6500 w/csm client talking with vip gets direct to real

[mariolaniel]

We got a small server farm with four real servers and one vserver. when the client initiate a connection with the vserv it opens up an RPC at a certain point and starts talking directly with one ofthe real servers totally bypassing the vserver and if we take down that real server, then the connection hangs and it does not get re-directed to another server. CSM is setup in bridge mode and the servers are being used for a document management application by Hummingbird. Has anyone seen that kind of behavior?

Any help would be welcomed has we are going live with this project at the end of the week.

[Gilles Dufour]

what is the concern ?

That the client goes directly to the real or that disconnecting the real does not redirect the connection ?

For the later, you should use the command 'failaction purge' under the serverfarm definition.

This will force the CSM to kill the connection if the real goes down.

For the other concern, your application is probably sending at some point its server ip address.

Each server will therefore send its own ip address and the client will go directly to it.

You should see if there is a way for your application to return a "configured" ip address that would be your vip.

You could also try to configure the vip as a loopback ip address on every real server and tell your application to advertise this address.

Hope this helps.

Gilles.

[mariolaniel]

Thanks Gilles,

I was wondering, is ther a way to prevent the real servers to talk directly with the client? If I change my config from bridge to router would it then be possible to prevent the real servers to talk directly with the clients or would I need to do source nat to achieve that?

In my situation, the server guys are not to keen on making changes to their servers, so if there is another way to circonvent the communication between the real servers and the client, it would be best.

Regards,

Mario

[Gilles Dufour]

Mario,

with route mode, client traffic is only allowed to vip address.

So, traffic sent directly from a client to a real server should be dropped.

Regards,

Gilles.

[mariolaniel]

Gilles,

In route mode, would a real server able to send traffic directly to a client, bypassing the vip?

I guess not, since the server vlan is totally hidden from the client, or is it?

Basically, what I'm trying to find out, is a way to prevent the client to talk directly to the reals and vice versa.

What I'm trying to achieve is:

client --> vserver --> real

real --> vserver --> client

Worst case, I would not mind this:

client --> vserver --> real

real --> client

client --> vserver --> real

Basically, I don't want the client to talk directly to the reals, always the vserver.

Thanks,

Mario