cisco ACE and firewall design

[helsayed78]

Guys,

If I have servers protected behind a firewall and I need to load balance some servers , where should I place the ACE?

Sent from Cisco Technical Support iPad App

[rgadle]

Hello,

Here it depends, on the nature of configuration that will be done on Ace. As per best practise put firewall in front of ACE. So the topogy should be like FW --> ACE --> SEVER FARM.

Sent from Cisco Technical Support Android App

[helsayed78]

This means I should go with the bridged mode ...

However I want to go with the one-arm mode.

What do you think?

Sent from Cisco Technical Support Android App

[helsayed78]

Any idea guys?

Sent from Cisco Technical Su:pport Android App

[sivaksiv]

Hi,

With one-arm i believe the question is where you want to place the firwall. As long as the client is able to reach the VIP and server replies back to ACE i dont see any problem with this design.

Firewall ---------Switch ---------------- Load Balancer ---

As you know with one-arm requires a source NAT and might not be a good fit for application that are using the source IP address to track client usage patterns. PBR avoids this problem but adds other considerations, such as routing complexity, asymmetrical routing for non-load-balanced flows, and VRF support; PBR is not available on VRFs.

Regards,

Siva

[helsayed78]

Actual this is the issue that I am facing ..... I won't be able to trace users since it is using source NAT that is allowed on the firewall to access the application .... And I am controlling the access using the access list on cisco ACE since I have on other options. Can you elaborate more on the PBR ... Think this might help alot.

Sent from Cisco Technical Support iPad App

[sivaksiv]

Hi,

With PBR, the server sends the packet to its default gateway, then the default gateway routes the packet via pbr to the ACE. 

This ideaology has a few requirements - ACE has to be L2 adjacent to the router that you configure the PBR on, and L2 adjacent to the server to make it simple.

PBR sample config:

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sga/configuration/guide/pbroute.html#wp1006646

Regards,

Siva