Real server to respond for client ICMP request.

[bala.inspirer]

Hi ,

Is the below requirement possible ?

Whenever the clients are pinging to the server which is located behind LB must reply with Server real IP address. But instead of that LB is replying with the VIP.

As per our security audit team advice our we wanted to change this behaviour and we would like to know is there any settings available in LB side to make reply packet forwarded with real server IP address Instead of LB VIP. “

WS-X6066-SLB-APC

Thanks ,

Bala

[Kanwaljeet Singh · Accepted solution]

Hi Bala,

I assume you are pinging the real server IP, for that you can create a route which bypasses the LB so that server can reply directly. If you are pinging the vip, then ACE replies directly without sending the traffic to real servers unless you are loadbalancing ICMP requests. Loadbalance vip icmp-reply <active> , this command makes the ace to reply to pings without sending it to the servers in serverfarm. If you use <active> then ACE only replies when that serverfarm is ACTIVE otherwise not.

However, there is an option of DSR and below is the explanation about it:

https://supportforums.cisco.com/document/91121/configure-ace-direct-server-return-mode

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[bala.inspirer]

Hi Kanwal,

Thanks very much for the reply.

I have attempted to get the answer like anything and this doc helped a lot.

Thanks

Bala