Andy, In general what you want to happen is when the port 80 session is on a server and the client goes over to 443, you want your server to push the client back to the same server on 443 through another private vip. So if you have 2 physical servers being load balanced, you would need 2 addional content rules configured as port 443 with a separate vip from the one you originally hit when you went to the server on 80 I'm not a webserver guy, but how ever you configure an HREF, you want to configure it to send the request to a vip which will inturn send it back to the server on 443 this time. ie: content public_vip vip address 123.123.123.220 protocol tcp port 80 add service WS-1 add service WS-2 active content WS-1 vip address 123.123.123.221 <-- new vip for HREF to server #1 protocol tcp port 443 add service WS-1 active content WS-2 vip address 123.123.123.222 <-- new vip for HREF to server #2 protocol tcp port 443 add service WS-2 active The HREF on WS-1 will point to vip 123.123.123.221 The HREF on WS-2 will point to vip 123.123.123.222 Hope this makes more sense Pete Knoops Cisco Systems ... View more

David, The code you are looking for actually takes a few extra steps because of its built in strong encryption. You need to click on "Download ACNS Software images (contains strong encryption)" once you are in this link: http://www.cisco.com/cgi-bin/tablebuild.pl/uce42 You need to fill out some information once you click on that link because of foreign laws on encryption. It's very straight forward. Good Luck Pete.. ... View more

Are you using a sticky method ? Can you post the rule associated with this ? thanks ... View more

David, I'm not one to recommend a blind upgrade, but in general the CE590 platform can run the latest 4.2 code that runs WCCP much better then 2.51 ever did. With that said, I would recommend getting a show tech off the router and CE to see if the router/ce are bypassing traffic for some particular reason. show bypass summary Regards Pete Knoops Cisco Systems ... View more

Clayton, You can probably do this, but the mgt port is non-routable, so as long as everything is on the local segment, it should work. Pete.. ... View more

Oddly enough, the down and alive state are part of different logging levels. In order to see the ALIVE in the log, you would need to increase the logging level to level-5. You probably have it at level-4 or lower at this point. You should see this: OCT 1 18:33:14 5/1 57 NETMAN-5: Enterprise:Service Transition:pete -> alive Netman Level-5 Regards Pete Knoops Cisco Systems ... View more

Hi, Using more then one link for your heartbeat or redundancy-protocol link is not supported and quite honestly will not work properly anyway simply due to some bridging holes that needed to be put into the code to avoid dropping VRRP frames with a CSS 11000 MAC address. Regards Pete Knoops Cisco Systems ... View more

Hi, The answer to your question is unfortunatly no. As far as a keepalive script goes, you cannot log to a file, however, you can change the logging of the CSS to reflect keepalive level logging which may help logging subsystem keepalive level debug-7 Regards Pete Knoops Cisco Systems ... View more

Tim, The suggested max is a combination of services and content rules not to exceed 300. This has been the development suggested ma for several years now. Pete.. ... View more

Couple of things here. 1. Is there a reason why you have specified 'port 443' in each of the services. This implies that you are natting the backend connection between the css and the webserver to port 443 even if the data coming in is something else, like port 80. Quite honestly if your users are coming in port 443, then specifiy this in the content rule and remove it from the service. 2. As for why your sorry server does not work. The sorry server shows port 443 in the service, but the keepalive is port 80. If port 80 is working on the webserver and port 443 is not in your senario, the service will remain active even though it is not working for 443. In other words, it makes no sense to use keepalive port 80 on a service when the way you have it configured only allows connections from the css to be on port 443 because you specified port 443 in the service. You generally want the keepalive to be the same port as the type of traffic you are sending the server so that the css really knows if the server is up. Hope this all makes sense Pete Knoops Cisco Systems ... View more

First make sure 'app' is running properly by doing a "show app session" Make sure it does not show in the "init" state. The message you show above appears to have something to do with the app session. Your 'master' css should have in it's config: app session 192.168.1.2 app Regards Pete.. ... View more

The best way to filter based on URL is to create layer 5 content rules that indicate the url that you want to hit the content rule. For example: You have a layer 3 rule for all content content test vip address 1.1.1.1 add service server1 active now you add a layer 5 rule for a particular url content test_l5 vip address 1.1.1.1 add service server2 <-- maybe you want the request to go to a different server port 80 protocol tcp url "/specific/content/pete.html" active So all requests except ones for specific/content/pete.html will go to server1, while this one will hit the l5 rule and go to server2. You can also use the "redirect" command in this L5 rule and send a redirect back to the client. Other then that, I'm not sure what other filtering you are talking about Regards Pete Knoops Cisco Systems ... View more

You can certainly do this with no problem, however, most keep the vip and servers on a different subnet for the simple reason of protecting the servers and keeping them on a private subnet versus the vip on a public subnet. I guess the exception to this rule would be utilizing the CSS to load balance an internal application with all the users being internal to your network where security is not as important. Regards Pete Knoops Cisco Systems ... View more