time. things started to LB then.BTW the ACE 4710 is running 4.2.1
We've got ACE30s (active/standby) running A5(1.2), and a context that's front-ending one of our major applications, doing SSL termination on the client side and SSL initiation on the back side:
parameter-map type ssl FrontEndSSL-Param rehandshake enabled
parameter-map type ssl BackendSSL-param authentication-failure ignore [Code]...
I have a requirement to load balance OWA 2010 inbound connectivity to 2 CAS servers using a ACE 4710 with sticky sessions enabled.
The CAS servers are currently responding on 80 or 443 at this moment in time. Eventually I want to off load the SSL to the ACE 4710, its currently running on the CAS servers. I need to enable sticky sessions to keep the session to the same CAS server for each internet based connection. I also have a proxy enabled for inbound connectivity so I cannot use source IP.
Here is my configuration but it doesn’t seem to be working, i am currently testing with port 80 connections not SSL.
We are using a ACE 4710 with A3(2.6) software release.I had to change our sticky load balancing method for HTTPS to cookie based.However while connections appear to work if I look at the show sticky database table I can not see or confirm sticky entries for the cookie based connections.Here or config snippets to show the config
I have a strange effect at my ACE 4710. I loadbalances normally reliable only 14 WEB-Services.
It's running on SW A3.25. Since several weeks I regognized a dramatical increase of Sticky entries. So when running in limitations (the stolen for reuse counter increased then) (show np 1 me-stats "-slb -v") gave more and more resources for sticky ... last it was at 65% and ran again into limits at round 650500 Sticky entries.
So I began to find out what of the services was affected with most sticky database entries and could Identify it. There were really to see round about640000 entries for that specific service.
The sticky for that service was defined to look at a specific cookie in the http header and the timeout defined is 120 minutes.
So round about 45000 Entries was to see with a "show sticky databse group Cookie_Sticky" with a time-to-expire value of zero in the database like the follwing examüple shows:
When I modified my Sticky definition with the command "timeout activeconns" all the Zero-Entries were kicked out and the rsources used for Stickywent back to 5% of usage...
Everytime I start one of my two Windows machines, I need to go to the control panel network adapter and enter the static IP address in the IPV4 properties. It is always blank after a shutdown.I have two machines that are networked for flight simming.One of the machines must have a static IP so I configured both static. Not sure if this has anything to do with my problem.
I have seen other discussions regarding Static MAC address entries on IPv4, but what of IPv6?We have MS NLB solutions and they are working fine. We have Cisco 6509/6504, Version 12.2(33)SXI5
But then we have a new one for a new ActiveDirectory solution, and on those networks we have implemented IPv6.
How is Static MAC address entries and MS NLB solved in IPv6 (i.e arp ip.ip.ip.ip mac.mac.mac ARPA gi1/1). I can't seem to find much examples or documentation on this? Is it replaced with another function?The reason I ask is twofold.
1. I really want to know
2. The NLB cluster seem to drop IPv6 traffic at even intervals, witch seems to correspond with NLB transition.
I'm facing a strange problem here with my WAG54G2 gateway. I've got a very bad connection when the signal strength is 2 out of 5 or less. I tested the DL and UL speed via url...and gives me hardly 1 Mb/s even though I have 10Mb ADSL connection. With wired and wireless connection with 3 out of 5 or more I got 8.7 Mb DL from the mentioned website.
We have cisco ace 30 modules installed in cisco 6500 switches. For application availability purpose from the internet, we need to have some global site selector/3rd party devices with similar feature set that of cisco gss.
whether cisco ace is compatible to ge tintegrated with other 3rd party devices like F5 GTM?
I have installed ANM 5.2 virtual appliance.I have an issue importing a Catalyst 6500 device.When I try to import it, I get the following error: Device discovery failed: Cannot communicate to the device.Authentication failure while attempting to connect. Verify the device type and credentials. I double verified and the credentials are correct.I user SSH version 2.I use the following special carachters in the password: "!" and space.I don't use enable password to connect to the 6500 device. The 6500 device has a privilege 15 username.In ANM, the enable password is a requirement so I just fill in the regular password.I think the issue is appearing due to one of the following:
1.) The ANM does not support the special carachters I use in the 6500 password.
2.) Then ANM requires enable password, while I don't use enable password in the 6500 switch.
The 6500 runs SXI6 software version.I can't configure an enable password or configure a test username without special carachters beacause it's against the organization's policy.
I have done this in the past but I cannot find it anywhere......how do you display the uptime of a CSM module in a 6500? The chassis has an uptime of over 2 years, but I believe the CSM module was power cycled at some point within that 2 years and I need to find out if we may be running in to the bug that occurs after 828days of uptime. We are running 4.2(6) on the CSM and 12.2(18)SXF1 IOS on the SUP.
I have an application for my client's company. Their clients should post the request from outside thru internet. for that we have bought a Static IP. And now i have to configure that static ip to access the application from outside.what is the procedure for that?
I am just designing a solution where a FWSM consists of 2 contexts initially and has a shared outside interface pointing to the 6500 switch. There are 3 subnets connected to each of the FWSM contexts. So if anyone wants to access these 6 subnets then a route would be needed pointing to the interface vlan of the shared interface on the switch. But that would not be enough to access the subnets.. I am sure we have to define static NATS to point them to the right context where these subnets reside.
The FWSM is running version 3.x code So say 1.1.1.0(shared), 10.10.0.0(inside1), 10.20.0.0(inside2) and 10.30.0.0(inside3) reside in Context 1 and 1.1.1.0(shared), 20.10.0.0(dmz1), 20.20.0.0(dmz2) and 20.30.0.0(dmz3) reside in Context 2 in each of the context we would have to make three static NATS
When we do self diagnostic test for WAE connected to the 6500 switch i get warning as below. Due to this alert there is no major acceleration benfits by the WAAS
Test WARN [tfo] WARN ASYMMETRIC Asymmetric routing is seen in the device Action: Check router's network configuration and WCCP redirection on the router.usevwa1#
6509 switches has only L2 capability and does not do WCCP redirection. The WCCP re-direction is done by 2821 routers.Is there any command which needs to be given in 6500 switch to solve the issue
I was asked to mount ACESMs on each of the CAT6K switches of a VSS cluster (one ACESM on each individual switch).On a non-VSS environment, the "svclc module <slot> vlan-group <group>" command is used to bind the VLAN group to the module on a certain slot. But now I am facing a VSS scenario, I will need to combine switch and slot in order to reference each of the individual modules...
How do I "index" each of the ACESMs in a VSS cluster? ¿Is there an extension of the aforementioned command to be able to combine switch and slot information?
I have an issue with my setup of a 6500 switch (12.2(33)SXI9).We have a 6500 switch with several VRF's. For a certain VRF I would like to redistribute a static route in EIGRP. After doing so I don't see the static route on my eigrp neighbor.
This is a overview of my config. I'm basically redistributing only my static route for this vrf in eigrp.
I found a similar case in which the solution was adding a metric to the static route. (eg. redistribute static route-map static-eigrp-pp metric 10000 100 255 1 1500). But the strange thing is that we don't have this issue on a similar machine (same IOS, same config setup). [code]
i have configure new ACE 30 module on top of 6500 core switch , the issues am facing whenver i want to access to https://ACE_IP and after i enter the user name and the password , it's forwared me to the follwoing page: is there anything should i configure to avoid this page ?
I have an ACE10-6500-K9 (Application Control Engine service module for Catalyst 6500) but I can't access it because I lost the admin password.I would like to know how to perform a Password Recovery Procedure on this device.Is it similar to the password recovery procedure on an ACE 4700 appliance?
I have Cisco 6500 with FWSM and ACE module which are in one central DC. Also we have four different Datacenter (Hub & spoke) and in our FWSM we have configured four contexts in central DC FWSM for each DC. Each DC servers are different VLAN and IP subnet. Now we have to configure ACE module for load balancing among those different subnet servers. What will be the design and configuration for this solution? Like routed or one-arm mode design.
Now customer requirement is we have to load balance using ACE between these App Servers which are in different context s in FWSM and one Server is not FWSM. how to configure or design or placement of ACE and FWSM for above scenario.
Since the ACE supports only static routing, when pointing a default route from the ACE what is your preferred method when using multiple 6500s with an ACE in each in a failover scenario to prevent just pointing at one 6500? Static route to an HSRP address? Multiple static routes on the ACE, etc?