topic Re: Unable to ping VIP and VIP not in ARP in Application Networking

Unable to ping VIP and VIP not in ARP

taylor_jeff — Thu, 14 Oct 2010 14:42:43 GMT

I am trying to configure an ACE 4710 appliance. The ace is connected to a 4500 switch and the client and server connections are on the same subnet.

I am not able to ping the VIP or connect via HTTP. The VIP doesn't appear when in the ARP cache when I issue the show arp command.

From the ACE I am able to ping addresses on the 4500 switch and addresses beyond the switch. I can also ssh into servers beyond the 4500 switch from the ACE.

The config is attached.

Hoping someone can point me in the right direction.

Thanks,

Jeff

Re: Unable to ping VIP and VIP not in ARP

andrels — Thu, 14 Oct 2010 14:53:54 GMT

I wonder if you try to add the http probe on the serverfarm it would make the rserver alive and therefore the VIP active?

Thanks,

Re: Unable to ping VIP and VIP not in ARP

Pablo — Thu, 14 Oct 2010 15:35:38 GMT

Hi Jeff,

Seems like you didn't apply the ACL to permit the traffic to flow through the ACE, the ping from ACE to 4500 because is traffic originated on the appliance.

Try this:

interface vlan 196
  ip address 161.80.201.254 255.255.255.0
  service-policy input int196   
   access-group input EAS_ACL
   no shutdown

Also if your clients and servers are on the same subnet you might need source NAT to avoid asymmetric routing.

HTH.

__ __

Pablo

Re: Unable to ping VIP and VIP not in ARP

taylor_jeff — Thu, 14 Oct 2010 17:39:08 GMT

I added the input ACL and still get the same result.

I also added an http probe to the real server, but no luck.

Thanks for the suggestions.

Re: Unable to ping VIP and VIP not in ARP

Pablo — Thu, 14 Oct 2010 18:23:17 GMT

Jeff,

Can you get a full show running from the Admin context (showing interface config), also get the output of

show serverfarm EAS det

show arp

show service-policy int196

Regards.

__ __

Pablo

Re: Unable to ping VIP and VIP not in ARP

Gilles Dufour — Fri, 15 Oct 2010 06:29:04 GMT

you will also need the management policy on interface 196.

So add "service-policy input EAS".

Gilles.

Re: Unable to ping VIP and VIP not in ARP

taylor_jeff — Fri, 15 Oct 2010 11:54:19 GMT

I am attaching the outputs from

show serverfarm EAS det

show arp

show service-policy int196

and the full running config from the admin context

Thanks,

Jeff

Re: Unable to ping VIP and VIP not in ARP

Gilles Dufour — Fri, 15 Oct 2010 12:59:32 GMT

Jeff,

allocate resource for the context.

Assign 10% min to all resources and unlimited max.

resource-class Basic
limit-resource all minimum 10.00 maximum unlimited

context EAS

member Basic

After that, it still does not work, try to reboot the box.

Gilles.

Re: Unable to ping VIP and VIP not in ARP

taylor_jeff — Sun, 17 Oct 2010 19:29:30 GMT

Gille,

I tried allocating the resources to it, but still no luck. I have tried rebooting the ACE with no luck.

I was running software A3.26 and tried going back to A3.20 with no luck.

For whatever reason I can't get the VIP to appear in the ARP cache.

Thanks,

Jeff

Re: Unable to ping VIP and VIP not in ARP

Pablo — Sun, 17 Oct 2010 23:36:28 GMT

Jeff,

Your VIP should be a /32 mask IP and that's the default on the ACE, try to rewrite your VIP without a network mask.

class-map match-all EAS_SAND
  2 match virtual-address 161.80.201.199 tcp eq www

Let us know if this helps.
__ __
Pablo

Re: Unable to ping VIP and VIP not in ARP

Gilles Dufour — Mon, 18 Oct 2010 07:30:21 GMT

Pablo,

that's a good catch... well done.

Gilles.

Re: Unable to ping VIP and VIP not in ARP

taylor_jeff — Mon, 18 Oct 2010 13:11:17 GMT

Pablo,

That worked. Thanks

I am now able to ping the VIP and it appears in the APR cache.

Re: Unable to ping VIP and VIP not in ARP

Pablo — Mon, 18 Oct 2010 21:48:20 GMT

Sweeet!

Glad to help 😃

__ __

Pablo