ACE Load Balancing

[creyes-IBM]

Hi all,

I´m configuring 2 ACE 4710 in failover, and I also need to balance 2 webservers at the momment. I have all of the IP address in the same subnet, is that a problem?

Server 1 192.168.1.1

Server 2 192.168.1.2

VIP 192.168.1.3

I have a VLAN for administration, and I have a VLAN for the client connection.

But when I try to connect to the VIP, It doesn't show the web page, but if I connect to the servers page directly they are working ok..

Does anybody know what can i check, or if there is any manual that really shows how to configure this type of connections.

Thanks..

[UHansen1976]

Carlos,

This could be helpfull to you: http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Troubleshooting_Guide.

Other than that, I'd recommend going through the following sequence of troubleshooting:

1. Access-list - Make sure traffic is actually permitted and that an access-list is applied to your ingress-interface.

2. VIPs - Verify, that your vip-addresses are in the state IN-SRVC and that hitcounters are increasing (or dropscounts possibly)

3. Multimatch policy - Do a detailed show of your policy-configuration and see, how far traffic gets or if it's dropped.

4. Serverfarms/realservers - Make sure, they're operational and see if any connections has passed through and failed connections. You could also look

    at your probe-status.

What kind of error are you getting? Timeout, blank page, incomplete page etc. Also, have you tried to run a trace?

hth

/Ulrich

[Sean Merrow]

Hello,

From your description, it sounds like you might have a one-armed configuration for load balancing.  If your management VLAN interface is only used for management, and you only have the client VLAN interface for load balancing, then this would be a one-armed config.  If this is indeed the case, then you would need to use either Policy-Based Routing to route the server response traffic back to the ACE rather than directly back to the client.  Or, the more common solution is to configure source NAT as shown below:

access-list ANYONE line 10 extended permit tcp any any

rserver host SERVER_01
  ip address 192.168.1.1
  inservice
rserver host SERVER_02
  ip address 192.168.1.2
  inservice

serverfarm host REAL_SERVERS
  rserver SERVER_01
    inservice
  rserver SERVER_02
    inservice

class-map match-all VIP-3
  2 match virtual-address 192.168.1.3 any

class-map type management match-any REMOTE_ACCESS
  description remote-access-traffic-match
  2 match protocol telnet any
  3 match protocol ssh any
  4 match protocol icmp any

policy-map type management first-match REMOTE_MGT
  class REMOTE_ACCESS
    permit

policy-map type loadbalance first-match SLB_LOGIC
  class class-default
    serverfarm REAL_SERVERS

policy-map multi-match CLIENT_VIPS
  class VIP-3
    loadbalance vip inservice
    loadbalance policy SLB_LOGIC
    loadbalance icmp-reply active
    nat dynamic 1 vlan 20

interface vlan 10
  description MANAGEMENT VLAN
  ip address 172.16.51.11 255.255.255.0
  access-group input ANYONE
  service-policy input REMOTE_MGT
  no shutdown
interface vlan 20
  description CLIENT VLAN
  ip address 192.168.1.10 255.255.255.0
  service-policy input CLIENT_VIPS
  nat-pool 1 192.168.1.100 192.168.1.100 netmask 255.255.255.0 pat
  no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.1.254

Hope this helps,

Sean