Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ACE Appliance Integration with Existing DC Network

We have a working Data Center with two-tier security architecture. On perimeter we have Checkpoint Firewalls while ASA is an Inside firewall. DMZ server's gateway resides on Firewall and are connected to L2 Switch. Serverfarm's servers' Gateway resides on Cisco Nexus switches whose default GW is ASA firewall.

Now, we want to introduce single pair of Cisco ACE appliance in this network to loadbalane DMZ servers and few Serverfarm servers. We don't have the option to change default gateway of servers.

I'm just looking at best options to carry out this implemention. Please correct me if I'm wrong and provide me your valuable inputs.

1. One-armed is the best way to go here. Since, I cannot change default gateway of servers and there are applications which need not be load-balanced.

2. All four ports of ACE should be part of single Port channel. I am thinking of creating two contexts and assign two physical interfaces to each context. However, this seems not very scalable.

3. Can I use same VLAN ID in different zones? Is it necessary to use unique VLAN ID across the architecture? What all needs to be permitted across the Firewall?

4. Currently, server load balancing is happening through some server technology. How can I use same current virtual IP in ACE appliance as VIP for the serverfarm? It seems that I need to use different subnet for VIP.

5. Later on, we plan to introduce GSS as well for DC-DR failover. GSS will be deployed in separate zone since we don't have DDoS protection. In future, there will be communication between ACE and GSS as well.

Please provide your valuable inputs. Thanks in advance.

Everyone's tags (4)
Cisco Employee

ACE Appliance Integration with Existing DC Network

Hi Nayan,

If you cannot change default gateway of the servers then you will have to use NAT on ACE so that return traffic comes back to ACE.

You can have servers as well as the VIP in same subnet without any issues.