There is no throughput problem if the CSS is bypassed, ie, the server is connected directly to the same switch as the firewall, and has it's default route set to the gateway ip address of the firewall. I can pull the full 100Mbit/s FD in this configuration, but the CSS doesn't see the traffic, so no load-balancing.
The network layout has changed slightly since my first posting, but I'm still seeing a throughput issue for the devices connected/routing out via the CSS.
I have now also raised this with Cisco TAC.
------------------
Outside LAN -- LAN1/28
\
usage: firewall public vip and Internet
/
Inside LAN -- LAN2/27
\
usage: firewall inside vip
CSS LAN2 vip (redundant-interface)
CSS content vips (redundant-vip)
CSS01 LAN2 interface address
CSS02 LAN2 interface address
/
Server LAN -- LAN3/28
\
usage: CSS LAN2 vip
App Servers
DB Servers
Admin Servers
CSS01 LAN3 interface address
CSS02 LAN3 interface address
------------------------
The servers (services) are defined like this :
service web01
redundant-index 1
port 80
protocol tcp
keepalive type tcp
keepalive port 80
ip address LAN3.35
active
service web02
redundant-index 2
port 80
protocol tcp
keepalive type tcp
ip address LAN3.36
active
Load-balanced vips (content) are defined like this :
content website
protocol tcp
vip address LAN2.11
port 80
sticky-inact-timeout 60
flow-reset-reject
add service web01
add service web02
redundant-index 101
advanced-balance sticky-srcip
active
LAN1, LAN2, and LAN3 are all publicly accessible Internet addresses (subject to the firewall placed between LAN 1&2). NAT is not used.
Any thoughts about why a single connection (flow) is slowed down dramatically when talking to either the servers that are placed in LAN3, or the VIPs placed in LAN2.
GT
