topic Re: Not bieng able to see Http or HTTPS traffic in Application Networking

Not bieng able to see Http or HTTPS traffic

AndyGB5150 — Tue, 25 Jan 2011 09:07:13 GMT

Morning or Evening.

I hope you can help me.

At the moment I can ping from a cisco ace 4710 two Web Servers and the rest of the infrastructure as shown below

At present the sticky sessions and ssl isn't really too much of a concern but I would like to see HTTP or HTTPS traffic running though the ACE 4710.

Ping from the Ace is successfull as it can ping AD servers, Database Servers, etc..

Show conn only shows that the HA links are connected but nothing else.

Show arp shows that ever thing is up from the Real Server,VIP addresses, H/A IP's and also a couple of vlans on a core switch.

I think the problem maybe due to the class-map and possibly a policy map that's not applied to the Virtual IP's

Thanks again

Re: Not bieng able to see Http or HTTPS traffic

AndyGB5150 — Tue, 25 Jan 2011 09:11:52 GMT

The attatched is a current VIP status.

Thanks again

Re: Not bieng able to see Http or HTTPS traffic

Marko Leopold — Tue, 25 Jan 2011 13:25:23 GMT

I would guess about a direct-server-return, but without your configuration it will be all just guessing.

Re: Not bieng able to see Http or HTTPS traffic

AndyGB5150 — Tue, 25 Jan 2011 13:53:37 GMT

Thanks for the reply.

Config attatched

Re: Not bieng able to see Http or HTTPS traffic

Marko Leopold — Tue, 25 Jan 2011 14:16:49 GMT

At first you should put your access-list on all your interfaces. The ACE is acting like a firewall. Then you should enable logging. The ACE is very good in telling you why something blocked or not.

Re: Not bieng able to see Http or HTTPS traffic

AndyGB5150 — Tue, 25 Jan 2011 14:38:56 GMT

Thanks for the reply.

I take it adding an access-list would be the same as a normal switch ???

Daft question but I had to ask

Re: Not bieng able to see Http or HTTPS traffic

Marko Leopold — Tue, 25 Jan 2011 15:18:39 GMT

on VLAN 200 you have the command

access-group input ALL

you should add this to VLAN 210 and 220 too. By default ACE is blocking all incoming traffic.