Hello,   You can reuse the same probes and policy map multi-match for the configuration additions.   Here is what I would do at this point: 1.) Create a new sticky group: sticky ip-netmask 255.255.255.255 address source A_HUB-CAS-STICKY timeout activeconns replicate sticky serverfarm A-Hub-Cas-Sfarm 2.) Add a policymap type loadbalance: policy-map type loadbalance first-match A_HUB-CAS_POLICY_MAP_80 class class-default sticky-serverfarm A_HUB-CAS-STICKY 3.) Add the rest of the configuration to the existing policymap multi match: policy-map multi-match HUB-CAS_SLB_80 class T_Hub-Cas_VIP loadbalance vip inservice loadbalance policy A_HUB-CAS_POLICY_MAP_80 loadbalance vip icmp-reply nat dynamic 1 vlan That sould do it. Regards, Chris Higgins ... View more

You have 2 things to fix -> 1.) Once the traffic is decrypted, it goes to the server.  The TCP port number it uses should be whatever your server is listening for on http.  I would assume port 80.  However, in your serverfarm that links to the SSL configuration, you have no port number. That means ACE looks at the class map for the port number to utilize, which is port 443.  It isnt common for a server to listen for HTTP traffic on port 443.  Modify the serverfarm like this : serverfarm host AVDirecto   description AV Directo Server Farm   probe icmp-probe   rserver avdirecto01 80 <- Add the port here.     conn-limit max 4000000 min 4000000     probe icmp-probe     inservice   rserver avdirecto02 80 <- Add the port here.     conn-limit max 4000000 min 4000000     probe icmp-probe     inservice parameter-map type ssl AVWildcard_PM   cipher RSA_WITH_AES_128_CBC_SHA ssl-proxy service AVWildcard_PS   key AV_Wildcard_Key.p12   cert AV_Wildcard_Key.p12   ssl advanced-options AVWildcard_PM serverfarm host AVDirecto   description AV Directo Server Farm   probe icmp-probe   rserver avdirecto01 80 <- Add the port here.     conn-limit max 4000000 min 4000000     probe icmp-probe     inservice   rserver avdirecto02 80 <- Add the port here.     conn-limit max 4000000 min 4000000     probe icmp-probe     inservice Keep in mind, you need to remove the rserver, then add it back in with the port. The second issue is the cipher list.  You don't need a cipher list, and by specifying a single cipher, you are limiting the client to use only 1. Although most clients support 128 bit CBC SHA encryption, some don't, and it might be part of the failure. With no cipher list, ace defaults to using all ciphers possible. (uses the highest supported between the client and itself) ssl-proxy service AVWildcard_PS   key AV_Wildcard_Key.p12   cert AV_Wildcard_Key.p12   ssl advanced-options AVWildcard_PM <- remove this parameter-map type ssl AVWildcard_PM <- then remove this.   cipher RSA_WITH_AES_128_CBC_SHA That should be it! Chris ... View more