topic Re: sca+css 11000 outbound routing+access list problem in Application Networking

sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Wed, 07 Sep 2005 05:47:14 GMT

http://www.cisco.com/en/US/products/hw/contnetw/ps2083/products_configuration_example09186a00801bbf4e.shtml

We a have a configuration like in this link.But our vlan2 servers (ex.10.2.2.3) have some files or gadgets which run/get from servers in vlan1/intranet/our_lan (ex.10.50.50.x).In this case our gadgedts and linked files didn't run well.So we add manuel routing to this gadget running servers to solve our problem.(ex route add 10.50.50.x to upstream-router )But now we have another small problem.The problem is that our intranet servers which is on vlan1 side (10.50.50.x) cannot reach https services on vlan2 servers (ex.10.2.2.3).The configuration is work for other users very well.Thanks,

Re: sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Wed, 07 Sep 2005 05:51:26 GMT

sample drawing attached.

Re: sca+css 11000 outbound routing+access list problem

Gilles Dufour — Wed, 07 Sep 2005 06:35:40 GMT

Devrim,

we will need your config and information about source ip and destination ip having problem to communicate.

Is it all the time, sometimes ?

Is it all type of traffic or just http or just https or .. ?

Thanks,

Gilles.

Re: sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Wed, 07 Sep 2005 07:26:54 GMT

It's all the times.

It's only http and https.

Re: sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Fri, 09 Sep 2005 07:10:17 GMT

Has anyone got any idea?Thanks,

Re: sca+css 11000 outbound routing+access list problem

Gilles Dufour — Fri, 09 Sep 2005 14:32:41 GMT

you need to remove your extra static routes.

You're breaking the ecmp concept.

To solve your gadget problem, you need to use acl prefer.

something like

clause 5 permit any any destination 10.50.50.10 255.255.255.0 prefer upstream-router

Apply this on you servers vlan.

Also your ACL 10 will need a clause 99 permit any any destination any.

Give it a try like this and let me know what works and what does not.

Regards,

Gilles.

Re: sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Mon, 12 Sep 2005 08:56:13 GMT

is this the right config?

Thanks,

acl 5

clause 10 permit any any destination any

apply circuit-(VLAN1)

apply circuit-(VLAN2)

acl 10

clause 5 permit any any destination 10.50.x.x 255.255.255.0 prefer upstream-router

clause 10 permit any any destination any prefer upstream-router

clause 99 permit any any destination any

apply circuit-(VLAN3)

Re: sca+css 11000 outbound routing+access list problem

Gilles Dufour — Mon, 12 Sep 2005 10:04:44 GMT

Looks good.

I assume your servers are in vlan 3.

Does it work ?

Re: sca+css 11000 outbound routing+access list problem

devrim.kalmaz — Mon, 12 Sep 2005 10:27:36 GMT

Yes our https servers are in vlan3.

Gadget servers are in vlan1.

I can try it tomorrow.I'll write results here.

Thank you.