Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ACE multiple loadbalancing policies help

Hi

I've configured my ACE to loadbalance all hits on a 2 servers farm. It's working, fine.

Now I want to loadbalance hits with a specific url on another farm, and it's not working (hits with the specific url are not logged in the new policy)

Here is what I've added :

1. A class-map to get my url :

class-map type http loadbalance match-all CLASSMAP_L7

match http header Host header-value my.domain.com

2. A policy-map :

policy-map type loadbalance first-match POLICYMAP_L7

  class CLASSMAP_L7

    serverfarm FARM_2

3. A policy-map to get the L7 policy map :

policy-map multi-match POLICYMAP_L3L4

  class L4-WEB-IP

    loadbalance vip inservice

    loadbalance policy POLICYMAP_L7

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

4. added the service policy on my interface

interface vlan 265

  service-policy input ALREADY_EXISTING_POLICIES

  service-policy input POLICYMAP_L3L4

I have to precise my class-map L4-WEB-IP is defined as

class-map match-all L4-WEB-IP

  2 match virtual-address 17x.xx.xxx.xxx tcp eq www

So basically, when I'm trying a show service-policy POLICYMAP_L3L4 summary, I've got 0 hits.

So the other service policy (implementing the same class L4-WEB-IP, of course) is taking all the traffic.

Any thoughts ? Thanks for the help.

  • Application Networking
9 REPLIES
New Member

ACE multiple loadbalancing policies help

precision : if I add the same class-map as L4-WEB-IP named CLASSMAP-L3L4 to integrate that classmap instead in the policy-map, it doesn't change anything...

Bronze

Re: ACE multiple loadbalancing policies help

Hi Laurent

I'm thinking this is just a matter of how your policies and classes are applied on that SVI. Would be possible for you to attach a sanitized copy of your configuration so we can try to figure what's wrong?

Tnx

-- --

Pablo

Sent from Cisco Technical Support iPhone App

New Member

Re: ACE multiple loadbalancing policies help

Thanks Pablo !

This is my full configuration below

access-list ANY line 24 extended permit icmp any any

access-list ANY line 32 extended permit ip any any

probe tcp PROBE_TCP

  interval 30

  passdetect interval 60

rserver host 55LABS

  ip address 172.16.0.1

  inservice

rserver host MICHELINE

  ip address 172.16.0.2

  inservice

serverfarm host FARM_55LABS

  predictor leastconns

  probe PROBE_TCP

  rserver 55LABS

    inservice

  rserver MICHELINE

    inservice

serverfarm host FARM_PHP

  predictor leastconns

  probe PROBE_TCP

  rserver MICHELINE

    inservice

parameter-map type http HTTP_PARAMETER_MAP

  persistence-rebalance

class-map match-all CLASSMAP_L3L4

  2 match virtual-address 178.xxx.xxx.xxx tcp eq www

class-map type http loadbalance match-all CLASSMAP_L7

  2 match http header Host header-value "subdomain.domain.com"

class-map match-all L4-HTTPS-IP

  2 match virtual-address xxx.xxx.xxx.161 tcp eq https

class-map match-all L4-WEB-IP

  2 match virtual-address xxx.xxx.xxx.161 tcp eq www

class-map type management match-all REMOTE_ACCESS

  2 match protocol ssh any

policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY

  class REMOTE_ACCESS

    permit

policy-map type loadbalance http first-match HTTPS_POLICY

  class class-default

    serverfarm FARM_55LABS

    insert-http x-forward header-value "%is"

policy-map type loadbalance first-match POLICYMAP_L7

  class CLASSMAP_L7

    serverfarm FARM_PHP

policy-map type loadbalance http first-match WEB_L7_POLICY

  class class-default

    serverfarm FARM_55LABS

    insert-http x-forward header-value "%is"

policy-map multi-match POLICYMAP_L3L4

  class CLASSMAP_L3L4

    loadbalance policy POLICYMAP_L7

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

policy-map multi-match WEB-to-vIPs

  class L4-WEB-IP

    loadbalance vip inservice

    loadbalance policy WEB_L7_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

  class L4-HTTPS-IP

    loadbalance vip inservice

    loadbalance policy HTTPS_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

interface vlan 265

  ip address xxx.xxx.xxx.170 255.255.255.240

  peer ip address xxx.xxx.xxx.171 255.255.255.240

  access-group input ANY

  service-policy input REMOTE_MGMT_ALLOW_POLICY

  service-policy input WEB-to-vIPs

  service-policy input POLICYMAP_L3L4

  no shutdown

interface vlan 2369

  ip address 172.31.255.250 255.240.0.0

  alias 172.31.255.249 255.240.0.0

  peer ip address 172.31.255.251 255.240.0.0

  access-group input ANY

  nat-pool 1 172.31.255.248 172.31.255.248 netmask 255.240.0.0 pat

  no shutdown

ft track interface  VLAN265

  track-interface vlan 265

  peer track-interface vlan 265

  priority 50

  peer priority 5

Bronze

Re: ACE multiple loadbalancing policies help

Hi Laurent,

Thanks for the info. From the configuration I noticed a couple of things missing,

1. The new class under the multi-match policy has not been yet activated with the command "loadbalance vip inservice", even if the policy is already applied under the interface the ACE is not ARP'ing for that new VIP.

2. I see that you're using the same rserver/SF for this new VIP so I'm assuming NAT is also required for this new implementation.

Not sure if you're doing all the config through the GUI, if using CLI you can copy and past the commands below and let us know if you get positive results.

policy-map multi-match POLICYMAP_L3L4

  class CLASSMAP_L3L4

    loadbalance vip inservice

     loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

HTH

__ __

Pablo

New Member

Re: ACE multiple loadbalancing policies help

Hi Pablo

Thanks for the answer.

You're right, I'd deleted it since I was testing. I have put it back now, and... same result.

(loading subdomain.domain.com)

show service-policy POLICYMAP_L3L4 summary => Hit Count doesn't change

show service-policy WEB-to-vIPs summary          => Hit Count increase

To be ok, here is the full configuration again, with the corrections.

probe tcp PROBE_TCP

  interval 30

  passdetect interval 60

rserver host 55LABS

  ip address 172.16.0.1

  inservice

rserver host MICHELINE

  ip address 172.16.0.2

  inservice

serverfarm host FARM_55LABS

  predictor leastconns

  probe PROBE_TCP

  rserver 55LABS

    inservice

  rserver MICHELINE

    inservice

serverfarm host FARM_PHP

  predictor leastconns

  probe PROBE_TCP

  rserver MICHELINE

    inservice

parameter-map type http HTTP_PARAMETER_MAP

  persistence-rebalance

class-map match-all CLASSMAP_L3L4

  2 match virtual-address xxx.xxx.xxx.161 tcp eq www

class-map type http loadbalance match-all CLASSMAP_L7

  2 match http header Host header-value "subdomain.domain.com"

class-map match-all L4-HTTPS-IP

  2 match virtual-address xxx.xxx.xxx.161 tcp eq https

class-map match-all L4-WEB-IP

  2 match virtual-address xxx.xxx.xxx.161 tcp eq www

class-map type management match-all REMOTE_ACCESS

  2 match protocol ssh any

class-map type management match-all TEST

  2 match protocol icmp any

policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY

  class REMOTE_ACCESS

    permit

policy-map type management first-match TEST_ALLOW

  class TEST

    permit

policy-map type loadbalance http first-match HTTPS_POLICY

  class class-default

    serverfarm FARM_55LABS

    insert-http x-forward header-value "%is"

policy-map type loadbalance first-match POLICYMAP_L7

  class CLASSMAP_L7

    serverfarm FARM_PHP

policy-map type loadbalance http first-match WEB_L7_POLICY

  class class-default

    serverfarm FARM_55LABS

    insert-http x-forward header-value "%is"

policy-map multi-match POLICYMAP_L3L4

  class CLASSMAP_L3L4

    loadbalance vip inservice

    loadbalance policy POLICYMAP_L7

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

policy-map multi-match WEB-to-vIPs

  class L4-WEB-IP

    loadbalance vip inservice

    loadbalance policy WEB_L7_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

  class L4-HTTPS-IP

    loadbalance vip inservice

    loadbalance policy HTTPS_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

interface vlan 265

  ip address xxx.xxx.xxx.170 255.255.255.240

  peer ip address xxx.xxx.xxx.171 255.255.255.240

  access-group input ANY

  service-policy input REMOTE_MGMT_ALLOW_POLICY

  service-policy input WEB-to-vIPs

  service-policy input POLICYMAP_L3L4

  class CLASSMAP_L3L4

    loadbalance vip inservice

    loadbalance policy POLICYMAP_L7

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

policy-map multi-match WEB-to-vIPs

  class L4-WEB-IP

    loadbalance vip inservice

    loadbalance policy WEB_L7_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

  class L4-HTTPS-IP

    loadbalance vip inservice

    loadbalance policy HTTPS_POLICY

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 2369

    appl-parameter http advanced-options HTTP_PARAMETER_MAP

interface vlan 265

  ip address xxx.xxx.xxx.170 255.255.255.240

  peer ip address xxx.xxx.xxx.171 255.255.255.240

  access-group input ANY

  service-policy input REMOTE_MGMT_ALLOW_POLICY

  service-policy input WEB-to-vIPs

  service-policy input POLICYMAP_L3L4

  no shutdown

interface vlan 2369

  ip address 172.31.255.250 255.240.0.0

  alias 172.31.255.249 255.240.0.0

  peer ip address 172.31.255.251 255.240.0.0

  access-group input ANY

  nat-pool 1 172.31.255.248 172.31.255.248 netmask 255.240.0.0 pat

  service-policy input TEST_ALLOW

  no shutdown

ft track interface  VLAN265

  track-interface vlan 265

  peer track-interface vlan 265

  priority 50

  peer priority 5

Thanks again.

Laurent

Bronze

Re: ACE multiple loadbalancing policies help

Hi Laurent,

Thanks for trying that out. Something that just called my attention is this:

class-map match-all CLASSMAP_L3L4

  2 match virtual-address xxx.xxx.xxx.161 tcp eq www

class-map match-all L4-WEB-IP

  2 match virtual-address xxx.xxx.xxx.161 tcp eq www

Are these two class-maps using the same VIP by any chance? All points out they are but want to make sure.

Tnx.

__ __

Pablo

New Member

Re: ACE multiple loadbalancing policies help

Hey Pablo,

Yes they are.

Unfortunately, I presume :/

Bronze

Re: ACE multiple loadbalancing policies help

Hey Laurent,

In this case I'd say fortunately, this will make things way easier =)

Long story short, you don't need the new policies to get this working, since both policies are using the same VIP the ACE will inspect both policies under the interface but it would match the first one that was applied, that's why you're not seeing any hits for the new L7 policy.

The easy way to get this working is under the "first-match" policy, you just need to put the most specific match on top of the policy so all the specific matches will be layer 5 inspected, if a request comes with the host header

subdomain.domain.com then it will be sent to farm PHP otherwise the hit  will be caught by the class-default and sent to the 55LABS farm.

The configuration should look like this:

policy-map type loadbalance http first-match WEB_L7_POLICY

  class CLASSMAP_L7

    serverfarm FARM_PHP

  class class-default

    serverfarm FARM_55LABS

    insert-http x-forward header-value "%is"

I'd recommend you to remove the new policy from the interface then apply these changes (test it works) and finally remove the unnecesary lines so you can keep the config as simple/clean as possible.

HTH

__ __

Pablo

New Member

ACE multiple loadbalancing policies help

Thanks Pablo, this helps a lot !

This is currently working as a charm, I was far to imagine this was as simple

Thanks again, and merry christmas !

Laurent

734
Views
0
Helpful
9
Replies