topic ACE VIP Design Query in Application Networking

ACE VIP Design Query

Lim Victor — Sat, 18 Aug 2012 12:39:29 GMT

Hi all,

I am configuring a ACE in routed mode. I would like to ask if the VIP is of a different subnet(10.10.138.14) from the interface vlans (10.10.160.192/29, 100.100.160.208/29, 20.20.88.0/24,200.200.132.0/24), would the load-balancing work? Is there a need to configure the VIP on a vlan or is there any additional configuration that I should be doing?

I believe it should work based on the following thread.

https://supportforums.cisco.com/thread/132175

int gi1/1

description Connections to Client

switchport trunk allowed vlan 1,10,100

no shutdown

int gi1/2

description Connections to Servers

switchport trunk allowed vlan 20,200

no shutdown

#Client Side VLAN

interface vlan 10

description Client Side VLAN

ip address 10.10.160.196 255.255.255.248

peer ip address 10.10.88.197 255.255.255.248

alias 10.10.88.198 255.255.255.248

interface vlan 100

description Client Side VLAN

ip address 100.100.160.212 255.255.255.248

peer ip address 100.100.160.213 255.255.255.248

alias 100.100.160.214 255.255.255.248

#Server Side VLAN

interface vlan 20

description App(Server) VLAN

ip address 20.20.88.4 255.255.255.0

peer ip address 20.20.88.5 255.255.255.0

alias 20.20.88.250 255.255.255.0

interface vlan 200

description App(Client) VLAN

ip address 200.200.132.4 255.255.255.0

peer ip address 200.200.132.5 255.255.255.0

alias 200.200.132.250 255.255.255.0

#VIP Config

class-map CM_1

match virtual-address 10.10.138.14 255.255.255.255 tcp eq 80

exit

class-map CM_2

match virtual-address 10.10.138.11 255.255.255.255 tcp eq 7080

exit

class-map CM_3

match virtual-address 100.100.91.14 255.255.255.255 tcp eq 4561

exit

class-map CM_4

match virtual-address 100.100.91.13 255.255.255.255 tcp eq 4561

exit

Thanks.

ACE VIP Design Query

sivaksiv — Sat, 18 Aug 2012 14:35:57 GMT

Hi,

This should be possible.

Re: ACE VIP Design Query

Lim Victor — Sat, 18 Aug 2012 14:42:28 GMT

Hi Siva,

Just what I needed.

Thanks

Re: ACE VIP Design Query

Lim Victor — Sun, 19 Aug 2012 09:56:34 GMT

Another question that I have.

If the gateway for the servers in my server VLANs are not on the ACE interface, anything that i will need to take note for the below scenarios?

1) For requests coming from the client vlan to any of the server vlan(vlan 20 or 200)?

2) For requests coming from the server vlan 20 to server vlan 200?

3) For requests coming from the server vlan 20 to server vlan 20? Should i be doing source nat like below? Any problems if I use the alias IP(20.20.88.250 for vlan 20 and 200.200.132.250 for vlan 200) of the server vlans as the nat IP?

class-map match-all L4-MAP-SNAT-INTERNAL-20

2 match source address 20.20.88.0 255.255.255.0

class-map match-all L4-MAP-SNAT-INTERNAL-200

2 match source address 200.200.132.0 255.255.255.0

policy-map multi-match PM_1

class L4-MAP-SNAT-INTERNAL-200

nat dynamic 1 vlan 200

policy-map multi-match PM_2

class L4-MAP-SNAT-INTERNAL-200

nat dynamic 1 vlan 200

policy-map multi-match PM_3

class L4-MAP-SNAT-INTERNAL-20

nat dynamic 2 vlan 20

policy-map multi-match PM_4

class L4-MAP-SNAT-INTERNAL-20

nat dynamic 2 vlan 20

interface vlan 20

service-policy input PM_3

service-policy input PM_4

nat pool 2 20.20.88.250 20.20.88.250 netmask 255.255.255.255 pat

interface vlan 200

service-policy input PM_1

service-policy input PM_2

nat pool 1 200.200.132.250 200.200.132.250 netmask 255.255.255.255 pat

ACE VIP Design Query

sivaksiv — Sun, 19 Aug 2012 10:22:41 GMT

Hi,

If the server gateway is not ACE ip then you would require SNAT to make sure the reply comes back to ACE for all 3 scenarios.

The service-policy should be applied on client vlan for scenario 1. Rest looks good and this should make sure the return traffic comes back to ACE.

Regards,

Siva

Re: ACE VIP Design Query

Lim Victor — Tue, 21 Aug 2012 01:42:51 GMT

Hi Siva,

Tested it yesterday and my ACE is working well. I amended the nat pool ip address to use a different ip address from the alias IP address.

int gi1/1

description Connections to Client

switchport trunk allowed vlan 1,10,100

no shutdown

int gi1/2

description Connections to Servers

switchport trunk allowed vlan 20,200

no shutdown

#Client Side VLAN

interface vlan 10

description Client Side VLAN

ip address 10.10.160.196 255.255.255.248

peer ip address 10.10.88.197 255.255.255.248

alias 10.10.88.198 255.255.255.248

#Server Side VLAN

interface vlan 20

description App(Server) VLAN

ip address 20.20.88.4 255.255.255.0

peer ip address 20.20.88.5 255.255.255.0

alias 20.20.88.250 255.255.255.0

service-policy input PM_1

service-policy input PM_2

service-policy input PM_3

service-policy input PM_4

nat pool 2 20.20.88.251 20.20.88.251 netmask 255.255.255.255 pat

interface vlan 200

description App(Client) VLAN

ip address 200.200.132.4 255.255.255.0

peer ip address 200.200.132.5 255.255.255.0

alias 200.200.132.250 255.255.255.0

service-policy input PM_1

service-policy input PM_2

service-policy input PM_3

service-policy input PM_4

nat pool 1 200.200.132.251 200.200.132.251 netmask 255.255.255.255 pat

#VIP Config

class-map CM_1

match virtual-address 10.10.138.14 255.255.255.255 tcp eq 80

exit

class-map CM_2

match virtual-address 10.10.138.11 255.255.255.255 tcp eq 7080

exit

class-map CM_3

match virtual-address 100.100.91.14 255.255.255.255 tcp eq 4561

exit

class-map CM_4

match virtual-address 100.100.91.13 255.255.255.255 tcp eq 4561

exit

#Policy Map

policy-map multi-match PM_1

class CM_1

loadbalance vip inservice

loadbalance policy P_1

loadbalance vip icmp-reply active

nat dynamic 1 vlan 200

policy-map multi-match PM_2

class CM_2

loadbalance vip inservice

loadbalance policy P_2

loadbalance vip icmp-reply active

nat dynamic 1 vlan 200

policy-map multi-match PM_3

class CM_3

loadbalance vip inservice

loadbalance policy P_3

loadbalance vip icmp-reply active

nat dynamic 2 vlan 20

policy-map multi-match PM_4

class CM_4

loadbalance vip inservice

loadbalance policy P_4

loadbalance vip icmp-reply active

nat dynamic 2 vlan 20

Thanks so much for the guidance