ACE 4710 Client and Server hitting same VIP

Answered Question
Dec 2nd, 2009
User Badges:

But the catch here is we are using IP's from server side VLAN's as opposed to from the Client side. If that were the case I would simply use SNAT and assign a pool but in this case that doesn't appear to work.


So how do I get this to work?


Mike

Correct Answer by Gilles Dufour about 7 years 4 months ago

you have to create a natpool on the vlan facing the servers.

Then create a policy, match the same vip, and simply add the nat dynamic function.

Assign this policy to the server vlan.

If the address in the natpool belong to the server subnet, nothing else is required.

Otherwise, you need to make sure the servers have a route to the addresses in the pool pointing to the ACE.


If that does not work, send your config.


Gilles.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Gilles Dufour Thu, 12/03/2009 - 02:00
User Badges:
  • Cisco Employee,

you need client nat for the connections opened by the servers.

Whatever the VIP, after loadbalancing the destination is the server.  So when the server sees a connection from another server, it does reply to the server directly, bypassing the ACE, and therefore the response comes directly from the server instead of the vip.


Gilles.

Correct Answer
Gilles Dufour Fri, 12/04/2009 - 01:27
User Badges:
  • Cisco Employee,

you have to create a natpool on the vlan facing the servers.

Then create a policy, match the same vip, and simply add the nat dynamic function.

Assign this policy to the server vlan.

If the address in the natpool belong to the server subnet, nothing else is required.

Otherwise, you need to make sure the servers have a route to the addresses in the pool pointing to the ACE.


If that does not work, send your config.


Gilles.

mbalasko Mon, 12/07/2009 - 08:54
User Badges:

It never occured to me that I would have to NAT an IP from a subnet to an IP in the same exact subnet. It

doesn't make any sense on the surface, but under the hood I get it now.


Thanks!



Mike

Actions

This Discussion