topic Thank you KanwalIn this in Application Networking

Cisco ACE incorrect translation src port

CSCO117775131 — Fri, 14 Nov 2014 13:28:35 GMT

Dear Experts please HELP!

I have one VIP IP 172.17.10.55:9082 for loadbalance between rservers with different ports(172.17.10.18:9083, 172.17.10.19:9087, 172.17.10.20:9084...)

class-map match-all VS_PP_9082
  2 match virtual-address 172.17.10.55 tcp eq 9082

serverfarm host SF_PRIZPRIV_9082
predictor leastconns
probe PR_PP_9082
rserver 172.17.10.18 9083
inservice
rserver 172.17.10.19 9087
....

Problem: ACE incorrect translate src port. The src port 47016, but ACE replace to 1092(or it can be 1280,1092,1278)

When port Vip and port rserver in serverfarm the same it works correct.

conn-id    np dir proto vlan source                destination           state
----------+--+---+-----+----+---------------------+---------------------+------+
488907     2  in  TCP   21   172.17.1.17:47016     172.17.10.55:9082     ESTAB
205377     2  out TCP   5    172.17.10.18:9083     172.17.1.17:1092      ESTAB

ACE Version A5(3.0)

How to solve it ? PLS give your recommendations.

BR,

Denis

Hi Denis,You have class map

Kanwaljeet Singh — Fri, 14 Nov 2014 22:46:41 GMT

Hi Denis,

You have class map matching on port 9082 and you have serverfarm listening on 9083. So ACE, changes the destination port to 9083 before forwarding it to the server but remember it will also change the source port and that is FAD. Are you facing any issues with that?

When the reply from server i.e 172.17.10.18 from src port 9083 will hit the ACE, ACE will change the dst port from 1092 back to 47016 and fwd the request back to client. Shouldn't be a problem.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

Thank you KanwalIn this

CSCO117775131 — Thu, 20 Nov 2014 12:54:58 GMT

Thank you Kanwal

In this situation, class map matching on port 9081 and serverfarm listening on 9082.
----------------------------------------------------------------------------------
ACE30-1/VC_FRONT_SRV# show conn serverfarm SF_PRIZPRIV_9082

conn-id np dir proto vlan source destination state
----------+--+---+-----+----+---------------------+---------------------+------+
2085856 3 in TCP 21 172.17.1.17:46983 172.17.10.55:9081 ESTAB
2040930 3 out TCP 5 172.17.10.18:9082 172.17.1.17:1037 ESTAB

ACE30-1/VC_FRONT_SRV# show conn ipv4 | include 172.17.1.17
2085856 3 in TCP 21 172.17.1.17:46983 172.17.10.55:9081 ESTAB
2040930 3 out TCP 5 172.17.10.18:9082 172.17.1.17:1037 ESTAB

serverfarm host SF_PRIZPRIV_9082
predictor leastconns slowstart 500
rserver 172.17.10.18 9082
cookie-string "priz01"
inservice
-----------------------------------------------------------------------------------

When ACE send back answer the port not changed to 46983

Cisco sent to us new FW Version A5(3.1a) but the problem not gone

PLZ reply me if you have any ideas

BR,

Denis

Hi Denis,Do you actually see

Kanwaljeet Singh — Thu, 20 Nov 2014 14:42:09 GMT

Hi Denis,

Do you actually see that port was not changed in pcaps or on the basis of "show conn" output you are saying that?

So IN and OUT actually correspond to ICM(Inbound connection manager) and OCM(outbound connection manager).

2085856 3 in TCP 21 172.17.1.17:46983 172.17.10.55:9081 ESTAB

Above represents the incoming leg of the connection where client comes on VIP.

2040930 3 out TCP 5 172.17.10.18:9082 172.17.1.17:1037 ESTAB

Above represents the leg of the connection where ACE forwarded the connection to server i.e 172.17.10.18. But in representation it is reversed. So when ACE forwarded the connection server .18, it changed the source port to 1037. This is what it represents.

If you have packet capture on client side indicating that the ACE didn't rewrite the source port before forwarding the packet to client, then that would be a bug. I doubt that is the case but then pcaps are our best friend to confirm that.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

Hello Kanwal I check again,

CSCO117775131 — Sat, 29 Nov 2014 19:18:06 GMT

Hello Kanwal

I check again, the port translation work is correct, you are right.

In our configuration we use S NAT, so the reply comes back through the ACE.

The scheme is Front--->LB--->APP, but with different ports APP it not work.

Q. ACE can work with different ports (Vip port not the same like in service-farm) ?

class-map match-all CM_LB_APP
2 match virtual-address 172.17.10.55 tcp eq 9081

serverfarm host SF_APP_EPZ
predictor leastconns
rserver APP 9082

I attach my configuration, if YOU have a time PLZ look on it.

Denis

Hi Denis,I haven't checked

Kanwaljeet Singh — Sat, 29 Nov 2014 19:18:07 GMT

Hi Denis,

I haven't checked the configuration but what you have demonstrated above should work just fine. Any request that comes on 9081 would be forwarded to 9082 since you have mentioned 9082 port in front of real server in the farm.

Is this not working?

Regards,

Kanwal

Note: Please mark answers if they are helpful.

Thank you, KanwalI used

CSCO117775131 — Tue, 09 Dec 2014 09:57:30 GMT

Thank you, Kanwal

I used capture packets directly on ACE, so it helped me.

Denis