topic Re: FTP load balance on ACE in Application Networking

FTP load balance on ACE

jteixido — Fri, 03 Apr 2009 20:04:40 GMT

Has anyone load balanced FTP on the ACE? If so can you please leave a configuration example?

Thank you,

John...

Re: FTP load balance on ACE

Syed Iftekhar Ahmed — Fri, 03 Apr 2009 22:09:48 GMT

class-map match-any FTP

2 match virtual-address 10.10.10.100 tcp eq ftp

policy-map type loadbalance first-match FTP-POLICY

class class-default

serverfarm FTP-SFarm

policy-map multi-match VIPS

class FTP

loadbalance vip inservice

loadbalance policy FTP-POLICY

loadbalance vip icmp-reply

inspect ftp

Syed

Re: FTP load balance on ACE

JamesLuther — Sat, 04 Apr 2009 16:08:06 GMT

Hi,

If you want FTP passive mode to work then in addition to the above configuration also add

class-map match-any FTP

match virtual-address 10.10.10.100 tcp range 1023 65535

Regards

Re: FTP load balance on ACE

jteixido — Mon, 06 Apr 2009 12:38:58 GMT

Thank you Guys.

Re: FTP load balance on ACE

Mehdi_ab — Wed, 08 Apr 2009 15:58:49 GMT

James

Wouldn't the ACE Ftp inspect also open the ports on the vip for the traffic to be loadbalanced? What you described raises security concerns. You could possibly have a firewall in front of the ACE doing the filtering (and ftp inspect)

Re: FTP load balance on ACE

sachinga.hcl — Wed, 08 Apr 2009 22:48:09 GMT

Kindly find these two examples for FTP load balance method in cisco ACE:

1. FTP serverfarm on Cisco ACE

http://snippets101.blogspot.com/2007/06/ftp-serverfarm-on-cisco-ace.html

2. FTP Load Balancing on ACE in Routed Mode Configuration Example

http://docwiki.cisco.com/wiki/FTP_Load_Balancing_on_ACE_in_Routed_Mode_Configuration_Example

3. FTP Load Balancing on ACE in One-Arm Mode Configuration Example

http://docwiki.cisco.com/wiki/FTP_Load_Balancing_on_ACE_in_One-Arm_Mode_Configuration_Example

Sachin

Re: FTP load balance on ACE

Gilles Dufour — Thu, 09 Apr 2009 06:01:22 GMT

I think this commands were only needed as a workaround for an old defect.

With the latest versions, I don't think this is required anymore.

FTP inspection should take care of everything.

Gilles

Re: FTP load balance on ACE

Mehdi_ab — Mon, 27 Apr 2009 18:58:51 GMT

Well Gilles

I went ahead and tried it in the labs. If you don't open the range of ports, ftp pasv does not work. Inspect ftp doesn't seem to resolv the issue.

Re: FTP load balance on ACE

Gilles Dufour — Wed, 29 Apr 2009 12:34:34 GMT

you don't need to modify the FTP class.

However, if you do client-nat, you need to create a new class and a new policy to perform client nat on the data connection.

Unfortunately, inspect FTP can't do that alone.

So you should have

class ftp

match virt x.x.x.x tcp eq 21

class ftp-data-nat

match virt x.x.x.x tcp range ...

policy multi FTP

class ftp

load ...

nat dynamic ...

inspect ftp

class ftp-data-nat

nat dynamic ...

Without client nat, the class ftp-data-nat is not required for passive ftp to work.

Gilles.