c6506 IOS SLB Across VRFs

Unanswered Question
May 27th, 2010

I'm trying to setup IOS SLB in directed mode on a Cat6506. We are currently using IOS SLB is dispatched mode for other services. Below is the relevent config. Please note there is no L3 interface on the 6506 for the Virtual Servers network (10.0.131.160). The gateway is an ASA which has L2 connectivity to the 6506. Also to note that the Server Farm network is within its own VRF.

ip slb serverfarm ADOBE-CONNECT

nat server

predictor leastconns

probe ADOBE

access Vlan130

!

real 10.0.130.161

  weight 1

  inservice

!

real 10.0.130.162

  weight 1

  no inservice

!

ip slb vserver ADOBE-TCP443
virtual 10.0.131.160 tcp https
serverfarm ADOBE-CONNECT
sticky 60
idle 600
inservice
!
ip slb vserver ADOBE-TCP80
virtual 10.0.131.160 tcp www
serverfarm ADOBE-CONNECT
sticky 60
idle 600
inservice
!
What happens is essentially nothing as you can see below 0 connections have occured, and 0 syns. "debug ip slb all" shows absolutely nothing in regards to this VServer.
ADOBE-TCP80, state = OPERATIONAL, v_index = 19, interface(s) = <any>
  virtual = 10.0.131.160/32:80, TCP, service = NONE, advertise = TRUE
  server farm = ADOBE-CONNECT, delay = 10, idle = 600
  sticky: client ip, timer = 60, subnet = 255.255.255.255
  sticky: group id = 4098 <assigned>
  synguard counter = 0, synguard period = 0
  conns = 0, total conns = 23, syns = 0,  syn drops = 0
  standby group = None
However on the 6506 when I do a SPAN on the trunk interface between the 6506 and the ASA I can see the packet TCP SYNs arriving at the 6506. Where ever they go from there..... I have no clue. This SPAN/packet capture also shows the ARP requests from the ASA for the virtual IP address, however there is never a response.
I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Calin Chiorean Tue, 06/01/2010 - 03:22

Hi!

In which VLANs are the interfaces up to ASA and down to real servers?

Next, if you take out "access vlan 130" and try, does it work?

Last, you are speaking about VRFs...but on C6500 you have only L2 configuration, as I understood. Where are the VRFs defined?

Sorry for so many questions, but I'm trying to help you!

Calin

ryansharpe Tue, 06/01/2010 - 12:51

Interface Gi1/21 is a trunk interface on the c6506 and faces the ASA. It trunks VLAN 131 which is the DMZ network. The vserver IP address 10.0.131.160 is within this DMZ network.

The "real" server is on a VMware box and utilizes port Gi2/19 this is also a trunk port which contains VLAN 130. The c6506 has a layer 3 interface for this VLAN, VLAN130. This interface is in the "app" VRF with an IP address of 10.0.130.252, eventually it will be running HSRP with a virtual address of 10.0.130.254.

I have tried taking out all of the access commands. Nothing changes from what I can see.

I hope I have answered your questions. Your help is greatly appreciated.

Thanks,

Ryan

Actions

This Discussion

Related Content