sca+css 11000 outbound routing+access list problem

devrim.kalmaz · ‎09-06-2005

http://www.cisco.com/en/US/products/hw/contnetw/ps2083/products_configuration_example09186a00801bbf4e.shtml

We a have a configuration like in this link.But our vlan2 servers (ex.10.2.2.3) have some files or gadgets which run/get from servers in vlan1/intranet/our_lan (ex.10.50.50.x).In this case our gadgedts and linked files didn't run well.So we add manuel routing to this gadget running servers to solve our problem.(ex route add 10.50.50.x to upstream-router )But now we have another small problem.The problem is that our intranet servers which is on vlan1 side (10.50.50.x) cannot reach https services on vlan2 servers (ex.10.2.2.3).The configuration is work for other users very well.Thanks,

devrim.kalmaz · ‎09-06-2005

sample drawing attached.

Gilles Dufour · ‎09-06-2005

Devrim,

we will need your config and information about source ip and destination ip having problem to communicate.

Is it all the time, sometimes ?

Is it all type of traffic or just http or just https or .. ?

Thanks,

Gilles.

devrim.kalmaz · ‎09-07-2005

It's all the times.

It's only http and https.

devrim.kalmaz · ‎09-09-2005

Has anyone got any idea?Thanks,

Gilles Dufour · ‎09-09-2005

you need to remove your extra static routes.

You're breaking the ecmp concept.

To solve your gadget problem, you need to use acl prefer.

something like

clause 5 permit any any destination 10.50.50.10 255.255.255.0 prefer upstream-router

Apply this on you servers vlan.

Also your ACL 10 will need a clause 99 permit any any destination any.

Give it a try like this and let me know what works and what does not.

Regards,

Gilles.

devrim.kalmaz · ‎09-12-2005

is this the right config?

Thanks,

acl 5

clause 10 permit any any destination any

apply circuit-(VLAN1)

apply circuit-(VLAN2)

acl 10

clause 5 permit any any destination 10.50.x.x 255.255.255.0 prefer upstream-router

clause 10 permit any any destination any prefer upstream-router

clause 99 permit any any destination any

apply circuit-(VLAN3)

Gilles Dufour · ‎09-12-2005

Looks good.

I assume your servers are in vlan 3.

Does it work ?

G.

devrim.kalmaz · ‎09-12-2005

Yes our https servers are in vlan3.

Gadget servers are in vlan1.

I can try it tomorrow.I'll write results here.

Thank you.