Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Error: sticky resource not available

Hi,

I get the following error when I try to add sticky config to a context.

Error: sticky resource not available

I have added the following to the admin context but no joy:

resource-class **********

  limit-resource all minimum 0.00 maximum unlimited

  limit-resource sticky minimum 10.00 maximum equal-to-min

One thing I noticed is it is only on the admin context of one ace module. It ain't on the admin module of the other ace context. Do I need to add it manly to both? Afraid of putting them out of sync.

Can anyone please advise?

3 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Error: sticky resource not available

Hi Netter,

You should what is the current resoruce allocation for your context and see what is changing. There should be no problem as long as you are increasing the resource.

Regards,

Kanwal

Cisco Employee

Error: sticky resource not available

Hi Netter,

You can use ,

show running-config resource-class

show resource-allocation

The above two commands shall show the details.

Regards,

Kanwal

Cisco Employee

Error: sticky resource not available

Hi,

So you can create resource class and assign to the context you are having issues with. You can look through the user guide for better understanding of how resource allocation works.

Regards,

Kanwal

56 REPLIES
Community Member

Error: sticky resource not available

I just added it on the other ACE admin context manually and still no joy.

resource-class **********

  limit-resource all minimum 0.00 maximum unlimited

  limit-resource sticky minimum 10.00 maximum equal-to-min

Can anyone tell me what I need to do to get stickiness working?

Cisco Employee

Error: sticky resource not available

Hi Netter,

You have defined the resource class and defined the limits but did you associate with the respective "Contexts"? Without association with any context it is just a resource class!

Please associate if you haven't already and let me know if you still face the same problem.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Hi Kanwal,

Thanks for your response. I am new to this and taking over from someone else. Can you tell me how you associate it with a particular context? Is it in the context itself? Whats the command?

Many thanks

Cisco Employee

Error: sticky resource not available

Hi Netter,

Here is the configuration that you need to do in "Admin" context. So i created a class (like you did above) named as "Test1". After that i go to context "Kan" and made it member of resource class Test1.

switch/Admin(config)# context Kan

switch/Admin(config-context)# member Test

Test   Test1

switch/Admin(config-context)# member Test1

switch/Admin(config-context)# exit

Let me know how it works and if this resolves your problem.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

I will give this a go. There are other services live already in this context. Will this cause any issues? Presume I just do it in active context?

Thanks.

Cisco Employee

Error: sticky resource not available

Hi Netter,

You should what is the current resoruce allocation for your context and see what is changing. There should be no problem as long as you are increasing the resource.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

Another stupid question but how do I check current resource allocation? There was nothing in admin or its context until I greated class above. So presume its default resources?

Thanks.

Cisco Employee

Error: sticky resource not available

Hi Netter,

You can use ,

show running-config resource-class

show resource-allocation

The above two commands shall show the details.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

I did this in the admin context and it has no resources assigned to it.

Cisco Employee

Error: sticky resource not available

Hi,

So you can create resource class and assign to the context you are having issues with. You can look through the user guide for better understanding of how resource allocation works.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks, yes will do this and let you know how it goes tomorrow.

Community Member

Error: sticky resource not available

Thanks Kanwal, this did the trick and I can apply stickness now. Unfortunately it didn't fix my main problem. Load balancing 2 web servers with redirest on port 80 to 443. But I get the following error:

This webpage has a redirect loop

Can open a separate discussion on this if you like. Config is fairly basic. Not sure what is wrong. If its me or the server guys. Any thoughts?

Cisco Employee

Error: sticky resource not available

Hi Netter,

Send me the configuration and i will have a look. 80 t0 443 should be a simple redirection. Who is doing the redirection here, ace or webserver?

Regards,

Kanwal

Community Member

Error: sticky resource not available

Hi Kanwal,

Should be ace but think server guys have a redirect as well. Will get them to turn off. Just heading to a meeting now. Will try and get a config onto you in the next hr. Thanks again.

Cisco Employee

Error: sticky resource not available

Hi Netter,

My pleasure in assisting you. Get me the configuration and we will see what is going on here.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal. Here is the current config. I think I am on right track.

crypto chaingroup ****-CHAINGRP
  cert chain-ROOT

    cert ****CAcert

crypto csr-params CSR-PARAMS
  country
  state
  locality
  organization-name
  organization-unit
  common-name ****.co.uk
  serial-number 601
access-list BPDU ethertype permit bpdu


probe tcp ****-WEB-PROBE
  interval 3
  passdetect interval 5

parameter-map type ssl SSL-****-ADVANCED
  cipher RSA_WITH_RC4_128_MD5

rserver host ****TC1
  ip address *.*.*.*
  inservice
rserver host ****TC2
  ip address *.*.*.*
  inservice
rserver redirect HTTP-****
  webhost-redirection https://%h/%p 301
  inservice

ssl-proxy service SSL-****-PROXY
  key ****.pem
  cert ****CAcert
  chaingroup ****-CHAINGRP
  ssl advanced-options SSL-****-ADVANCED


serverfarm host ****-FARM
  predictor leastconns
  probe ****-WEB-PROBE
  rserver ****TC1 80
    inservice
  rserver ****TC2 80
    inservice
serverfarm redirect HTTP-****-FARM
  rserver HTTP-****
    inservice


sticky ip-netmask 255.255.255.255 address source STICKY-SSL-****-FARM
  timeout 720
  timeout activeconns
  replicate sticky
  serverfarm ****-FARM

class-map match-any ****-HTTPS-VIP
  2 match virtual-address *.*.*.* tcp eq https
class-map match-any REDIRECT-HTTP-****
  2 match virtual-address *.*.*.* tcp eq www

policy-map type loadbalance first-match ****-HTTPS-POLICY
  class class-default
    sticky-serverfarm STICKY-SSL-****-FARM
policy-map type loadbalance first-match ****-POLICY-REDIRECT
  class class-default
    serverfarm HTTP-****-FARM

policy-map multi-match ****-POLICY
  class ****-HTTPS-VIP
    loadbalance vip inservice
    loadbalance policy ****-HTTPS-POLICY
    loadbalance vip icmp-reply active
    ssl-proxy server SSL-****-PROXY
policy-map multi-match ****REDIRECTPOLICY
  class REDIRECT-HTTP-****
    loadbalance vip inservice
    loadbalance policy ****-POLICY-REDIRECT
    loadbalance vip icmp-reply active
    loadbalance vip advertise

service-policy input ****REDIRECTPOLICY
service-policy input ****-POLICY

Cisco Employee

Error: sticky resource not available

Hi Netter,

The configuration looks absolutely fine to me.

So this configuratio didn't work? You said there was redirection loop which  i assume could happen because client didn't come with https url to which it was redirected otherwise it would have matched a different class and loadbalanced to different serverfarm.

Can you capture on client itself and see what URL client goes with after it has been redirected? That should tell us why the redirection is happening again and again.

You can also install iehttp for IE or Live utility in Mozilla to see the HTTP based communication between client and server(ACE).

And you don't need to define two policy mutli-match. You can simply call both class maps under the same policy mutli match. If it doesn't match the first class, it will look into second and so on. Once a match is done it stops.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Hi Kanwal,

Just got word from the server guys  server runs on 8443. Do I just change

serverfarm host ****-FARM

  predictor leastconns

  probe ****-WEB-PROBE

  rserver ****TC1 80

    inservice

  rserver ****TC2 80

to

serverfarm host ****-FARM

  predictor leastconns

  probe ****-WEB-PROBE

  rserver ****TC1 8443

    inservice

  rserver ****TC2 8443

Cisco Employee

Error: sticky resource not available

Hi Netter,

If the server is listening on 8443 then backend connection would be SSL too which means you need to do end to end ssl loadbalancing or you can simply loadbalance based on TCP port and if you do so you need to remove SSL proxy configuration.

For end to end ssl you have to configure ACE both as ssl server and client and configuration will need a slight change. Please go through the below link for same.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/endtoend.html

Let me know if have any questions.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

To be honest I am knew to all this so haven't a clue which is best way to proceed. What way would you think is best? Would it be hard to change my current config to do end to end loadbalancing? Not sure where to start.

Cisco Employee

Re: Error: sticky resource not available

    Hi Netter,

    To configure end-to-end SSL you need to make couple of changes and they are not big. Please go through the link and it will give you an idea of what you are missing.

Regarding what you should is absolutely your decision. Normally SSL offloading is done on ACE to relieve servers of cpu intensive SSL handshake which may impact their performance and also take decisions on the basis of data which ACE otherwise cannot see if it is not doing SSL ofloading.

In end to end ssl even backend connection is encrypted which means that you don't care about performance impact but you may still need ACE to look into data for LB decisions. If you don't need that you can simply tell ACE to LB on the basis of TCP port and connection would be encrypted from client to server and ACE would just do LB.

Honestly, it is your decision based on your requirement. If you don't want ACE to do anything by looking into decrypted packet then i would suggest go for TCP port based load balancing.but still your decision.

You can also go through the link for more details regarding end to end ssl which explains in detail about it.

If you have any questions please let me know.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

The service has to run on 8443 if they disable redirects so guess I have to do end-to-end SSL. I will give it a go and let you know how I get on.

I don't think I can do it on tcp port as client may connect on 80 or 443 from a web browser.

Cisco Employee

Re: Error: sticky resource not available

Hi Netter,

You are welcome. It is your choice as i said. But you can use redirection for port 80 and normal LB for 443 or end to end ssl. For end to end ssl you just need to make a minor change which you can see in the link i pasted. You have to add ssl-proxy client statement under policy-map type first match.

Let me know if you have any questions.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Thanks Kanwal,

Doing that now. I am worried do I need to do this part.

interface vlan 210

ip address 10.10.2.1 255.255.255.0

  service-policy input L7_1

  access-group input ACL

  no shutdown

Do I need to add

service-policy input L7_1? There are servers already live in this context and I am afraid this will break them.


Cisco Employee

Re: Error: sticky resource not available

Hi Netter,

I am not sure what this policy is. If the connections  already working don't match what this service policy (class map conditions) has then there should be no problems.

You can do this without breaking any existing connections. If you are not sure you can try this in off time.

Regards,

Kanwal

Community Member

Error: sticky resource not available

Sorry thats just from the config in link you sent me. I will send what I have done now. I think I am totally lost to be honest.

Community Member

Error: sticky resource not available

Hi Kanwal,

Here is my current config. Is it totally wrong? Policy map L7_1 appears as offline.

crypto chaingroup ****-CHAINGRP

cert chain-ROOT

  cert ****CAcert

access-list BPDU ethertype permit bpdu

access-list ALL line 8 extended permit ip any any

access-list ALL line 16 extended permit icmp any any

probe tcp ****-WEB-PROBE

port 8443

interval 3

passdetect interval 5

parameter-map type ssl PM1

session-cache timeout 300

queue-delay timeout 1

parameter-map type ssl SSL-****-ADVANCED

cipher RSA_WITH_RC4_128_MD5

rserver host ****TC1

ip address *.*.*.*

inservice

rserver host ****TC2

ip address *.*.*.78

inservice

rserver redirect HTTP-****

webhost-redirection https://%h/%p 301

inservice

ssl-proxy service SSL-****-PROXY

key ****.pem

cert ****CAcert

chaingroup ****-CHAINGRP

ssl advanced-options SSL-****-ADVANCED

ssl-proxy service SSL_CLIENT

ssl advanced-options PM1

ssl-proxy service SSL_SERVER

key ****.pem

cert ****CAcert

ssl advanced-options PM1

serverfarm host ****-FARM

predictor leastconns

probe ****-WEB-PROBE

rserver ****TC1 8443

inservice

rserver ****TC2 8443

inservice

serverfarm redirect HTTP-****-FARM

rserver HTTP-****

inservice

sticky ip-netmask 255.255.255.255 address source STICKY-SSL-****-FARM

timeout 720

timeout activeconns

replicate sticky

serverfarm ****-FARM

class-map match-any ****-HTTPS-VIP

2 match virtual-address *.*.*.* tcp eq https

class-map match-any REDIRECT-HTTP-****

2 match virtual-address *.*.*.* tcp eq www

class-map type http loadbalance match-any SSL

2 match http url .*

class-map match-any SSL_C1

2 match virtual-address *.*.*.* tcp eq https

3 match virtual-address *.*.*.* tcp any

policy-map type loadbalance first-match ****-HTTPS-POLICY

class class-default

sticky-serverfarm STICKY-SSL-****-FARM

policy-map type loadbalance first-match ****-POLICY-REDIRECT

class class-default

serverfarm HTTP-****-FARM

policy-map type loadbalance first-match SSL_BACK

class SSL

serverfarm ****-FARM

ssl-proxy client SSL_CLIENT

policy-map multi-match ****-POLICY

class ****-HTTPS-VIP

loadbalance vip inservice

loadbalance policy ****-HTTPS-POLICY

loadbalance vip icmp-reply active

ssl-proxy server SSL-****-PROXY

policy-map multi-match ****REDIRECTPOLICY

class REDIRECT-HTTP-****

loadbalance vip inservice

loadbalance policy ****-POLICY-REDIRECT

loadbalance vip icmp-reply active

loadbalance vip advertise

policy-map multi-match L7_1

class SSL_C1

loadbalance vip inservice

loadbalance policy SSL_BACK

loadbalance vip icmp-reply

ssl-proxy server SSL_SERVER

service-policy input ****REDIRECTPOLICY

service-policy input ****-POLICY

interface vlan 303

bridge-group 303

no normalization

mac-sticky enable

access-group input BPDU

access-group input ALL

no shutdown

interface vlan 603

bridge-group 303

no normalization

mac-sticky enable

access-group input BPDU

access-group input ALL

no shutdown

interface bvi 303

ip address *.*.*.* 255.255.254.0

peer ip address *.*.*.* 255.255.254.0

no shutdown

ip route 0.0.0.0 0.0.0.0 *.*.*.1

Cisco Employee

Re: Error: sticky resource not available

Hi Netter,

As per your requirement which i have understood after our discussion, you don't need to do any major. Please see the bold lines that you need to add and you should have end to end ssl configuration.

crypto chaingroup ****-CHAINGRP
cert chain-ROOT

cert ****CAcert

crypto csr-params CSR-PARAMS
country
state
locality
organization-name
organization-unit
common-name ****.co.uk
serial-number 601
access-list BPDU ethertype permit bpdu


probe tcp ****-WEB-PROBE
interval 3
passdetect interval 5

parameter-map type ssl SSL-****-ADVANCED
cipher RSA_WITH_RC4_128_MD5

rserver host ****TC1
ip address *.*.*.*
inservice
rserver host ****TC2
ip address *.*.*.*
inservice
rserver redirect HTTP-****
webhost-redirection https://%h/%p 301
inservice

ssl-proxy service SSL-****-PROXY
key ****.pem
cert ****CAcert
chaingroup ****-CHAINGRP
ssl advanced-options SSL-****-ADVANCED

ssl-proxy service SSL_CLIENT

ssl advanced-options SSL-****-ADVANCED


serverfarm host ****-FARM
predictor leastconns
probe ****-WEB-PROBE
rserver ****TC1 8443
inservice
rserver ****TC2 8443
inservice
serverfarm redirect HTTP-****-FARM
rserver HTTP-****
inservice


sticky ip-netmask 255.255.255.255 address source STICKY-SSL-****-FARM
timeout 720
timeout activeconns
replicate sticky
serverfarm ****-FARM

class-map match-any ****-HTTPS-VIP
2 match virtual-address *.*.*.* tcp eq https
class-map match-any REDIRECT-HTTP-****
2 match virtual-address *.*.*.* tcp eq www

policy-map type loadbalance first-match ****-HTTPS-POLICY
class class-default
sticky-serverfarm STICKY-SSL-****-FARM

ssl-proxy client SSL_CLIENT


policy-map type loadbalance first-match ****-POLICY-REDIRECT
class class-default
serverfarm HTTP-****-FARM

policy-map multi-match ****-POLICY


class ****-HTTPS-VIP
loadbalance vip inservice
loadbalance policy ****-HTTPS-POLICY
loadbalance vip icmp-reply active
ssl-proxy server SSL-****-PROXY


class REDIRECT-HTTP-****
loadbalance vip inservice
loadbalance policy ****-POLICY-REDIRECT
loadbalance vip icmp-reply active
loadbalance vip advertise


service-policy input ****-POLICY

Let me know how it goes.

Regards,

Kanwal

Community Member

Re: Error: sticky resource not available

Thanks a million for all your help. I'll give this a go tomorrow and let you know how it goes.

735
Views
0
Helpful
56
Replies
CreatePlease to create content