Solved: Cisco ACE transparent serverfarm with http

florentDet · ‎02-22-2013

I use ACE for load balance www and https to 3 servers. I use mode transparent for keep destination address and match it on each firewall (like failover).

For test, I tried on one server:

Me (194.78.223.33)

|

Internet

| (vlan 1231)

ACE

| (vlan 2164)

Firewall

|

Nginx (192.168.23.31)

Configuration:

access-list ANY line 8 extended permit icmp any any

access-list ANY line 16 extended permit ip any any

probe tcp PROBE_TCP

interval 5

passdetect interval 10

rserver host i1

ip address 172.16.0.1

conn-limit max 50000 min 40000

inservice

serverfarm host FARM_WEB_SSL

transparent

predictor hash address destination 255.255.255.255

probe PROBE_TCP

rserver i1

inservice

class-map match-any L4-WEB-SSL-IP

2 match virtual-address 5.135.79.20 tcp eq https

3 match virtual-address 5.135.79.20 tcp eq www

policy-map type loadbalance http first-match WEB_SSL_L7_POLICY

class class-default

serverfarm FARM_WEB_SSL

insert-http x-forward header-value "%is"

policy-map multi-match LB-to-vIPs

class L4-WEB-SSL-IP

loadbalance vip inservice

loadbalance policy WEB_SSL_L7_POLICY

access-group input ANY

interface vlan 1231

ip address 5.135.79.26 255.255.255.240

alias 5.135.79.25 255.255.255.240

peer ip address 5.135.79.27 255.255.255.240

service-policy input REMOTE_PUBLIC_MGMT

service-policy input LB-to-vIPs

no shutdown

interface vlan 2164

ip address 172.31.255.250 255.240.0.0

alias 172.31.255.249 255.240.0.0

peer ip address 172.31.255.251 255.240.0.0

no normalization

mac-sticky enable

no icmp-guard

nat-pool 1 172.31.255.248 172.31.255.248 netmask 255.240.0.0 pat

service-policy input REMOTE_MGMT_ALLOW_POLICY

no shutdown

ft track interface VLAN1231

track-interface vlan 1231

peer track-interface vlan 1231

priority 50

peer priority 5

ip route 0.0.0.0 0.0.0.0 5.135.79.30

My proxy sever recive request :

11:23:12.027868 IP (tos 0x0, ttl 254, id 26864, offset 0, flags [none], proto TCP (6), length 44)

194.78.223.33.53120 > 192.168.23.31.http: Flags [S], cksum 0x90ef (correct), seq 2632425798, win 32768, options [mss 1460], length 0

E..,h........N.!.......P...F....`...........

11:23:12.027884 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)

192.168.23.31.http > 194.78.223.33.53120: Flags [S.], cksum 0xa64f (correct), seq 556994644, ack 2632425799, win 14600, options [mss 1460], length 0

E..,..@.@........N.!.P..!3.T...G`.9..O......

11:23:12.548061 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)

192.168.23.31.http > 194.78.223.33.53018: Flags [S.], cksum 0x2225 (correct), seq 2696932208, ack 1878390816, win 14600, options [mss 1460], length 0

E..,..@.@........N.!.P.....po.. `.9."%......

But nothing in access log ... I tried with web server too .. Nothing ...

If I try without ACE, it works.

ajayku2 · ‎02-22-2013

Hi,

I see that you have tried to create a nat pool but I dont see any policy that use it.

policy-map multi-match LB-to-vIPs

class L4-WEB-SSL-IP

loadbalance vip inservice

loadbalance policy WEB_SSL_L7_POLICY

nat dynamic 1 vlan 2164 << Missing >>

access-group input ANY

try using the same that should help.

Also refer the following for more troubleshooting tips

http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Troubleshooting_Guide_--_Troubleshooting_Network_Address_Translation#Configuring_Dynamic_NAT_and_PAT

regards,

Ajay Kumar

View solution in original post

ajayku2 · ‎02-22-2013

Hi,

I see that you have tried to create a nat pool but I dont see any policy that use it.

policy-map multi-match LB-to-vIPs

class L4-WEB-SSL-IP

loadbalance vip inservice

loadbalance policy WEB_SSL_L7_POLICY

nat dynamic 1 vlan 2164 << Missing >>

access-group input ANY

try using the same that should help.

Also refer the following for more troubleshooting tips

http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Troubleshooting_Guide_--_Troubleshooting_Network_Address_Translation#Configuring_Dynamic_NAT_and_PAT

regards,

Ajay Kumar

florentDet · ‎02-22-2013

Thank you for the answer

Now, I've :

class L4-WEB-SSL-IP

loadbalance vip inservice

loadbalance policy WEB_SSL_L7_POLICY

nat dynamic 1 vlan 2164

But the result is the same... With IP of ACE

15:02:49.730291 IP (tos 0x0, ttl 254, id 713, offset 0, flags [none], proto TCP (6), length 44)

172.31.255.248.menandmice-mon > 192.168.23.31.http: Flags [S], cksum 0xabc8 (correct), seq 410041845, win 32768, options [mss 1460], length 0

E..,......6#...........P.p......`...........

15:02:49.730305 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 44)

192.168.23.31.http > 172.31.255.248.menandmice-mon: Flags [S.], cksum 0xd2f5 (correct), seq 2554169212, ack 410041846, win 14600, options [mss 1460], length 0