Issues With ACE 4710 Config

[Wes Neary]

Hi all, We are currently in the process of setting up a routed Mode context on an ACE4710 Appliance and have come across some problems which im hoping that someone here maybe able to highlight where we are going wrong.

At the moment the setup is very simple we have a client Side VLAN-VLAN 2 10.1.2.0/24 and a backend VLAN-VLAN3 10.1.3.0/24 At present we have only created on rserver (Server1-10.1.3.11) when we encountered the problems below and so have stopped to try and diagnose the issue.

Please see attached a text file of the context Config.(Some details have been removed while others have been changed.)

The symptons we are experiencing are

1. If the servers default Gateway is set as 10.1.3.1 the server cant communicate with anything including the ACE, If the Servers DG is set to .

2 the server can communicate with the ACE and the ACE Probes are succsesful, however it cant communicate with anything on the Front end of the ACE. 2. The Ace can communicate with the server as long as the servers DG is sert as .2 in the 10.1.3. subnet.

3. The next L3 Device in the network can communicate with the front end vlan.  It can also communicate with the VIP address'  however it has no communication with anything in the Backend VLAN. Thanks in Advance for your help.

[ajayku2]

Hi,

Ideally you should allow the traffic from inside to outside. Also try to use server NAT as used in below thread.

https://supportforums.cisco.com/thread/132052

In case if you dont want to use ACE as default gateway then you can also use source NAT. That will help you to pass the traffic without issue.

Hope that helps.

regards,

Ajay Kumar

[Wes Neary]

Ajay,

forgive my ignorance, but i thought that traffice was allowed by applying the access policy to the server side SVI.  Also i thought the servers had to have there DG as the ACE Server Side VLAN IP.

Regards

Wes

[stephen.stack]

When you set the servers default Gateway is set as 10.1.3.1, can you run a continous ping to a host in the 10.1.2.x subnet. Run a 'show access-list INBOUND' and make sure the counter is incrementing. Then also do a 'sh conn' and ensure you see connections for this pair in the connection table. Also, enabel logging and ensure no errors in the logs.

logging enable

logging timestamp

logging buffered 6

Also, I assume you have routing configured correctly in the 10.1.2.x subnet to route back to 10.1.3.x via 10.21.2.4?

==========================
http://www.rConfig.com 

A free, open source network device configuration management tool, customizable to your needs!

- Always vote on an answer if you found it helpful

[Wes Neary]

Hi Stepen when a ping is launched from the server, there is no increment in the ACL on the LB.  Also no conn is established.

Thanks for the Help.

[stephen.stack]

Well, back to basics i guess. Is there an ARP entry on the ACE for Server1-10.1.3.11? What is it?

Can the ACE ping the server?

==========================
http://www.rconfig.com 

A free, open source network device configuration management tool, customizable to your needs!

- Always vote on an answer if you found it helpful

[Wes Neary]

Hi,

Yes the ACE can ping the server the arp entry has the correct address to the correct MAC in the right vlan. the type is rserver the encap is 83 and the status is up.

Hope this helps.

[Wes Neary]

Any Ideas anyone.

[pablo.nxh]

Hi Wes,

Do you have a sketch of your current setup? I feel there's a switching connectivity issue behind this; more than an ACE issue, that ping test you're doing will only be generating routed traffic through the ACE which will only need your interfaces up and ACLs in place (no LB required). Also is there a special reason for using the ACE cluster as your server gateway?

__ __

Pablo

[Jorge Bejarano]

Wes,

Please upload the configuration and specify the current default gateway.

Can´t you make the ACE as the default gateway?

What willl be the VIP in question?

Jorge