Re: Port ranges on CSS

paul.matthews · ‎06-29-2004

Is there an easy way to have a content rule listen on a range of selcted ports rather than all open or just one?

robin.pimentel · ‎06-29-2004

Paul,

I just want to shoot out an idea to you. I haven't tried this out myself, so my apologies if I'm way off here. Is there a reason why you couldn't define a service for each port on the same host? So lets say you wanted http and dns:

service serv1-http

port 80

ip 192.168.1.1

service serv1-dns

port 53 (UDP or TCP depending on DNS function)

ip 192.168.1.1

then add the two services to a single content rule (VIP). Just an idea. Let me know what you come up with, since your question was pretty interesting.

Gilles Dufour · ‎07-05-2004

Robin,

sorry to say this but your solution is totally wrong.

If you have 2 services defined with a different port and assigned to the same content rule, the CSS will one time nat to port1 and one time to port2.

For example, you get a connection on port 80, the CSS could loadbalance the request to serv1-dns since it is configured under the content rule and the CSS will forward the request to port 53 -> see the problem.

There is no solution to Paul's request unless we get more info about the end goal so we can find a different approach.

Regards,

Gilles.

robin.pimentel · ‎07-06-2004

Gilles,

good catch. I was obviously out of my mind on that one. I think I can safely say that I lost my perspective (big picture) on that one. I was thinking of a load balance algorithm in my mind that doesn't exist in real life. Too much brainstorming. Obviously, a content rule will just load balance between services in the same rule. My sincere appologies to Paul.

paul.matthews · ‎07-06-2004

No problem - sometimes off the wall stuff works...

Gilles Dufour · ‎07-05-2004

no solution.

You can have a layer 3 rule that will accept all ports and then use an acl to limit what ports you want to be accessible.

Regards,

Gilles.

paul.matthews · ‎07-05-2004

Thanks. I have a feeling that is the way I will have to go to do it. It would be useful to have a range facility for ports though.

Paul.