topic Re: ACE - Ping to Server-Side interface in Application Networking

ACE - Ping to Server-Side interface

stevek1 — Fri, 18 Jul 2008 05:38:49 GMT

Hi Folks,

I have a problem whereby I need to allow my real servers to ping the Server-Side ACE interface. Is this explicitly denied? I have the VIP up and running OK but my server can't ping the Server-Side interface (which is it's gateway).

Thanks in advance,

SteveK.

Re: ACE - Ping to Server-Side interface

jleszewski — Fri, 18 Jul 2008 06:26:34 GMT

You probably didn't configure management type policy or didn't include icmp traffic there.

Or didn't apply this policy to appropriate interface or globally.

Re: ACE - Ping to Server-Side interface

stevek1 — Fri, 18 Jul 2008 06:33:29 GMT

Thanks for the response Kuba.

I've attached the config for you - can you see what the cause is?

SteveK.

Re: ACE - Ping to Server-Side interface

Syed Iftekhar Ahmed — Fri, 18 Jul 2008 07:19:42 GMT

Your management policy is not configured under server side vlan

Do the following and you are good to go

interface vlan 56

service-policy input REMOTE_MGMT_ALLOW_POLICY

Thanks

Syed Iftekhar Ahmed

Re: ACE - Ping to Server-Side interface

jleszewski — Fri, 18 Jul 2008 09:21:00 GMT

I think You should apply policy REMOTE_MGMT_ALLOW_POLICY to interface vlan 56 or globally.

Currently it's only applied to vlan 55 which is the client side interface.

If You don't want telnet/ssh access from server side, then You need to prepare another class and policy with only icmp traffic allowed.

Re: ACE - Ping to Server-Side interface

stevek1 — Mon, 21 Jul 2008 02:50:02 GMT

Thanks Kuba and Syed,

Your speedy response was most helpful.

Cheers, SteveK.