CSS11050 Redirect IP Address

fpulice · ‎12-10-2002

I try to setup two web servers (10.1.1.10 and 10.1.1.11) using CSS11000 for load balancing. By using VIP address 10.1.1.30 with stricky content rule. However when the application server rely back the request the URL still contain the web server ip address (10.1.1.10 or 10.1.1.11) , is there the way to redirect or change the url contents point to VIP address rather then the web server ip address from the CSS ?

pknoops · ‎12-13-2002

Yes there is/

You can create a group to NAT the servers response back out to the VIP address.

group pete

vip address 10.1.1.30

add service server1

add service server2

active

This will take all traffic being sourced from the servers going outbound through the CSS and NAT the source ip to the VIP address and not show the servers ip address

Regards

Pete Knoops

Cisco Systems

fpulice · ‎12-13-2002

Thank you Pete

jcy444 · ‎03-04-2003

What if you need each server to access a domain controller by it's individual address not the VIP? Is there a way to exclude the Group from being applied to flows to the domain controller?

pknoops · ‎03-04-2003

The only way to do this is to apply the group in a different manner.

So you would still have a group configured, but you would not add any services to it. It would simply be a group with a vip in it and it was active.

Then you would use acls on the box to to apply the sourcegroup given certain source and destination criteria. If you do not already use ACLs, beware as they can be dangerous and they have an implicit deny on all traffic to all vlans if not configured correctly.

So in conclusion, you tell the CSS when to NAT as opposed to NATing everything with regards to the servers.

Regards

Pete..

jcy444 · ‎03-04-2003

I assume I would need to use the "bypass" command on the ACL to exclude the content rule to the domain controllers. Thanks for the info!

pknoops · ‎03-05-2003

Most people think you would use the bypass command on the acl for this particular issue, but bypass does not work on a source group. It is mainly for bypassing content rules. The equivalent of bypass when using acls and source groups is to explicitly state which traffic gets nat'd and not which traffic does not get nat'd. It's kind of a reverse thinking approach. When you have to tell the CSS which traffic not to nat, you in fact tell it only which traffic to nat and leave out the traffic you do not want the CSS to nat.

Pete..