content switch virtual address routing question

[admin_2]

I am in the market to purchase CSS11501S-k9 as my new load balencing solution.

I need to know if an application that is accessed through a virtual address being load balenced through a CSS11501S-k9, needs to call upon another application that is also using a virtual address to be accessed, and is also being balenced throught the same CSS11501S-k9 is supported, or just plain old works.

I know this did not work in older models of the cisco Content switch, but I believe this is resolved with http 1.1, but I am not 100%

Any assisance would be grateful. Thanks.

[stevehall]

when a server needs to access a virtual address, and be load balanced to other servers on the same vlan, then we do need to do some special configuration. This is what we call a one-armed configuration since the client (web servers) and servers (backend apps/DBs) are on the same interface of the load balancer.

You are correct that some older load balancers did not support this (Specifically, the Local Director). The CSS always has (at least as long as I have been using them, for about 3 1/2 years), but still needs some special configs.

We need to do what we call "client nat". To ensure that the response from the App servers goes through the CSS on the way to the Web Server, we nat the web server's address to a CSS address. This is described in the following url:

http://www.cisco.com/en/US/customer/products/hw/contnetw/ps789/products_configuration_example09186a0080093dff.shtml

This configuration is identical for first generation and second generation (like the 11501) CSSs.

hope that helps

-Steve

[#3]

Thanks for the great reply!! Beside the one armed config, would the following two ideas work?

1) If all the servers that need to communicate with each other through VIP, are in a direct attach configuration through the CSS, would that possibly work? If all servers were in a direct attach config, all traffic would flow through the CSS.

2) Would setting up Sourcegroupe work for the instaces of a VIP needing to communicate with a VIP?

[stevehall]

well, the first point of having all servers directly connected to the CSS, presumably with no other L2 device between them, would also work. The only issue is that it will not scale very well as you are limited by the number of ports you have.

Also, redundancy will be a problem. If a CSS goes down, the redundant CSS will not be able to access those servers.

The second point regarding VIPS communicating with other VIPS does not seem very relevant. In reality, there is also a client access a VIP. We may sometimes nat the source IP to a VIP address (which is fine) but a VIP is not a client to another VIP.

if this does not make sense, let me know... Sorry if it looks like I am avoiding the second question, but need clarification on it to answer it effectively.

-Steve

[#5]

After I re-read the second question I realized it did not come out the way I wanted it to.

On your first note about the direct connect config, as long as there is no L2 device between the CSS and the servers, then I should be ok, except redundantcy? For redundantcy I was going to have (2) CSS 11501 in an Active-Passive configuration where each sever has a primary and secondary connection to both CSS.

For the second question I basically wanted to know if by setting up sourcegroupes would also resolve the issue?