The servers are connected to a 3524XL switch.
The CSS is the default gateway to the servers.
The server can bypass the CSS if we change the gateway, because the firewalls are in the same network.
I don´t have any ACL in the CSS
The services are alive.
I can ping the VIP.
CONFIG:
CSS-1A# version
Version: ap0500033 (5.00 Build 33)
Flash (Locked): 5.00 Build 33
Flash (Operational): 5.00 Build 33
Type: PRIMARY
Licensed Cmd Set(s): Standard Feature Set
SSH Server
CSS-1A# sh boot
!************************ BOOT CONFIG ************************
ip address 192.168.7.242
subnet mask 255.255.255.0
primary boot-file ap0500033
primary boot-type boot-via-disk
CSS-1A# sh run
!Generated on 02/26/2003 19:32:32
!Active version: ap0500033
configure
!*************************** GLOBAL ***************************
ip redundancy
no restrict web-mgmt
no restrict xml
restrict ftp
restrict telnet
restrict user-database
restrict snmp
app session 192.168.100.2
app
ip route 0.0.0.0 0.0.0.0 192.168.1.254 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
bridge vlan 3
description "HeartBeat"
interface e2
phy 100Mbits-FD
bridge vlan 2
redundancy-phy
description "UP-Link to FW01N1 via Switch-3A"
interface e3
phy 100Mbits-FD
bridge vlan 2
interface e4
phy 100Mbits-FD
bridge vlan 2
interface e5
phy 100Mbits-FD
bridge vlan 2
interface e6
phy 100Mbits-FD
bridge vlan 2
interface e7
phy 100Mbits-FD
bridge vlan 2
interface e8
phy 100Mbits-FD
bridge vlan 4
!************************** CIRCUIT **************************
circuit VLAN3
ip address 192.168.100.1 255.255.255.0
redundancy-protocol
circuit VLAN2
redundancy
ip address 192.168.1.250 255.255.255.0
circuit VLAN4
ip address 10.6.1.60 255.255.255.128
!************************** SERVICE **************************
service WEB01_HTTP
ip address 192.168.1.31
keepalive type tcp
keepalive port 80
keepalive frequency 15
keepalive maxfailure 2
active
service WEB01_HTTP&HTTPS
ip address 192.168.1.31
keepalive frequency 15
keepalive maxfailure 2
active
service WEB01_HTTPHEADwebinfo
ip address 192.168.1.31
keepalive type script ap-kal-httplist "192.168.1.31 /webinfo.asp"
keepalive frequency 15
keepalive maxfailure 2
active
service WEB01_HTTPS
ip address 192.168.1.31
keepalive type tcp
keepalive port 443
keepalive frequency 15
keepalive maxfailure 2
active
service WEB02_HTTP
ip address 192.168.1.32
keepalive type tcp
keepalive port 80
keepalive frequency 15
keepalive maxfailure 2
active
service WEB02_HTTP&HTTPS
ip address 192.168.1.32
keepalive frequency 15
keepalive maxfailure 2
active
service WEB02_HTTPHEADwebinfo
ip address 192.168.1.32
keepalive type script ap-kal-httplist "192.168.1.32 /webinfo.asp"
keepalive frequency 15
keepalive maxfailure 2
active
service WEB02_HTTPS
ip address 192.168.1.32
keepalive type tcp
keepalive port 443
keepalive frequency 15
keepalive maxfailure 2
active
service WEB03_HTTP
ip address 192.168.1.33
keepalive type tcp
keepalive port 80
keepalive frequency 15
keepalive maxfailure 2
active
service WEB03_HTTP&HTTPS
ip address 192.168.1.33
keepalive frequency 15
keepalive maxfailure 2
active
service WEB03_HTTPHEADwebinfo
ip address 192.168.1.33
keepalive type script ap-kal-httplist "192.168.1.33 /webinfo.asp"
keepalive frequency 15
keepalive maxfailure 2
active
service WEB03_HTTPS
ip address 192.168.1.33
keepalive type tcp
keepalive port 443
keepalive frequency 15
keepalive maxfailure 2
active
service WEB04_HTTP
ip address 192.168.1.34
keepalive type tcp
keepalive port 80
keepalive frequency 15
keepalive maxfailure 2
active
service WEB04_HTTP&HTTPS
ip address 192.168.1.34
keepalive frequency 15
keepalive maxfailure 2
keepalive type script ap-kal-dcheck "192.168.1.34"
active
service WEB04_HTTPHEADwebinfo
ip address 192.168.1.34
keepalive type script ap-kal-httplist "192.168.1.34 /webinfo.asp"
keepalive frequency 15
keepalive maxfailure 2
active
service WEB04_HTTPS
ip address 192.168.1.34
keepalive type tcp
keepalive port 443
keepalive frequency 15
keepalive maxfailure 2
active
!*************************** OWNER ***************************
owner www.cidadebcp.pt
content Rule_HTTP
vip address 192.168.1.100
protocol tcp
port 80
advanced-balance sticky-srcip
add service WEB01_HTTP&HTTPS
add service WEB02_HTTP&HTTPS
add service WEB03_HTTP&HTTPS
add service WEB04_HTTP&HTTPS
active
content Rule_HTTPS
vip address 192.168.1.100
protocol tcp
port 443
advanced-balance sticky-srcip
add service WEB02_HTTP&HTTPS
add service WEB01_HTTP&HTTPS
add service WEB03_HTTP&HTTPS
add service WEB04_HTTP&HTTPS
active
SHOW SUMMARY
CSS-1A# sh summ
Global Bypass Counters:
No Rule Bypass Count: 1406999
Acl Bypass Count: 0
Owner Content Rules State Services Service Hits
www.?????????.pt Rule_HTTP Active WEB01_HTTP&HTTPS 23851961
WEB02_HTTP&HTTPS 23432601
WEB03_HTTP&HTTPS 25224983
WEB04_HTTP&HTTPS 20882126
Rule_HTTPS Active WEB01_HTTP&HTTPS 34624556
WEB02_HTTP&HTTPS 32311666
WEB03_HTTP&HTTPS 33279661
WEB04_HTTP&HTTPS 30738365
SHOW SERV SUMMARY
CSS-1A# show serv summ
Service not found
I hope that this information is enough to you.
If you want i can send you the same information by mail. Tell me if necessary.
