ACE module Bridge mode issue

[ehdf_infra]

Hi All,

I am trying to configure one of the contexts in ACE module in bridged mode. Generic issues what i am facing is servers are not able to reach the gateways

SRV->ACE in Bridge mode-> FW->OUTSIDE USERS

Default gateway on server is the firewall IP , where as outside users' connection will hit firewall go to the  load balancer  inorder to reach the server and do the load balancing.

I have couple of BVI groups ( since i have 5 set of services), and thus I use "mac-sticky" enable feature on each client VLAN associated with the respective server vlan.

None of my serverfarm servers are able to reach the gateways ( ping)  but from the firewall I am able to ping the servers. but when a user outside is trying to initiate traffic it is not getting through even though it hits the service policy.

Any help is highly appreciated.

My config is attached herewith.

[rvavale · Accepted solution]

Hi,

Can you try by configuring 'access-group input PERMIT-ANY' on interface vlan 106. By default, ACE will Deny all Incoming traffic on an Interface unless you specify Permit ACL.

Hope this helps,

Best Regards,

Rahul

[parveesm123]

Hi Rahul,

Yes , it worked after putting the access-list

many thanks

Parvees (EHDF_INFRA)

[Ahmed Sabanaa]

Dears ,

i have the follwing problem ,could anyone please help me because i am in a hurry .

I have Cisco ACE Device configured with bridging mode ,

lately we have migration between tow server Farms , and the server admin asks me to grant access between the phisical server on the old server farm to the virtual IP of the other server farm :

lets say that we have SF 1, and SF2

the VIP of the SF1 192.168.100.10

with 2 Rservers :192.168.100.1 and 192.168.100.2

and the VIP of the SF2 192.168.100.20

with 2 Rservers 192.168.100.3 and 192.168.100.4

and the Admins Asks me to grant access from the servers on the SF1(192.168.100.1 &192.168.100.2) to the VIP ip of the SF2(192.168.100.20) and nothing denying this access it is from the same sub net  ,but its not working .....

please help solving this problem >?????

[Simon Chow · Accepted solution]

Vlan 106 is missing "access-group input PERMIT-ANY", adding this fixed the ping problem from servers.

Reason for adding the access-list on the server side interface is because the server ping first comes into the ACE via the server side Vlan, hence requiring an access-list entry on the server vlan to allow this.