Need help with initial ACE 4710 config

[dclee]

Hoping someone can point me in right direction to config guide etc..

Essentially I have 2 Exchange servers on vlan 10.

I want to use the 4710 to sit in front of them and load balance between the 2 servers.

The 4710 and the 2 servers are on the same vlan.

I have configured a VIP, the 2 real servers and the the server farm. Everything appears to be inservice.

Any help would be appreciated.

Cheers

Dave

[Pablo · Accepted solution]

Hi Dave,

If you have a one-armed design then you require Source NAT to get things working

policy-map type loadbalance http first-match Exchange-PM
  class class-default
    serverfarm Exchange

policy-map multi-match LB
  class Exchange-VIP
    loadbalance vip inservice
    loadbalance policy Exchange-PM
    loadbalance vip icmp-reply active
   nat dynamic 1 vlan 10

interface vlan 10
  ip address 10.10.10.2 255.255.255.0
  access-group input Any
nat-pool 1 10.10.10.10 10.10.10.10 netmask 255.255.255.0 pat
  service-policy input MGMT
  service-policy input LB

  no shutdown

You can use the VIP address or any other available IP address no NAT the request.

HTH

__ __

Pablo

[dclee]

Thanks for the reply and I understand the need for source nating...but was hoping someone could provide me a sample

walk thru of a 1 armed scenario ?

Cheers

Dave

[Pablo]

Morning Dave,

Gotcha, you're looking for something like this

http://docwiki.cisco.com/wiki/Basic_Load_Balancing_Using_One_Arm_Mode_with_Source_NAT_on_the_Cisco_Application_Control_Engine_Configuration_Example

I've attached a configuration chapter that walks you through the one-arm mode configuration and all its requirements.

HTH

__ __

Pablo

[dclee]

Thanks Pablo

I noticed its for the ACE module, does this config also work for the stand alone 4710 appliance ?

From a best practice perspective, is it best to put the ACE VIP on a seperate routed VLAN ?

I notice the network diagram has the ACE on VLAN 50 and the servers on VLAN 51 with the MSFC routing between the 2.

Or can I have both the ACE physical and VIP on the same subnet as my server farm ?

Cheers

Dave

[Pablo]

Dave,

Yup the configuration lines on the module and the appliance are indentical, I think more of the docs are module oriented because of the sell numbers

From a best practice perspective, is it best to put the ACE VIP on a seperate routed VLAN ?

Not really the design that you want to implement depends on what's already setup on your environment, regardless of the mode that you want to go with Bridged/One-Armed/Routed you can expect same load balancing performance, for example clients would not go with One-Armed mode if they need to avoid client NAT for auditing purposes or something.

I notice the network diagram has the ACE on VLAN 50 and the servers on VLAN 51 with the MSFC routing between the 2./Or can I have both the ACE physical and VIP on the same subnet as my server farm ?

That's a Cisco's different (weird) sketch for a one-armed design, the diagram that commonly you see is like this

http://img526.imageshack.us/i/onearmed.jpg/

Absolutely you can have ACE/VIP/Servers on the same VLAN as long as source NAT is in place LB should work flawlessly =)

HTH

__ __

Pablo

[dclee]

Thanks Pablo, your help is much appreciated

So far I have gotten the load balancer working with 2 servers

in a server farm.

Cheers

Dave

[Pablo]

Sweeeet! Great to hear the info was useful to get things on the right track

Have a nice one!

__ __

Pablo