Good day,   We have a client who has a requirement where servers (should be viewed as clients) needs to access a VIP utilizing L7 class-map matching on a specific url as distinction from others going to same VIP on ACE, load balancing to local rservers in local server farm in country A. These load balanced rservers (should be viewed a clients in country A) then need to initiate requests to a VIP utilizing L7 class-map matching on a specific url (same as one in country A) as distinction from others going to same VIP on ACE load balancing to local rservers in local server farm in country B. How would this be achieved? Would we need to create a configuration which would allow us to apply a service policy on Server VLAN on ACE in country A, as this the source of the originating request to ACE VIP in country B? I imagine this may be required? How would  this configuration be implemented (as far as I know can't create a rserver to place in server farm and L3/4 class-map both containing same IP address). Would we leave the rserver and server farm components out and just create the L3/4 and L7 class-map's and on load balance policy-map just set to forward? Currently this is not working with the config's implemented on ACE's in country A and B. The SOAPUI request times out from the load balanced rservers in Country A. Any guidance/advice or input would be greatly appreciated.   Thanks in advance. Paul ... View more

Good day, I see that ANM 5.2.4 supports up to ACE version A5(3.1). We need to upgrade numerous ACE's at multiple customers to A5(3.1a) due to SHA2 support requirements. Question is, will a new version of ANM be released to support ACE A5(3.1a)? How will this be addressed? Thanks in advance. Paul.   ... View more

Good day, Regarding the articles from Entrust and Google (Chrome) on the “sun setting” of the SHA 1 hashing algorithm. I guess that other OEM browsers will soon follow suite. What is means for SARS is that Entrust do not issue SSL certificates with SHA1 anymore, the clients SSL certificates expires in June next year and we will have to implement the new certificates on all ACE devices. The biggest possible impact would be with eFiling season 2015 and the new SHA2 hashing algorithm that will be introduced in the updated ciphers as the new MAC. We will have to confirm that the ACE supports this new MAC and that the ACE will be able to handle the new MAC introduced. SHA 2 has six different hashing functions using longer keys (SHA224, SHA256, SHA384, SHA512, SHA512/224 & SHA512-256), stronger hash functions and additional computational rounds which will result in more processing on the ACE, this is what we need to test/cater for.   I see the longer keys (SHA224 to SHA 512) appear to be supported but the reference to the MAC still appears to be specific to SHA1 (this is main concern currently) but need confirmation on all points relating to SHA2. The versions running are A5.2.1 and A.4.1.0.   Thanking you in advance. Paul   ... View more

Good day, We have a customer who has an ANM deployment at a site. This is a HA deployment on RedHat. The customer created a perl script to run off an external host to generate reports. This was acheievd by querying the sqldatabase (dcm_ems). ANM version is 3.2. No problems. An additional ANM deployment was done on another site. ANM version 4.2. This deployment is the VA edition. They would like to deploy and run the same perl script. Is this possible on the VA Edition? Even with the RootPatch? Not sure of the level of access the patch provides, or if it is even recommened or would then still allow for the ANM to be supported? If possible, has the sqldatabase structure changed (suppose would need this for the guy's to ammend the script)? How would we obtain the "sqluser" and "sqlpwd" info for the perl script to use? Appreciate any guidance or feedback. Thank you in advance. Paul. ... View more

Good day, I am currently experiencing a problem while trying to import multiple 4710 ACE Appliances into ANM. ANM version is 5.2 and ACE 4710 Appliances version is 5.1.2. The error message is the same for all Appliances (currently 14, more to be deployed this year, another 12 this year). The management class, policy-map and servcie policy are all in place. The error message is below: Any assistance would be greatly appreiated. Thank you. Paul ... View more

Good day, I would just like to double-check a point with the forum on licensing on 4710 Appliance. If with version 4.2 and above 2Gbps Bandwidth licence is required, the output of the sho license status should be? We have this currently: ACE/Admin# sh license status                                                       Licensed Feature                            Count ------------------------------------        ----- Compression Performance in Mbps             2000      Web Optimization Concurrent Conns.          105       SSL transactions per second                 7500      Virtualized contexts                        20        Module bandwidth in Gbps                    1.0 I believe the bold line should not be 1.0, am I correct? Thank you in advance. Paul. ... View more

Good day, I was presented with a requirement from a customer as follows: 1. Site published to customer was http://www.abc.com 2. Actual site is http://abc.com 3. Requirment is for site to be accessed via https Originally https configuration implemeted with SSL offloading. No problem, all working fine (or so was thought as abc.com site was tested) as this was the site with the cert. issued to this and the "mishap" of the in-correct publication of the www.abc.com site was only picked up later. Now, first requirement is to redirect http to https. Implemted and tested, no worries. Second, access to www.abc.com presents cert. error. So, we now are requested to redirect www.abc.com to abc.com, then redirect all http to https. So, off I go and try implement this. The final config applied is below: rserver redirect REDIRECT-TO-HTTPS   webhost-redirection https://%h%p 301   inservice rserver redirect WWW-REDIRECT   webhost-redirection http://abc.com 301   inservice serverfarm redirect REDIRECT-Serverfarm   rserver REDIRECT-TO-HTTPS     inservice serverfarm redirect WWW-REDIRECT-Serverfarm   rserver WWW-REDIRECT     inservice class-map type http loadbalance match-any ABC-WWW-L7CLASS   2 match http header Host header-value "www.abc.com" class-map match-all VIP-PUBLIC   2 match virtual-address xxx.xxx.xxx.186 tcp eq https class-map match-all VIP-PUBLIC-HTTP-REDIRECT   2 match virtual-address xxx.xxx.xxx.186 tcp eq www policy-map type loadbalance first-match REDIRECT-POLICY   class ABC-WWW-L7CLASS     serverfarm WWW-REDIRECT-Serverfarm   class class-default     serverfarm REDIRECT-Serverfarm policy-map type loadbalance first-match WEB_LB   class class-default     sticky-serverfarm VIP-COOKIE-STICKY policy-map multi-match PUBLIC-VIP   class VIP-PUBLIC-HTTP-REDIRECT     loadbalance vip inservice     loadbalance policy REDIRECT-POLICY     loadbalance vip icmp-reply active     appl-parameter http advanced-options HTTP_PARAM_MAP   class VIP-PUBLIC     loadbalance vip inservice     loadbalance policy WEB_LB     loadbalance vip icmp-reply active     loadbalance vip advertise active     appl-parameter http advanced-options HTTP_PARAM_MAP     ssl-proxy server abc.com This is working. I just wanted to post this as while appying this, I recieved the following message while applying the second part within the policy map: " Error: An action already exists. Delete that first.". I then tryied again and it was accepted and it is working. So I suppose my questions are; 1. Is the message valid? 2. If so, how is this working? 3. Is this an eroneous message? 4. is this a bug, and will it "stop" working? Should I not be too comfortable? Just wanted to post this and find out if anyone may have had to do something similar,  if it worked for them and if they encountered something similar? Thanks in advance, as always. Paul. ... View more