topic Re: ace proxy connections in Application Networking

ace proxy connections

Thompso7540_2 — Wed, 22 Dec 2010 14:27:24 GMT

when teh ace sends a load balancing request to a real server in regular la

yer 4 load balancing, i udnerstand that the ace actually make 2 connections ( 2 connections = 1 flow) i from client to ace, and another from ace to rserver

does the ace keep the source IP as the client or does the ace make it the vip when it sends a request to a serverfarm?

Re: ace proxy connections

litrenta — Wed, 22 Dec 2010 18:07:13 GMT

unless you are natting the ace will send the traffic to the server with the source ip of the client.

Re: ace proxy connections

Thompso7540_2 — Wed, 22 Dec 2010 18:09:55 GMT

thanks

if i issue a show conn - will i see two connections? One from client to VIP - then another from VIP to rserver?but the packet the rserver sees has the source IP of the client?

Re: ace proxy connections

Dan-Ciprian Cicioiu — Wed, 22 Dec 2010 18:24:02 GMT

Bryan,

By default the ACE does not change the IP of the client , so the rserver will see the client real IP.

But you can configure the ACE to do NAT of the client , so that the rserver couldn't see the client real ip.

The second case is the case in which the rserver has other default gateway then the ACE, and the client would be NATed to an ip from the same segment of the rserver.

Dan

Re: ace proxy connections

Dan-Ciprian Cicioiu — Wed, 22 Dec 2010 18:25:41 GMT

If there are some active connections , you can try "show xlate" to see if there is any NAT configuration in place.

Dan

Re: ace proxy connections

Thompso7540_2 — Tue, 28 Dec 2010 14:32:44 GMT

i am confused - here is what is in this doc:

"Client requests will arrive at the VIP, and the ACE will pick the appropriate server and then use the destination Network Address Translation (NAT) to send the client request to the server. The server will respond using the interface VLAN of the ACE as its default gateway to the client. The ACE will then change the source IP to be the VIP and forward the response to the client via the MSFC."

so the communication is always natted to the vip, and the onyl thing that makes the flows different is the src ports?

http://docwiki.cisco.com/wiki/Basic_Load_Balancing_Using_Routed_Mode_on_the_Cisco_Application_Control_Engine_Configuration_Example

Re: ace proxy connections

Dan-Ciprian Cicioiu — Tue, 28 Dec 2010 15:54:09 GMT

Yes (src port being the client port) . From the clients point of view , there is only one IP and one dst port ( in case of an application ).

Dan

Re: ace proxy connections

danielng83 — Tue, 28 Dec 2010 17:56:37 GMT

Hi Bryan,

i have a query somewhat similar to yours. I hope this helps abit in understanding how the "show conn" works

https://supportforums.cisco.com/thread/2042187?tstart=0