<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
<channel>
<title>Cisco NetPro - <![CDATA[Application Networking]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=&amp;topic=&amp;CommCmd=MB%3Fcmd%3Ddisplay_messages%26mode%3Dnew%26location%3D.ee7814f</link>
<description><![CDATA[Accelerating and optimizing applications in the data center and for branch offices    ]]></description>
<lastBuildDate>Sat, 10 May 2008 13:53:46 PST</lastBuildDate>
<generator>CCSF</generator>
<docs>http://blogs.law.harvard.edu/tech/rss</docs>
<item>
<title><![CDATA[ACE: load balancing servers using DMZ ports on FWSM]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc06528</link>
<description><![CDATA[devices; (2 core with the ff config)
6500
fwsm
idsm
msfc

SETUP;
Servers are connected to the dmzs on the core

REQUIREMENT;
to load balance the servers

QUESTION;
Using the ACE module, is it possibe to load balance the servers which are connected to the port which is configured as DMZ?

Thanks]]></description>
<guid isPermaLink="false">.2cc06528</guid>
<pubDate>Sat, 10 May 2008 08:21:02 PST</pubDate>
</item>
<item>
<title><![CDATA[HTTP Redirection in CSS 11501]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0863c</link>
<description><![CDATA[Currently clients type the url &lt;A HREF=&quot;javascript:newWin('http://name.domain.com:8080')&quot;&gt;http://name.domain.com:8080&lt;/A&gt; to access our application servers which are behind the CSS 11501.

can anybody give inputs as how to configure http port redirection in CSS 11501 where clients only type &lt;A HREF=&quot;javascript:newWin('http://name.domain.com')&quot;&gt;http://name.domain.com&lt;/A&gt; without mentioning the port nos.

My configuration is as given below

****************Service******************
service Server1
ip address 192.168.51.1
redundant index 65
keepalive type tcp
keepalive port 8080
active
*****************************************

*****************OWNER*******************
owner abc

     content Link
     vip address 192.168.51.200
     add service server1
     redundant index 55
     protocol tcp
     port 8080
     active
*****************************************
]]></description>
<guid isPermaLink="false">.2cc0863c</guid>
<pubDate>Sat, 10 May 2008 05:04:16 PST</pubDate>
</item>
<item>
<title><![CDATA[NATing outbound traffic from server]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc08485</link>
<description><![CDATA[Currently we have configured CSM in bridged mode where 106.101.X.Y is our client as well as server side Vlan. Currently requests from clients at Virtual Server IP: 106.101.X.Y3 are distributed between Real Server IP 106.101.X.Y1 and 106.101.X.Y2. Now we want to make sure that when these Real servers at IP 106.101.X.Y1 and 106.101.X.Y2  originate their outbound requests, they should be NATed to one IP address: 106.101.X.Y4. What will be the required configuration for this?

&lt;b&gt;Attachment Keywords : &lt;/b&gt; 
1) CSM CatchAll.bmp
]]></description>
<guid isPermaLink="false">.2cc08485</guid>
<pubDate>Fri, 9 May 2008 21:18:21 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS 11503 persistence]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc085d7</link>
<description><![CDATA[We have a web app that still uses frames.  The web URL is HTTPS, but 1 of the frames uses HTTP.  I need for a user to stick to the same server for both frames or it screws up the application.

I am load balancing to 2 servers over HTTP and HTTPS using a group for client NATing.  I have tried the advanced-loadbalancing ssl on both HTTP and HTTPs services, and I tried advanced-loadbalancing arrowpoint-cookie. on both.  Neither way worked.

How do i get the CSS to stick to 1 server for both frames?]]></description>
<guid isPermaLink="false">.2cc085d7</guid>
<pubDate>Fri, 9 May 2008 18:31:34 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS11506 - show flows]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc084ea</link>
<description><![CDATA[Hello all,

I have a CSS11506 with the following config...

!************************** SERVICE **************************

service pas_main_uswrnsa0ptf01_11111
  ip address 172.16.25.30
  keepalive type tcp
  keepalive port 11111
  port 11111
  active

service pas_main_uswrnsa0ptf02_11111
  ip address 172.16.25.31
  keepalive type tcp
  keepalive port 11111
  port 11111
  active

service pas_main_uswrnsa0ptf03_11111
  ip address 172.16.25.32
  keepalive type tcp
  keepalive port 11111
  port 11111
  active

service pas_main_uswrnsa0ptf04_11111
  ip address 172.16.25.33
  keepalive type tcp
  keepalive port 11111
  port 11111
  active

!*************************** OWNER ***************************
owner PAS

  content PAS-pas_main-2008-11111
    vip address 123.123.130.222
    protocol tcp
    port 11111
    url &quot;/*&quot;
    balance aca
    application ssl
    add service pas_main_uswrnsa0ptf01_11111
    add service pas_main_uswrnsa0ptf02_11111
    add service pas_main_uswrnsa0ptf03_11111
    add service pas_main_uswrnsa0ptf04_11111
    active

!*************************** GROUP ***************************
group PAS-pas_Dgraphs
  vip address 172.16.25.11
  add destination service pas_main_uswrnsa0ptf01_11111
  add destination service pas_main_uswrnsa0ptf02_11111
  add destination service pas_main_uswrnsa0ptf03_11111
  add destination service pas_main_uswrnsa0ptf04_11111
  active

I can access my servers just fine, but when issuing the 'show flows' command, I do not see my traffic... even though I can see my hit counters incrementing.

NOTE: The 'application ssl' command is something new for us, so I thought it may be related to this.

Any ideas?

Thanks,

-Adam]]></description>
<guid isPermaLink="false">.2cc084ea</guid>
<pubDate>Fri, 9 May 2008 15:22:39 PST</pubDate>
</item>
<item>
<title><![CDATA[WAFS/WAAS File Locking]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0645c</link>
<description><![CDATA[I have run into an issue that i believe is file server related however i just want to run it by the board for clarification. 

A remote site was recently converted from a standalone server site to one that is supported via WAFS/WAAS 4.0.11 installed on a 512 WAE w/ 2GB of Ram acting as wafs edge. The core is a 612 w/ 4GB of ram. 

All user home folders reside across the WAN in the data center on a NetApp NAS SAN hosting the home folder natively (there is no windows server involved). 

The issue is with file locking. Periodically, when a user opens a file on the server that is already been opened they are not getting any indication that the file is in use. Once they go to save the file they are told by the system that they cannot save the file using the same filename since it is being modified. 

From reading the docs on WAFS/WAAS this looks like it is a problem with the OpLocks coming from the NetApp NAS and nothing to do with WAFS since WAFS/WAAS doesn't act on file locking requests, only passing them through to the file server. 

Are my assumptions correct in this regard? Could WAFS be interferring some how with this communication and causing the file locking information being received from the NetApp NAS not to be correctly sent to the client? 

Any way for me to debug this besides a packet capture? Any show commands that could indicate an issue? or logs?

TIA

Mike Louis]]></description>
<guid isPermaLink="false">.2cc0645c</guid>
<pubDate>Fri, 9 May 2008 15:15:36 PST</pubDate>
</item>
<item>
<title><![CDATA[MAC-Miss Rate on ACE module]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc08397</link>
<description><![CDATA[What exactly does the MAC-Miss rate mean on the ACE? And if we are running out of resources for it, should I worry?

We have only implemented 1 production policy on the ACE module so far and we are already running out of resources for the mac-miss rate. All other resources look good.

Is this OK? Or is something wrong here?

Attached is the resource usage counters.

Thanks,

Ben

&lt;b&gt;Attachment Keywords : &lt;/b&gt; 
1) ACEResourceUsage.txt
]]></description>
<guid isPermaLink="false">.2cc08397</guid>
<pubDate>Fri, 9 May 2008 13:52:00 PST</pubDate>
</item>
<item>
<title><![CDATA[ACE: predictor hash header Host - not working]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0832c</link>
<description><![CDATA[Hello,

I've a problem with the predictor has Header host.

I've a Farm of HTTP Proxy Servers which work an TCP Port 8000 and 8080.

We have configured like in the attachment but on the two proxy Servers the log shows that the Requests are balanced over both proxys for a request to the Host: &lt;A HREF=&quot;javascript:newWin('http://www.gelbeseiten.de')&quot;&gt;http://www.gelbeseiten.de&lt;/A&gt;

Has anyone an idea what is wrong in my configuration?

Sven




]]></description>
<guid isPermaLink="false">.2cc0832c</guid>
<pubDate>Fri, 9 May 2008 13:44:59 PST</pubDate>
</item>
<item>
<title><![CDATA[ACE: rserver access to its own VIP]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc08528</link>
<description><![CDATA[Can anyone be my second pair of eyes and confirm for me that this configuration is good?  I am having problems doing source NAT from a real server to a VIP for which it is a service for.

The two real servers here are within a serverfarm for the VIP etrust2vip.  The real servers themselves need to hit that VIP.  In the configuration below I have a NAT applied to the server vlan (vlan71) to  SNAT the packets destined for the VIP in the acl (enat).

'sh xlate' shows me nothing nor do I see any hits in 'sh conn'.  The default gateway for the real servers is the alias address on vlan71.

The equipment I am working with is an ACE appliance with code 3.0(0)A1(7b).

Any help would be greatly appreciated.

access-list enat line 3 extended permit ip host 10.24.71.18 host 10.24.70.176
access-list enat line 4 extended permit ip host 10.24.71.19 host 10.24.70.176
access-list allacl line 10 extended permit ip any any

probe tcp P-20389
  port 20389
  interval 5
  faildetect 2
  passdetect interval 10
  passdetect count 5
  connection term forced
  open 2

rserver host etrustserver1
  ip address 10.24.71.18
  inservice
rserver host etrustserver2
  ip address 10.24.71.19
  inservice

serverfarm host etrust2sfarm
  failaction purge
  predictor leastconns
  probe P-20389
  retcode 100 500 check count
  rserver etrustserver1 20389
    inservice
  rserver etrustserver2 20389
    inservice

sticky ip-netmask 255.255.255.0 address source STICKY-2
  timeout 720
  replicate sticky
  serverfarm etrust2sfarm

class-map match-any SNAT
  description Source NAT connections to the VIPs
  2 match access-list enat
class-map match-all etrust2vip
  2 match virtual-address 10.24.70.176 tcp eq 20389

policy-map type loadbalance first-match etrust2lbpolicy
  class class-default
    sticky-serverfarm STICKY-2
policy-map multi-match vlan70-service
  class etrust2vip
    loadbalance vip inservice
    loadbalance policy etrust2lbpolicy
    loadbalance vip icmp-reply
policy-map multi-match vlan71-service
  class SNAT
    nat dynamic 2 vlan 70

interface vlan 70
  description CLIENT-SIDE
  ip address 10.24.70.183 255.255.255.0
  alias 10.24.70.182 255.255.255.0
  peer ip address 10.24.70.185 255.255.255.0
  mac-sticky enable
  access-group input allacl
  access-group output allacl
  nat-pool 2 10.24.70.200 10.24.70.200 netmask 255.255.255.255 pat
  service-policy input vlan70-service
  no shutdown
interface vlan 71
  description RSERVER-SIDE
  ip address 10.24.71.4 255.255.255.0
  alias 10.24.71.5 255.255.255.0
  peer ip address 10.24.71.6 255.255.255.0
  mac-sticky enable
  access-group input allacl
  access-group output allacl
  nat-pool 1 10.24.71.200 10.24.71.205 netmask 255.255.255.255 pat
  service-policy input vlan71-service
  no shutdown
]]></description>
<guid isPermaLink="false">.2cc08528</guid>
<pubDate>Fri, 9 May 2008 13:27:31 PST</pubDate>
</item>
<item>
<title><![CDATA[GSS vs CSS]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0845e</link>
<description><![CDATA[

We have two CSSs one in DR and one in HQ and are communicating with an App Session.

They are configured in sort of a hybrid mode as partially a content services switch to failover servers and as a DNS server to host DNS records

We are using both the DNS component and services to failover some servers:



 dns-server zone 0 tier1
 dns-record a popserver.mynetwork.com 2.1.1.8 50 single kal-icmp 172.16.10.65 150 sticky-disabled weightedrr 10


service MCI-SMTP
  protocol tcp
  port 25
  keepalive frequency 120
  keepalive retryperiod 120
  max usage 255
  keepalive type script ap-kal-smtp &quot;2.1.1.8&quot;
  ip address 2.1.1.8
  active

We have  some set up to just use the GSLB method for failover with services, VIP Addresses and content rules.

We need to have the ability to check the https index page of one of the server and this requires an encryption module, which we don't have in the CSS devices we currently own.

My understanding is that the GSS was design to do the DNS function in a more enhanced way that the CSS can do it.

Since we will be purchasing new appliances, I have these questions:

1. Can the GSS be a replacement for the CSS and do everything the CSS can do, configuring services, VIP address and content rules, in addition to DNS funtions?

2. What is the benifit of using the GSS over the CSS?

3. If 1 and 2 are Can I get an encryption module for the GSS to check the https index page on services configured?]]></description>
<guid isPermaLink="false">.2cc0845e</guid>
<pubDate>Fri, 9 May 2008 11:30:25 PST</pubDate>
</item>
<item>
<title><![CDATA[CSM fails to come online when installed in a chas. SUP720  - 12.2(18)SXF8]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07c0d</link>
<description><![CDATA[Question 1:
===========

We think this is a compatabilty problem between teh version of code in CSM and the IOS image version. But I can't find on CCo anything to say so.

*May  7 18:48:47.835: %ONLINE-SP-6-TIMER: Module 3, Proc. 0. Failed to bring online because of timer event *May  7 18:48:47.835: %C6KPWR-SP-4-DISABLED: power to module in slot 3 set off (Module  Failed SCP dnld) *May  7 18:50:30.380: %ONLINE-SP-6-TIMER: Module 3, Proc. 0. Failed to bring online because of timer event *May  7 18:50:30.380: %C6KPWR-SP-4-DISABLED: power to module in slot 3 set off (Module  Failed SCP dnld) ttllagx001# ttllagx001# ttllagx001#sh mod
Mod Ports Card Type                              Model              Serial No.
--- ----- -------------------------------------- ------------------ -----------
  1    4  CEF720 4 port 10-Gigabit Ethernet      WS-X6704-10GE      SAL1122Q2H0
  2   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     SAL1002ABSF
  3    4  SLB Application Processor Complex      WS-X6066-SLB-APC   SAD08220563
  4    6  Firewall Module                        WS-SVC-FWM-1       SAD0730017N
  5    2  Supervisor Engine 720 (Active)         WS-SUP720-BASE     SAD0725023K

Mod MAC addresses                       Hw    Fw           Sw           Status
--- ---------------------------------- ------ ------------ ------------ -------
  1  001a.a2a2.74d4 to 001a.a2a2.74d7   2.5   12.2(14r)S5  12.2(18)SXF8 Ok
  2  0015.c6b4.21bc to 0015.c6b4.21eb   2.5   12.2(14r)S5  12.2(18)SXF8 Ok
  3  0011.211c.3f20 to 0011.211c.3f27   1.7   Unknown      Unknown      PwrDown
  4  0003.feac.644c to 0003.feac.6453   2.0   7.2(1)       2.3(2)       Ok
  5  000c.ce64.1098 to 000c.ce64.109b   2.1   7.7(1)       12.2(18)SXF8 Ok

Mod  Sub-Module                  Model              Serial       Hw     Status
---- --------------------------- ------------------ ----------- ------- -------
  1  Centralized Forwarding Card WS-F6700-CFC       SAL1120P3GH  3.1    Ok
  2  Centralized Forwarding Card WS-F6700-CFC       SAD091200C1  2.1    Ok
  5  Policy Feature Card 3       WS-F6K-PFC3A       SAD0721041R  1.1    Ok
  5  MSFC3 Daughterboard         WS-SUP720          SAD072501R6  1.2    Ok

Mod  Online Diag Status
---- -------------------
  1  Pass
  2  Pass
  3  Not Applicable
  4  Pass
  5  Pass

Question 2:
===========
This customer has several SUP720 runningf 12.2(17)SXB11a and CSM 3.21 and has no problem. 

Now they need to upgrade all their SUP720 to 12.2(18)SXF8. So they upgraded the one in theie lab to 12.2(18)SXF8 and then installed a CSM in this lab machine,. but the CSM doesn't come online. Not sure what code this CSM is running because it is down. Customer wants to know if 3.21 will be supported with 12.2(18)SXF8.]]></description>
<guid isPermaLink="false">.2cc07c0d</guid>
<pubDate>Fri, 9 May 2008 08:08:44 PST</pubDate>
</item>
<item>
<title><![CDATA[Team servers connected to a css11501S]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07f82</link>
<description><![CDATA[I have 2 CSS11501S connected to an stateful active/standby pair on port e8.  And servers with one nic in each CSS.  So CSS01 e1 has NIC1 of serverA  and CSS02 e1 has NIC2 of serverA.  I had some issues where the VIPs would not work because VRRP wouldnt work (each CSS couldnt see eachother)  I resolved that by making e7 a trunk and got the VRRP working in a active standby(stateful) setup between the CSS.  PRoblem is now that the Teamed servers crap out when more than one nic is turned on.  If i put on both nics then they dont work they just die.  If i turn off a nic then it works.  I'm a bit confused since the trunk should be able to allow the nics to communicate with eachother.

Any insight would be helpful]]></description>
<guid isPermaLink="false">.2cc07f82</guid>
<pubDate>Fri, 9 May 2008 07:09:48 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS11506 TCP window size issue]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07819</link>
<description><![CDATA[Under some conditions, we are seeing the TCP Window Size being cut back to 0 by our CSS11506, even though there is no abnormal load or backend issues that we can see.  
Any ideas on what to look for, to debug this further?]]></description>
<guid isPermaLink="false">.2cc07819</guid>
<pubDate>Fri, 9 May 2008 06:49:59 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS Terminal Services load balancing]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07322</link>
<description><![CDATA[Hello,
I have configured load-balancing for terminal services running on windows servers. All works fine, but sometimes (ones per 1-3 days) is session to terminal server dropped. tcpdump shows reason - communication to client is coming not from VIP address, but from real server address (in other words: session is running 2, or 5 hours and suddenly is session dropped, because tcp issue and load-balanced to other server). Real server is operational during this issue.

here is a configuration:

server side: 10.1.3.0/24
client side: 10.1.0.0/24

(the same config for other services)
 service trkat-tsapp7 
  port 3389 
  protocol tcp 
  keepalive type tcp 
  keepalive frequency 30 
  ip address 10.1.3.7 
  active 

  content trkat-tsapp 
    vip address 10.1.0.19 
    protocol tcp 
    port 3389 
    sticky-inact-timeout 660 
    advanced-balance sticky-srcip 
    add service trkat-tsapp7 
    add service trkat-tsapp6 
    add service trkat-tsapp5 
    add service trkat-tsapp4 
    add service trkat-tsapp3 
    active  

clients are remote office workers, therefore sticky time 660min. tcp session is handshakes only ones by connecting client to terminal server and sticky timer is initiated. customer requires connecting to the same server after network connectivity problem.

There are around 20-100 users per real server.

I think this configuration is ok. Or it's well know problem with terminal services load balancing?

martin]]></description>
<guid isPermaLink="false">.2cc07322</guid>
<pubDate>Fri, 9 May 2008 06:28:38 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS TCP RST to dead VIP address]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cbfc8b4</link>
<description><![CDATA[When all services goes down, telnet to VIP address is trying to connect. CSS don't send TCP RST to the client (it's enabled). tcpdump shows only TCP SYN packets to the CSS, but no response from CSS. It's a bug, or feature? :)

CSS version: 07.50.1.03

css1# sh rule domino domino-tomcat  

Name:           domino-tomcat   Owner:                  domino
State:                 Active   Type:                     HTTP
Balance:          Round Robin   Failover:                  N/A
Persistence:          Enabled   Param-Bypass:         Disabled
Session Redundancy:   Enabled   Redundancy Global Index:    12
IP Redundancy:           Master
FlowTimeout:                8
L3:         172.24.1.23
L4:         TCP/8009
Url:        
Redirect: &quot;&quot;
TCP RST client if service unreachable: Enabled
Rule Services &amp; Weights:
 1: domino-tomcat-1-Down, S-1
 2: domino-tomcat-2-Down, S-1


after configuring 'flow tcp-reset-vip-unavailable' in global config mode, CSS send TCP RST to the client.

My question: 
When is 'flow tcp-reset-vip-unavailable' enabled, is needed to configure &quot;TCP RST client if service unreachable: Enabled&quot; in the content?.]]></description>
<guid isPermaLink="false">.2cbfc8b4</guid>
<pubDate>Thu, 8 May 2008 15:39:10 PST</pubDate>
</item>
<item>
<title><![CDATA[Standard Application policies on WAE]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07ece</link>
<description><![CDATA[Is there a list of the application types or policies that come 'standard' on WAE appliances? Data sheets refer to 150 or more, and need to know what these are. Any info helpful. Thx-]]></description>
<guid isPermaLink="false">.2cc07ece</guid>
<pubDate>Thu, 8 May 2008 14:38:23 PST</pubDate>
</item>
<item>
<title><![CDATA[Upgrading from TRN to ENT Licence]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07f6d</link>
<description><![CDATA[Hi,

I am trying to find out how easy it is to upgrade a WAAS device from Transport to Enterprise. Plus can this be done remotely?

Thanks]]></description>
<guid isPermaLink="false">.2cc07f6d</guid>
<pubDate>Thu, 8 May 2008 14:26:38 PST</pubDate>
</item>
<item>
<title><![CDATA[Show Chassis Type]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc06f79</link>
<description><![CDATA[Is there a show command that you can run to deturmin if a 6500 Chassis is an E version or not?]]></description>
<guid isPermaLink="false">.2cc06f79</guid>
<pubDate>Thu, 8 May 2008 10:14:05 PST</pubDate>
</item>
<item>
<title><![CDATA[CSM Fron realserver access to VirtualServer]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc079fc</link>
<description><![CDATA[We have two farms, and we want fron a realserver access to virtual server from the other farm, it can´t .... How can i do this?
]]></description>
<guid isPermaLink="false">.2cc079fc</guid>
<pubDate>Thu, 8 May 2008 09:22:24 PST</pubDate>
</item>
<item>
<title><![CDATA[Cisco CSS not NATing FTP 'data' connection]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc078a4</link>
<description><![CDATA[ I have a CSS11501 that load balances traffic to 4 FTP servers.

2 of the 4 servers also initiate outbound FTP connections (Active mode) to other servers on the internet.
(When I talk about these 2 servers initiating a FTP session from behind a CSS I will refer them as 'client' to avoid confusion.)

Inbound FTP traffic to all the servers work fine.  The outbound Active mode FTP traffic from the 2 client is failing (passive FTP works).
I have defined both the 'content rules' and 'groups' (source groups) for these connections.
But what I see on the PIX is this:

PIX515-active %PIX-4-406002: FTP port command different address: 10.1.1.15(10.1.1.16) to xx.xx.xx.70 on interface inside
I believe this dropped packet on the PIX is the acknowledgement 'ACK' packet from the client(sitting behind the CSS) to the connection attempt from the server (on the internet) for the 'data' connection. And basically the CSS is not translating the source address of the client from 10.1.1.16 --&gt;10.1.1.15(VIP) for this acknowledgement 'ACK' packet.

Here is the relevant config:
For inbound FTP:

service ftp1
  ip address 10.x.x.10
  active

service ftp2
  ip address 10.x.x.11
 active

content ftp
    application ftp-control
    add service ftp1
    add service ftp2
    vip address 10.x.x.21
    active

group ftp
  add service ftp1
  add service ftp2
  vip address 10.x.x.21
   active

For FTP servers that initiate FTP traffic and receive FTP request as well (i.e. inbound/outbound FTP)

service fftp1
  ip address 10.x.x.16
  active

service fftp01
  ip address 10.x.x.17
  active

content Fftp1 --&gt; this does not have VIP but I tried adding a VIP same as the source group but to no  avail.
    application ftp-control
    add service fftp1
    protocol tcp
    port 2021
    add service fftp01
    active

group fget
  vip address 10.x.x.15
  add service fftp1
  add service fftp01
  active

Inbound FTP works fine without any issues. Even outbound FTP (passive mode) works fine.
However active mode FTP fails and I see this error on the PIX:

PIX515-active %PIX-4-406002: FTP port command different address: 10.1.1.15(10.1.1.16) to xx.xx.xx.70 on interface inside

What am I missing here to get active mode connections to work with the CSS so that machines sitting behind the CSS can initiate active mode FTP connections? Do I need a content rule for the &quot;data&quot; connection as well??? ]]></description>
<guid isPermaLink="false">.2cc078a4</guid>
<pubDate>Thu, 8 May 2008 09:21:21 PST</pubDate>
</item>
<item>
<title><![CDATA[WAFS ]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0746e</link>
<description><![CDATA[When I set up the File Servers for my core and edge WAE's I understand that this will provide CIFS acceleration - in addition to the TFO/DRE/LZ features.  Does this CIFS acceleration only provide benefits for file shares - or would it also provide some benefit for the logon process w/ roaming profiles?
]]></description>
<guid isPermaLink="false">.2cc0746e</guid>
<pubDate>Thu, 8 May 2008 07:52:28 PST</pubDate>
</item>
<item>
<title><![CDATA[Multiple SSL Certs]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07d87</link>
<description><![CDATA[Hi All,

   I'm pretty sure I know the answer to this, but like the Russians say &quot;Trust but Verify&quot;.

   I've just been handed a requirement to add a second SSL termination on a CSS 11501S.  I presume I just add a second SSL-SERVER to my proxy list and call the same service in the SSL rule.  Is this the correct method?  I know it will not allow me to create a 2nd proxy-list.

   Please help me be sure I understand these things.

TIA,

Jim]]></description>
<guid isPermaLink="false">.2cc07d87</guid>
<pubDate>Thu, 8 May 2008 06:45:33 PST</pubDate>
</item>
<item>
<title><![CDATA[WCCP and ISDN / Dialer]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0753c</link>
<description><![CDATA[We have two routers running the same IOS version in our core - c7200-is-mz.123-10a.bin.  One terminates a number of tunnels and the other has a number of dialer interfaces associated with an ISDN PRI.  Each of our site routers has a tunnel going to the core (via an ADSL connection) and a backup ISDN interface with a dialer configured.  When we are running on the primary links everything works fine.  When we are running on the backup links (the ISDN) WCCP redirection seems to prevent clients from accessing services on TCP in the core (I can telnet to the core ISDN router from a PC on site, but can't access anything else).  Ping always works fine - hence my suspicions about WCCP.  If I disable WCCP on the core router with the ISDN links backup connections work fine.

Our remote routers use c2800nm-advsecurityk9-mz.124-11.T4.bin.

My question is - is there any issue with WCCP redirection and dialer interfaces?

Below is the relevant config for the routers that don't work (addresses, names and numbers have been sanitized.
corerouter#
ip wccp 61
ip wccp 62
interface Dialer183
 description Backup DoD for remote site
 bandwidth 64
 ip address 192.168.1.1 255.255.255.252
 ip wccp 61 redirect out
 ip wccp 62 redirect in
 encapsulation ppp
 dialer pool 2
 dialer remote-name siterouter
 dialer idle-timeout 300
 dialer enable-timeout 60
 dialer wait-for-carrier-time 10
 dialer caller 222222
 dialer-group 1
 snmp ifindex persist
 ppp authentication chap
End
siterouter#sh run
ip wccp 61
ip wccp 62
interface Dialer1
 description Backup DoD to the core via ISDN
 bandwidth 64
 ip address 192.168.1.2 255.255.255.252
 ip wccp 62 redirect in
 encapsulation ppp
 dialer pool 2
 dialer remote-name corerouter
 dialer idle-timeout 300
 dialer enable-timeout 60
 dialer wait-for-carrier-time 10
 dialer string 111111
 dialer caller 222222
 dialer-group 2
 ppp authentication chap
end]]></description>
<guid isPermaLink="false">.2cc0753c</guid>
<pubDate>Wed, 7 May 2008 16:43:38 PST</pubDate>
</item>
<item>
<title><![CDATA[SMTP, RADIUS, and source groups on CSS 11503]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0738d</link>
<description><![CDATA[I'm reviewing this doc:

&lt;A HREF=&quot;javascript:newWin('http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.10/configuration/content_lb/guide/SGrp.html')&quot;&gt;http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.10/configuration/content_lb/guide/SGrp.html&lt;/A&gt;

I need to have my (to-be) load balanced SMTP servers authenticate against RADIUS, which is on the public side of the CSS 11503.  We use UDP for RADIUS, and don't want to change - we need the IPs to authenticate against RADIUS and be &quot;sticky&quot;, ie source and destination stay the same.

I figured that I could have a source-group for SMTP as follows:

-----
service smtp1
ip address 172.x.x.51
active

service smtp2
ip address 172.x.x.52
active

-------

group SMTP
vip 111.x.x.50
add service smtp1
add service smtp2
active

-------

Then do my content rules, based on protocol; we need 25 and 465, but for simplicity I'll do one:

owner MAIL
content smtp
protocol tcp
port 25
vip address 111.x.x.50
add service smtp1
add service smtp2
active
------------

So, first:  does that take care of my outbound traffic 100%, or am I missing an ACL somewhere to make it happen?

Then, I figured for RADIUS, I do the same thing, but with the UDP port.  Something like:

group RADIUS1
vip 111.x.x.51
add service smtp1
active

group RADIUS2
vip 111.x.x.52
add service smtp2
active

And then do TWO content rules, one per SMTP server with the two different RADIUS vips.

The goal here is to properly load balance SMTPs, have incoming and outgoing be one IP, which is standard.  However, each individual SMTP server needs a &quot;sticky&quot; type of connection on UDP to authenticate to the RADIUS server(s), so the authentication reply from RADIUS goes to the right place.

The problem is that the doc I am reading says &quot;a service may belong to only one group at a time&quot;.

How do I get out of this pickle?

Thank you!]]></description>
<guid isPermaLink="false">.2cc0738d</guid>
<pubDate>Wed, 7 May 2008 13:35:01 PST</pubDate>
</item>
<item>
<title><![CDATA[looking for competitive info on WAAS]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07b4d</link>
<description><![CDATA[Hi, I'm looking for competitive WAAS info, and I don't see any on this website... can anyone point me in the right direction?

Thanks! Lisa G]]></description>
<guid isPermaLink="false">.2cc07b4d</guid>
<pubDate>Wed, 7 May 2008 12:29:50 PST</pubDate>
</item>
<item>
<title><![CDATA[nat server on CSM]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc06e62</link>
<description><![CDATA[Exactly what does &quot;nat server&quot; do on CSM's?

Does it NAT all incoming traffic from client to server w/ the VIP, or NAT return packets back to client w/ VIP as source? or both?]]></description>
<guid isPermaLink="false">.2cc06e62</guid>
<pubDate>Wed, 7 May 2008 11:58:17 PST</pubDate>
</item>
<item>
<title><![CDATA[WAE &amp; FreeBSD]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07565</link>
<description><![CDATA[Is 2 wae612 and 1 wae512 (Central Manager). There are 2 routers on FreeBSD. Prompt as it is possible to redirect the traffic from these routers on wae, without use wccp.]]></description>
<guid isPermaLink="false">.2cc07565</guid>
<pubDate>Wed, 7 May 2008 11:07:51 PST</pubDate>
</item>
<item>
<title><![CDATA[CSS/CSM to ACE conversion tool]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc062ba</link>
<description><![CDATA[Hi,

Are there any plans to release a standalone CSS/CSM to ACE config migration tool? (just like the CatOS to IOS tool)?

thanks,
Andrew.
]]></description>
<guid isPermaLink="false">.2cc062ba</guid>
<pubDate>Wed, 7 May 2008 10:34:33 PST</pubDate>
</item>
<item>
<title><![CDATA[WAAS Design Question]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc07994</link>
<description><![CDATA[Let's say I have one host site (A) and one remote site (B) connected by a 1.5Mb Frame-relay T1.  Servers are at site A, clients at site B.

Would you typically place the same size WAAS box at each end of the circuit?  Like a WAE-512 at the host AND remote?  This is what I get from the documentation.  However, using common sense I would think the remote site would need to be larger.

If the idea is to have files stored local to the remote site, why would I need to have more storage space at my host site?

Just trying to understand.

Thanks!
Tom]]></description>
<guid isPermaLink="false">.2cc07994</guid>
<pubDate>Wed, 7 May 2008 05:55:51 PST</pubDate>
</item>
<item>
<title><![CDATA[WAE-512 - Disk Space Question]]></title>
<link>http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&amp;type=rss&amp;forum=Data%20Center&amp;topic=Application%20Networking&amp;CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc0798d</link>
<description><![CDATA[We have a WAE-512 with two 232GB drives.  When we do a 'show disk' the 'CONTENT' mount only shows to be 209177MB in size.  Shouldn't this number be around 464GB?  232GB X 2????

Thanks!
Tom]]></description>
<guid isPermaLink="false">.2cc0798d</guid>
<pubDate>Wed, 7 May 2008 05:55:15 PST</pubDate>
</item>

</channel>
</rss>
