Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ACE Implementation Bridging Question


My customer is looking to undertake ACE Module implementation in favour of legacy installed products.

One of the requirements of the current environment is that some applications have VIPs and servers in the same IP Subnet and same Layer 2 vlan.

I assumed using Bridge Mode (BVI) would be the way to go - but now I am not so sure. The examples of bridge group config I have seen reference the VIP in a separate Layer 2 Vlan to the Servers.

My requirement is to have all in the same Layer 2 Vlan. Is this possible ?

Cisco Employee

Re: ACE Implementation Bridging Question

you can have the virtual ip address in the same subnet as the servers.

You do not need bridge mode for that.

However, if you are in bridge mode and can isolate the servers on one side and the clients on the other side, you guarantee that all traffic goes through ace.

In routing mode, in order to guarantee that the server response does not bypass ACE, you need to enable client nat or policy routing or make ACE the default gateway for the servers.


New Member

Re: ACE Implementation Bridging Question

Thanks for that ... new to this product.

Don't suppose there is a link to documentation for the above ?

Also we have a situation where clients, VIPs and Servers are currently all in the same IP subnet and Layer 2 vlan. Are we saying this is possible by configuring Bridge Mode also ?

Once again, many thanks for the response.

Re: ACE Implementation Bridging Question

yes it is possible.

You need two Vlans. clients & Vip will be on one Vlan and the servers on the other Vlan then you will bridge them using ACE.

For e.g

Lets say currently you have VLANX with all users & Servers.

You can create a new Vlan "VLAN Y" , assign all servers to VLAN Y, assign VLAN X & VLAN Y to ACE and bridge VLANY (new vlan) & VLANX (Old VLAN) using ACE.

Now your VIPs & clients will belong the old vlanX (same Ip subnet) & Servers will be on a new VlanY (again same Ip subnet.

If you donot want to use two Vlans

then you will have to use ACE in one arm mode. Simply extend the current vlan to the ACE module and configure SRC NAT/PBR.

Reason behind using SrcNat/PBR is to make sure that return traffic from the servers should not bypass ACE module

(which is not possible in case of bridge mode).



New Member

Re: ACE Implementation Bridging Question

Hi thanks for that,

so if we want to use bridging mode we need to separate the clients and servers on separate vlans. My follow up is if there are existing traffic flows between the client and servers that we do not want load balanced, just regular flows, does the ACE also perform that bridging function ?

ie. All Layer 2 vlan connectivity works post move with the benefit of having LoadBalancing

Re: ACE Implementation Bridging Question

Yes it will work as before.You just need to make sure that you should have ACLs applied to each vlan permitting all such (non-loadbalance)traffic.

Also things to remember in configuring Bridge mode are

1. Enable BPDU forwarding on ACE (to merge STP domains).

2. BPDU guard & Loopguard must be turned off.

Hope this helps

Syed Iftekhar Ahmed