Cannot ping VIP in One-Arm mode

[dlongworth]

Hello.

I can ping the ip addresses of the vlan and access via management, the real-servers are Active along with the VIP service (ie. show service-policy) but I cannot ping the VIP interface and traces do not show any traffic hitting it because the 6500 the ACE (vc4710ace-mz.A1_8_0a) is connecting to has no ARP entry for the VIP.

It's in One-Arm mode; one gig-link to core, vlan 141.

I've attached the config.

Anyone got any ideas what I'm missing, please?

[litrenta · Accepted solution]

You vip is configured with a netwmask

10 match virtual-address 10.214.40.241 255.255.254.0 tcp any

since it is not a host vip it will not get in the arp table of the switch.

if you configure as:

10 match virtual-address 10.214.40.241 25 tcp any

you will get an arp entry.

If you want to treat the vip as a network then you would need to assign an alias ip address to int vlan 141 and add a static route on 6500 to point to the alias ip as next hop for that network.

But looking at your config I would guess you simply need to change the vip to a host address.

[dlongworth]

Doh!

Thanks for your help.

[iwearing]

I realise this is an old post.

I am struggling to find worthwhile documentation for the ace 4710 configured in one arm mode.

Can you confirm whether the Real Servers have their default gateways configured with the ace or the next hop router.

thanks

ian.

[dario.didio]

Hi,

the default gateway of your servers is the upstream router.

Have a look at following link: http://docwiki.cisco.com/wiki/Basic_Load_Balancing_Using_One_Arm_Mode_with_Source_NAT_on_the_Cisco_Application_Control_Engine_Configuration_Example

Nevermind the picture, it should look more like this: http://docwiki.cisco.com/wiki/SSL_Termination_on_the_Cisco_Application_Control_Engine_Using_an_Existing_Chained_Certificate_and_Key_in_One_Arm_Mode_Configuration_Example

HTH,

Dario

[iwearing]

Dario,

Thats great.

Thanks for the useful links.

Ian.