Why do I see "FAILED" for probes on standby ACE?

[HyeonCheol Cho]

Here there,

I am running a pair of ACE in redundancy mode for HA and have created multiple context.

here is my basic config for the serverfarm.

serverfarm host VPN_Farm

  transparent

  failaction purge

  predictor leastconns

  probe ICMP_Probe

  rserver SVR_A

    probe ICMP_Probe

    inservice

  rserver SVR_B

    probe ICMP_Probe

    inservice

So, on the active unit, I can see that the probes are running fine. However, if I do "show probe" on the standby unit, it appears that all my probes fail.

Result of  "show probe" captured from Standby Unit.

probe       : ICMP_Probe

type        : ICMP

state       : ACTIVE

----------------------------------------------

   port      : 0       address     : 0.0.0.0         addr type  : -          

   interval  : 15      pass intvl  : 60              pass count : 3   

   fail count: 3       recv timeout: 10  

                ------------------ probe results ------------------

   associations ip-address      port  porttype probes   failed   passed   health

   ------------ ---------------+-----+--------+--------+--------+--------+------

   rserver        : SVR_A

                      1.1.1.1   0     --                       109      109      0        FAILED

is it normal to see failed probe on the standby unit?

Thank you

Best Regards

[Alex Rickard]

It is not normal to see failed probes on the standby. For whatever reason the rserver is not responding to the standby probes in a successful manner or the standby is not receiving the response. Each ACE will send their own probes. You also do not need to have the same probe applied to the serverfarm and to the rservers under that serverfarm.

[Dominic Wilkinson]

On the standby ACE, if this is an ACE service module, have you made sure that on the 6500 you have assigned the VLAN being used by the servers to ACE module in the 6500 config? I've seen people forget this before.

Sent from Cisco Technical Support Android App

[Jorge Bejarano · Accepted solution]

Hi Hyeon,

Some questions here.

• Is this an ACE module or an ACE 4710? What version?
• Are both ACEs peers connected to the same switch or how you got them setup? Can you describe a little bit your topology?
• From the standby, Did you try to ping/telnet the servers?
• Did you try to remove the probe and re-add it back? (get a #show tech-support before and after)
• Is there any firewall or L3 device between the ACEs and the servers?
• Do you use these servers for several contexts? Is the probe failing in all the contexts?

Jorge

[HyeonCheol Cho]

Hello All,

Sorry that I made you guys busy with this question.

Fortunately, I could track down the root cause of this problem with spending a coupel of hours.   I had to check all the physical ports, trunk ports, allowed vlans on trunk, and etc. After this, I checked all the configuration on the ACEs and could not find any wrong piece. so, I checked the servers and finally, I could find on the servers an access-list was configured with wrong IP addresses.

Thank you so much

[Jorge Bejarano]

It sounds great that everything is working now

Jorge