CSS and SCA One-Armed Transparent Mode Problem

[nalcomis75]

I am having a routing problem (I believe) with my One-Arm Transparent Proxy configuration. When the SSL traffic (port 443) is sent to the CSS, the CSS forwards it off to the SCA on port 443. The SCA then forwards it back to the VIP on port 81 (verified with "show netstat" on the SCA). For some reason the CSS is not properly routing the inbound port 81 traffic to the back end servers. It is instead forwarding the traffic directly back to the client with a source port of 81 and a source IP of the VIP. I verified this with a packet sniffer on the client. When transparent mode is disabled on the SCA, the system functions properly (minus the transparent IP functionality). Has anybody seen this before? Thanks.

[pknoops]

Do you have a port 80 content rule and a port 81 content rule. They would look indentical except one was for SCA traffic only and the other would be for stright port 80 traffic from your clients.

What does the SCA config look like for the port 81 traffic being sent to the CSS ?

Regards

Pete..

[nalcomis75]

Pete,

Thanks for the reply. Attached are my configs.

[nalcomis75]

Pete,

I have a both a 80 and 81 content rule. I really don't need the 80 rule. The clients will be forced communicate with the servers via SSL.