Am trying to replicate the managment interface functionality of a CSS on ACE 4710 but have problem with it being treated as a general routed interface.
On ACE 4710 I have a front-end interface for client facing VIPS and a back-end interface facing a server farm, taking care of load balancing flows
Non load-balance system traffic for the back-end servers also flows through these two ACE interfaces, following a default route path (the back-ends use the ACE as default gateway) i.e. dns requests from the servers flow through the ACE egressing the front-end interface to hit a firewall and route to an internal dns server.
If I add a "management interface" to the ACE 4710 and give it an IP address for management access, the interface by default assumes 'routed' mode and as the ACE treats this as a general interface it will route traffic out of it. For example if the IP address of this management interface is on the same network as the internal dns server, it breaks that connectivity. This as the ACE will see the "management" interface as best route to directly connected network and send traffic to dns server over that, however dns server response traffic will follow its defult route path via firewall and ACE front-end interface to get reply to back-end server. The firewall will block this traffic as traffic is asymmetrically routed and firewall not seen the initial dns request packet.
Is there a way of making an ACE interface a 'non routed' management only interface for out of band management use?
That is ACE will not attempt to route general traffic through the interface
I realise I could achieve this with multiple contexts but want to have a single context for various reasons - i.e. to have a kind of like for like CSS replacement using ACE 4710
Just in case someone else has to go down this path....
I had no luck with trying to a achieve a seperate 'management interface' ala CSS (using A5(1) f/w)
The short answer as it stands is you prob have to use separate context to split LB and management access and accept the other baggage that goes with that.
As workarounds I tried
This is a bit of a pain if you are trying to migrate/replicate a CSS install and or you want a 'simple' LB with no virtualisation - i.e. everything running in the default admin context
Seeing as on the ACE 4710 there is blanked off unused motherboard NIC, you'd think it might not be that hard to give the platform a separate Ethernet management port (like for example the CSS and ASA firewalls etc..) - leaving the 4 x GigE ports for LB traffic only