hello team, i have the following configuration (see blow). it works well if i put only one DMVPN router behind the ACE. after i put a second for scalability into the group, some DMVPN do no longer work ( if the router is "inservice"), one or two VPN are load balanced. and most of them do no longer work. i believe it is a small problem. but i can not see it. so is there someone out here able to give me a hint ? this ACE configuration is L2 object-group service IPSec   esp   ah   gre   udp eq isakmp   udp eq 4500 object-group network DMVPN-HUB   host x.2.3.45   host x.2.3.46 access-list inside_in_vlan_994 line 8 extended permit eigrp any any  access-list inside_in_vlan_994 line 16 extended permit object-group IPSec any any  access-list inside_in_vlan_994 line 24 extended permit ip any any  access-list outside_in_vlan_992 line 8 extended permit eigrp any any  access-list outside_in_vlan_992 line 16 extended permit object-group IPSec any object-group DMVPN-HUB  probe icmp ICMP   interval 2   faildetect 2   passdetect interval 2 rserver host DMVPN_HUB_A   ip address 169.254.169.27   inservice rserver host DMVPN_HUB_B   ip address 169.254.169.28   inservice serverfarm host DMVPN_HUB   transparent   failaction purge   predictor leastconns   probe ICMP   rserver DMVPN_HUB_A     inservice   rserver DMVPN_HUB_B     inservice parameter-map type connection UDP_Settings   set timeout inactivity 86450 sticky ip-netmask 255.255.255.255 address source Sticky_1   serverfarm DMVPN_HUB class-map match-any VIP_3.45   2 match virtual-address x.2.3.45 47   3 match virtual-address x.2.3.45 50   4 match virtual-address x.2.3.45 udp eq 500   5 match virtual-address x.2.3.45 udp eq 4500   6 match virtual-address x.2.3.45 51 class-map match-any VIP_3.46   2 match virtual-address x.2.3.46 47   3 match virtual-address x.2.3.46 50   4 match virtual-address x.2.3.46 udp eq 500   5 match virtual-address x.2.3.46 udp eq 4500   6 match virtual-address x.2.3.46 51 policy-map type loadbalance first-match DMVPN-SLB   class class-default     sticky-serverfarm Sticky_1 policy-map multi-match vlan_992_in   class VIP_3.45     loadbalance vip inservice     loadbalance policy DMVPN-SLB     loadbalance vip icmp-reply     connection advanced-options UDP_Settings   class VIP_3.46     loadbalance vip inservice     loadbalance policy DMVPN-SLB     loadbalance vip icmp-reply     connection advanced-options UDP_Settings interface vlan 992   description ### outside ###   bridge-group 1   access-group input outside_in_vlan_992   service-policy input vlan_992_in   no shutdown interface vlan 994   description ### inside ###   bridge-group 1   access-group input inside_in_vlan_994   no shutdown interface bvi 1   ip address 169.254.169.21 255.255.255.224   alias 169.254.169.20 255.255.255.224   peer ip address 169.254.169.22 255.255.255.224   no shutdown ip route 0.0.0.0 0.0.0.0 169.254.169.1 ... View more

hello team, i am configuring for while with PfR now. i got some policies working, others not. but the all other solution is not working as expected. i use liveaction to see if there is some better traffic flow but => no.    what i tried to accomblish is WAN outbound and inbound optimization on first: ASN, second applikation, dependent on packet loss, jitter and delay....  so may  curent configuration looks like as follows:    we have dual routers ( ASR 1001) with each connected to two upstream carriers. we have BGP full table. pfr master  policy-rules PFR_Configure  keepalive 60  logging  !  border 169.254.169.12 key-chain xyz   interface Port-channel1.992 internal   interface GigabitEthernet0/0/2 external    maximum utilization receive percentage 65   interface GigabitEthernet0/0/3 external    maximum utilization receive percentage 65  !  border 169.254.169.11 key-chain xyz   interface GigabitEthernet0/0/3 external    maximum utilization receive percentage 65   interface GigabitEthernet0/0/2 external    maximum utilization receive percentage 65   interface Port-channel1.992 internal  !  learn   delay   inside bgp   traffic-class filter access-list PFR_Prefixes   expire after time 60  max prefix total 20000 learn 20000  max range receive percent 40  mos threshold 3.06  mode monitor fast  periodic 90  ! ! pfr border  logging  local Port-channel1.992  master 169.254.169.11 key-chain xyz ! pfr-map PFR_Configure 10  match pfr learn inside  set periodic 90  set mode select-exit good  set backoff 90 90  set delay threshold 80  set mode route control  set mode monitor fast  set resolve delay priority 1 variance 10     but i allways get logging  events telling me not "write" ( what it shall be). so does anyone outhere has a working sample config for this cenario ?    i want to use "inside bgp" or a prefix list both possible since we only have a few /22 to announce.    on the other hand outbound everything shall be loadbalanced based on destination. ... View more

hello team, i am dealing for a while now with the issue, that we want to replace a windows server maschine doing in IIS only a redirect of http://autodiscover.domain.tld to https://autodiscover.exchange.tld/autodiscover. since it is needed for each client, there is "some" administrative overhead we want to prevent for  each new client. so i configured the following in ACE (snipped)   action-list type modify http autodiscover-redirect   header rewrite response location header-value "https://autodiscover.exchange.tld/autodiscover" replace "http://autodiscover.*.*" action-list type modify http 80-to-443-rewrite   ssl url rewrite location ".*"  rserver redirect 01_redirect_80-to-443   webhost-redirection https://%h%p 301   inservice  rserver redirect 03_response_redirect_autodiscover   webhost-redirection http://%h%p 301 serverfarm redirect 01_redirect_80-to-443   rserver 01_redirect_80-to-443     inservice serverfarm redirect 03_response_redirect_autodiscover   rserver 03_response_redirect_autodiscover     inservice class-map type http loadbalance match-all 02A_autodiscover.*.*   2 match http header Host header-value "autodiscover.*.*"   4 match http url / policy-map type loadbalance first-match 21_Exchange-HTTPS-Policy   class 02A_autodiscover.*.*     action autodiscover-redirect   class class-default     sticky-serverfarm 21_Exchange-cookie-sticky_443     action 80-to-443-rewrite   but it always is redirecting me directly within the same session to https://autodiscover.exchange.tld/autodiscover instead telling the client to make a new request for https://autodiscover.exchange.tld/autodiscover.   thank you for suggestions. manuel ... View more