Wali,

this is possible but more complicated,

   Internet

            |

         MSFC

            |

        FWSM---- ACE

         |       |

  Subnet1  Subnet2

The flow client---> ACE ---> servers is not a problem with this design.

The concern is the response from the servers.

You need a way to force the FWSM to send the response to ACE and not directly to the client on the Internet.

And only for traffic that was loadbalanced.

You only have 2 options.

1/ Do client nat for all traffic going through ACE. Easy to do.  But you lose information about client source ip address on the servers.

For HTTP, you could keep this information by instructing ACE to insert this info in the http header.

2/ Put the MSFC right after FWSM as well and implement policy-routing on the MSFC . Based on src ip and tcp src port decide to send the traffic to ACE or not.

It is much better to create a subnet for LB servers and put this subnet behind the ACE module.

   Internet

            |

         MSFC

            |

        FWSM---- ACE ----- LB_Subnet

         |       |

  Subnet1  Subnet2

Gilles.