12-10-2002 01:22 PM
I try to setup two web servers (10.1.1.10 and 10.1.1.11) using CSS11000 for load balancing. By using VIP address 10.1.1.30 with stricky content rule. However when the application server rely back the request the URL still contain the web server ip address (10.1.1.10 or 10.1.1.11) , is there the way to redirect or change the url contents point to VIP address rather then the web server ip address from the CSS ?
12-13-2002 04:51 AM
Yes there is/
You can create a group to NAT the servers response back out to the VIP address.
group pete
vip address 10.1.1.30
add service server1
add service server2
active
This will take all traffic being sourced from the servers going outbound through the CSS and NAT the source ip to the VIP address and not show the servers ip address
Regards
Pete Knoops
Cisco Systems
12-13-2002 10:00 AM
Thank you Pete
03-04-2003 12:49 PM
What if you need each server to access a domain controller by it's individual address not the VIP? Is there a way to exclude the Group from being applied to flows to the domain controller?
03-04-2003 12:55 PM
The only way to do this is to apply the group in a different manner.
So you would still have a group configured, but you would not add any services to it. It would simply be a group with a vip in it and it was active.
Then you would use acls on the box to to apply the sourcegroup given certain source and destination criteria. If you do not already use ACLs, beware as they can be dangerous and they have an implicit deny on all traffic to all vlans if not configured correctly.
So in conclusion, you tell the CSS when to NAT as opposed to NATing everything with regards to the servers.
Regards
Pete..
03-04-2003 01:34 PM
I assume I would need to use the "bypass" command on the ACL to exclude the content rule to the domain controllers. Thanks for the info!
03-05-2003 04:17 AM
Most people think you would use the bypass command on the acl for this particular issue, but bypass does not work on a source group. It is mainly for bypassing content rules. The equivalent of bypass when using acls and source groups is to explicitly state which traffic gets nat'd and not which traffic does not get nat'd. It's kind of a reverse thinking approach. When you have to tell the CSS which traffic not to nat, you in fact tell it only which traffic to nat and leave out the traffic you do not want the CSS to nat.
Pete..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide