Troubleshooting Virtual Appliances is not that different than troubleshooting real ones. Here we need to see the packets "on the wire" to see what exactly is wrong with them. In a virtual environment with N1K this is even easier to do. You can clone a new VM and install wireshark on it. Then SPAN the port on N1K where vWAAS is connected to the N1K port where your new cloned VM with Wireshark will capture the packets. Then we can see the vPath encapsulated packets and see what is wrong with them. We have already seen these kind of issues with vWAAS and there a couple of bugs there with various combinations of settings, so we should first know the following: - N1k version - vWAAS version - ESX version - which NIC types are used (e1000, vmxnet3...) on vWAAS and invovled VMs Cheers, Ivan ... View more

There is one error in your config. You should add the bolded line: sticky ip-netmask 255.255.255.255 address source RADINLB-TFTP timeout 60 replicate sticky serverfarm RADINLB-TFTP ... View more

Hello, I am not sure I understand your questions. The TFTP VIP on the front end id defined with IP address and with UDP port 69, like any ohther VIPs. This works in a usual way as any other VIP. The problem with TFTP is when the server openes a new UDP connection. Thos connections need to be NATed to VIP address and this document shows how to do it. If the only application that needs to open UDP connection from inside is TFTP than you can leave as is. However, if there are some other UDP connections that need to initated from the server they will be NATed to VIP address. If this is a problem then you need to change the FROM-TFTP-REAL class-maps so it refern only to TFTP server IPs. I hope this clarifies the idea. Ivan ... View more

Could you please move this tread to AAA community, since this community is mostly about load-balancing and I doubt that you will get any answers here. You can find AAA community here: https://supportforums.cisco.com/community/netpro/security/aaa You should be able to move it by clicking on "Move thread" on the right side and then navigating to Communities -> Security -> AAA Thanks ... View more

ACE removes TCP options if the normalization is enabled on the interface (default setting). You can allow TCP options with a parameter-map: cdn-ace-1/ivan(config)# parameter-map type connection TEST cdn-ace-1/ivan(config-parammap-conn)# tcp-options ?   range          Configure TCP options range   selective-ack  Configure Selective Ack TCP option   timestamp      Configure Timestamp TCP option   window-scale   Configure Window scale TCP option ... View more

Hi Brian, You have posted to the wrong community. Could you please move your thread to "Wide Area Application Services (WAAS)" community? ... View more

Good catch, thanks! The error was occurred while I was changing policy names to something meaningful... It should be correct now. ... View more

There is no difference between match-all and match-any when there is only one match line under the class map, so you don't need to change it. By default VIP on ACE does not respond to echo requests. The "loadbalance vip icmp-reply" changes this and makes the VIP answer ping. This is not needed unless you want to be able to ping the VIP. You don't need to create two separate policies unless you want to implement some different L7 rules for HTTP and HTTPS service. All these things are explained in detail in the ACE config guide, so I recommend you to read at least the Server Load-Balancing Configuration Guide section before continuing with ACE configuration. ... View more

Yes, that is correct. When number of concurrent embryonic connections goes over 4096 the SYN COOKIE feature will handle the TCP handshakes. ... View more

It doesn't look like the SUN COOKIE was triggered, but on the other hand this output doesn't make much sense. Last two counters should be sum of the third counter "Number of TCP Syns Intercepted by SYN COOKIE". Your output might indicate incorrect behavior or a cosmetic counter inconsistency. Is this something that is on going all the time or it happened in the past and now it is not increasing? Have you noticed any problems with TCP session establishment? If the last counter is increasing all the time, can you reset all counters with "clear syn-cookie vlan 2045" and check if it continues to increase? ... View more

Yes, you need the second class-map and you also need to refer to it under "policy-map multi-match". If you haven't spotted it take a closer look at the config example I posted: policy-map multi-match L7   ...     class HTTP       loadbalance vip inservice       loadbalance policy L7_POL       loadbalance vip icmp-reply ... View more

cdn-ace-1/Admin# sh syn Interface vlan499         Configured TCP Embryonic Connection Limit: 0         Current number of Embryonic Connections: 0         Number of TCP Syns Intercepted by SYN COOKIE: 0         Number of TCP Acks Successfully Processed by SYN COOKIE: 0         Failed Number of TCP Acks Processed by SYN COOKIE: 0 Interface vlan500         Configured TCP Embryonic Connection Limit: 0         Current number of Embryonic Connections: 0         Number of TCP Syns Intercepted by SYN COOKIE: 0         Number of TCP Acks Successfully Processed by SYN COOKIE: 0         Failed Number of TCP Acks Processed by SYN COOKIE: 0 Interface vlan666         Configured TCP Embryonic Connection Limit: 0         Current number of Embryonic Connections: 0         Number of TCP Syns Intercepted by SYN COOKIE: 0         Number of TCP Acks Successfully Processed by SYN COOKIE: 0         Failed Number of TCP Acks Processed by SYN COOKIE: 0 ... View more

I am not sure I understand which second policy are you talking about. The config I provided will allow the same website to be reachable via HTTP and HTTPS. No other config is needed. However, if your website contains HTTP redirect responses, you should also configure SSL URL Rewrite ... View more