Thanks Gilles. All the docs show servers that are directly connected on the back end. What issues/design considerations do we need to consider when the real devices are not directly connected? The real server won't come back through the load balancer correct? Won't the TCP session be dropped from the client? If you know of a link to answer my questions, that would be great (so you don't have to answer).

Collin, Here is the link thank might help as well.

http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/ACE_FWSM.html#wp1000603

Depending on the logically design the return traffic can still go back through the ACE. If not as Gilles mentioned DSR (direct server return) configuration could be an option.

DSR is only an option if the servers are directly connected.

DSR requires the servers to use a loopback address and the serverfarm to be transparent, so that the servers can respond directly using the Virtual IP.

If your problem is that the servers are further hops away, you need to find a way to guarantee the traffic to come back to the loadbalancer.

This can be done with client nat on the loadbalancer.

The cons is that you lose the original client ip and the server log will only show connections from the nat ip address and not the client.

This can also be fixed with client ip header insert for http.

Another solution is to use policy-based routing. More complicated to set in place, but you do not lose the client ip address.

Gilles.

Can you please refer me to a doc explaining DSR in ACE?

Thanks..