Secondary ACE dropping connections

[magordon]

Let me start with: I have a failover set of ACE-4710's running FW 4.1. This had occurred on previos versions of the firmware as well.

I have a application (Oracle Forms Based) with a persistent connection required. On LB1 the service runs without issue, as soon as I try to run it on LB2 the connection drops after 30 seconds or so... Any ideas, and further troubleshooting I can do? The configs on both devices seem to be in sync if I do a sh ft group brief on both devices and there are no sync errors.

Thanks in advance.

Matt

[jsirstin]

Matt,

This is purley a shot in the dark but what IP is the server using for the gateway? Is it the alias  or physical IP of ACE?

Thanks

Jim

[magordon]

Jim,

Neither, the servers are not sitting directly behind the LB, they are on the same segment though.

Attached is the context config...

Thank you,

Matt

[jsirstin]

Matt,

Unfortunately nothing in the config jumps out to be an issue. Could you get a sniffer capture from the ACE that has the problem to see who is resetting the connection after 30 seconds?

If you do not have a sniffer available you could try using the ACE capture utility.

You first need to create an ACL to match a test client IP destined to the vip address.

access-list test extended permit ip host client host vip

replace the client IP with the word "client" and the vip you are hitting for "vip"

Once the ACL is built to match the interesting traffric you can build the capture.

you can name the capture anything you want the sample below uses the name "name"

from the #prompt

capture name interface vlan 1000 access-list test

capture name start

Have the cleint hit the vip. You should see the capture data scroll accross the screen at this point. Once you experience the failure you can stop the capture.

capture name stop.

If you need to poll this off in a format that you can open with Wireshark you can issue the command

copy capture name disk0: name

This will create a file on disk0: with the name you give it. From there you can ftp or tftp this file off and open it with wireshark. If you want to send this I will be happy to look at it.

Regards

Jim