-
User Guide for the Cisco Application Networking Manager 4.2
-
Index
-
Preface
-
Overview
-
Using Homepage
-
Using ANM Guided Setup
-
Importing and Managing Devices
-
Configuring Virtual Contexts
-
Configuring Virtual Servers
-
Configuring Real Servers and Server Farms
-
Configuring Stickiness
-
Configuring Parameter Maps
-
Configuring SSL
-
Configuring Network Access
-
Configuring High Availability
-
Configuring Traffic Policies
-
Configuring Application Acceleration and Optimization
-
Using Configuration Building Blocks
-
Monitoring Your Network
-
Administering the Cisco Application Networking Manager
-
Troubleshooting Cisco Application Networking Manager Problems
-
ANM Ports Reference
-
Using ANM With Virtual Data Centers
-
Glossary
-
Feedback
Table Of Contents
Configuring Real Servers and Server Farms
Information About Server Load Balancing
Dynamic Workload Scaling Overview
Configuring Load Balancing on Real Servers
Displaying Real Server Statistics and Status Information
Using the Real Server Connection Statistics Graph
Using the Real Server Topology Map
CLI Commands Sent from the Real Server Table
Configuring Dynamic Workload Scaling
Configuring and Verifying a Nexus 7000 Connection
Configuring and Verifying a VM Controller Connection
Configuring Load Balancing Using Server Farms
Adding Real Servers to a Server Farm
Configuring the Predictor Method for Server Farms
Configuring Server Farm HTTP Return Error-Code Checking
Displaying Server Farm Statistics and Status Information
Configuring Health Monitoring for Real Servers
Configuring DNS Probe Expect Addresses
Configuring Headers for HTTP and HTTPS Probes
Configuring Health Monitoring Expect Status
Configuring an OID for SNMP Probes
Displaying Health Monitoring Statistics and Status Information
Configuring Real Servers and Server Farms
Date: 2/21/11This chapter describes how to configure real servers and server farms on the Cisco Application Control Engine (ACE) using Cisco Application Networking Manager (ANM).
Note
When naming ACE objects (such as a real server, virtual server, parameter map, class map, health probe, and so on), enter an alphanumeric string of 1 to 64 characters, which can include the following special characters: underscore (_), hyphen (-), dot (.), and asterisk (*). Spaces are not allowed.
If you are using ANM with an ACE module or ACE appliance and you configure a named object at the ACE CLI, keep in mind that ANM does not support all of the special characters that the ACE CLI allows you to use when configuring a named object. If you use special characters that ANM does not support, you may not be able to import or manage the ACE using ANM.This chapter includes the following sections:
•
•
•
Information About Server Load Balancing
Server load balancing (SLB) is the process of deciding to which server a load-balancing device should send a client request for service. For example, a client request can consist of an HTTP GET for a Web page or an FTP GET to download a file. The job of the load balancer is to select the server that can successfully fulfill the client request and do so in the shortest amount of time without overloading either the server or the server farm as a whole.
Depending on the load-balancing algorithm or predictor that you configure, the ACE performs a series of checks and calculations to determine the server that can best service each client request. The ACE bases server selection on several factors, including the server with the fewest connections with respect to load, source or destination address, cookies, URLs, or HTTP headers.
ANM allows you to configure load balancing using:
•
•
•
•
•
•
For more information about SLB as configured and performed by the ACE, see:
•
•
•
•
This section includes the following topics:
Load-Balancing Predictors
The ACE uses the following predictors to select the best server to satisfy a client request:
•
Note
•
•
•
•
•
You can specify a beginning pattern and an ending pattern to match in the URL. Use this predictor method to load-balance cache servers. Cache servers perform better with the URL hash method because you can divide the contents of the caches evenly if the traffic is random enough. In a redundant configuration, the cache servers continue to work even if the active ACE switches over to the standby ACE. For information about configuring redundancy, see the "Configuring High Availability" section on page 12-1.
•
•
•
•
•
Note
Related Topics
Configuring the Predictor Method for Server Farms
Real Servers
To provide services to clients, you configure real servers on the ACE. Real servers can be dedicated physical servers or VMware virtual machines (VMs) that you configure in groups called server farms.
Note
Real servers provide client services such as HTTP or XML content, website hosting, FTP file uploads or downloads, redirection for web pages that have moved to another location, and so on. You identify real servers with names and characterize them with IP addresses, connection limits, and weight values. The ACE also allows you to configure backup servers in case a server is taken out of service for any reason.
After you create and name a real server on the ACE, you can configure several parameters, including connection limits, health probes, and weight. You can assign a weight to each real server based on its relative importance to other servers in the server farm. The ACE uses the server weight value for the weighted round-robin and the least-connections load-balancing predictors. The load-balancing predictor algorithms (for example, roundrobin, least connections, and so on) determine the servers to which the ACE sends connection requests. For a listing and brief description of the load-balancing predictors, see the "Load-Balancing Predictors" section.
The ACE uses traffic classification maps (class maps) within policy maps to identify traffic that meets defined criteria and to apply specific actions to that traffic based on the SLB configuration.
If a primary real server fails, the ACE takes that server out of service and no longer includes it in load-balancing decisions. If you configured a backup server for the real server that failed, the ACE redirects the primary real server connections to the backup server. For information about configuring a backup server, see the "Configuring Virtual Server Layer 7 Load Balancing" section on page 6-30.
The ACE can take a real server out of service for the following reasons:
•
•
•
•
The Out Of Service and Inservice Standby selections both provide the graceful shutdown of a server.
Related Topics
•
Dynamic Workload Scaling Overview
Note
The ACE Dynamic Workload Scaling feature permits on-demand access to remote resources, such as VMs, that you own or lease from an Internet service provider or cloud service provider. This feature uses Cisco Nexus 7000 series switches with OTV to create a Data Center Interconnect (DCI) on a Layer 2 link over an existing IP network between geographically distributed data centers (see Figure 1-1). The local data center Nexus 7000 contains an OTV forwarding table that lists the MAC addresses of the Layer 2 extended virtual private network (VPN) and identifies the addresses as either local or remote.
When you configure the ACE for Dynamic Workload Scaling, the ACE uses an XML query to poll the Nexus 7000 and obtain the OTV forwarding table information to determine the locality of the VMs (local or remote). The ACE also uses a health monitor probe that it sends to the local VMware vCenter Server to monitor the load of the local VMs based on CPU usage, memory usage, or both. When the average CPU and/or memory usage of the local VMs reaches its configured maximum threshold value, the ACE bursts traffic to the remote VMs. The ACE stops bursting traffic to the remote VMs when local VM usage drops below its configured minimum threshold value.
To use Dynamic Workload Scaling, you configure the ACE to connect to the Data Center Interconnect device (Cisco Nexus 7000 series switch) and the VMware Controller associated with the local and remote VMs. You also configure the ACE with the probe type VM to monitor a server farm's local VM CPU and memory usage, which determines when the ACE bursts traffic to the remote VMs (see the "Configuring Dynamic Workload Scaling" section).
For more details on this feature, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.
Server Farms
Typically, in data centers, servers are organized into related groups called server farms. Servers within server farms often contain identical content (referred to as mirrored content) so that if one server becomes inoperative, another server can take its place immediately. Also, having mirrored content allows several servers to share the load of increased demand during important local or international events, such as the Olympic Games. This phenomenon of a sudden large demand for content is called a flash crowd.
After you create and name a server farm, you can add existing real servers to it and configure other server farm parameters, such as the load-balancing predictor, server weight, backup server, health probe, and so on. For a listing and brief description of load-balancing predictors, see the "Load-Balancing Predictors" section.
Related Topics
Configuring Real Servers
Real servers are dedicated physical servers that are typically configured in groups called server farms. These servers provide services to clients, such as HTTP or XML content, streaming media (video or audio), TFTP or FTP services, and so on. When configuring real servers, you assign names to them and specify IP addresses, connection limits, and weight values.
The ACE uses traffic classification maps (class maps) within policy maps to filter specified traffic and to apply specific actions to that traffic based on the load-balancing configuration. A load-balancing predictor algorithm (such as round-robin or least connections) determines the servers to which the ACE sends connection requests. For information about configuring class maps, see the "Configuring Virtual Context Class Maps" section on page 13-6.
This section includes the following topics:
•
•
Configuring Load Balancing on Real Servers
You can configure load balancing on real servers.
Procedure
Step 1
The Real Servers table appears.
Step 2
Step 3
The Real Servers configuration window appears.
Step 4
Table 7-1 Real Server Attributes
Name
Field that allows you to either enter a unique name for this server or accept the automatically incremented value in this field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.
Type
Type of server:
•
•
State
State of the real server:
•
•
Description
Brief description for this real server. Valid entries are strings of up to 240 characters. Spaces and special characters are allowed.
IP Address
Field that appears for only real servers specified as hosts.
Enter a unique IP address in dotted-decimal format (such as 192.168.11.1). The IP address cannot be an existing virtual IP address (VIP).
Fail-On-All
Field that appears only for real servers identified as host servers.
By default, real servers with multiple probes configured for them have an OR logic associated with them, which means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state.
Check this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic).
The Fail-On-All function is applicable to all probe types.
Min. Connections
Minimum number of connections to be allowed on this server before the ACE starts sending connections again after it has exceeded the Max. Connections limit. This value must be less than or equal to the Max. Connections value. By default, this value is equal to the Max. Connections value. Valid entries are from 2 to 4000000.
Max. Connections
Maximum number of active connections allowed on this server. When the number of connections exceeds this value, the ACE stops sending connections to this server until the number of connections falls below the Min. Connections value. Valid entries are from 2 to 4000000, and the default is 4000000.
Weight
Field that appears only for real servers identified as hosts.
Enter the weight to be assigned to this real server in a server farm. Valid entries are from 1 to 100, and the default is 8.
Probes
Field that appears only as follows:
•
•
–
–
The redirect real server Available probe list contains only configured probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the "Configuring Health Monitoring for Real Servers" section).
In the Probes field, choose the probes to use for health monitoring in the Available Items list, and click Add. The probes appear in the Selected Items list.
Note
To remove probes that you do not want to use for health monitoring, choose them in the Selected Items list, and click Remove. The probes appear in the Available probe list.
Web Host Redirection
URL string used to redirect requests to another server. This field appears only for real servers identified as redirect servers. Enter the URL and port used to redirect requests to another server.
Valid entries are in the form http://host.com:port where host is the name of the server and port is the port to be used. Valid host entries are unquoted text strings with no spaces and a maximum of 255 characters. Valid port numbers are from 1 to 65535.
The relocation string supports the following special characters:
•
•
Redirection Code
Field that appears only for real servers identified as redirect servers.
Choose the appropriate redirection code:
•
•
•
Rate Bandwidth
Bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions.
Specify the real server bandwidth limit in bytes per second. Valid entries are from 2 to 300000000. The default is 300000000.
Rate Connection
Connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server.
Specify the limit for connections per second. Valid entries are from 2 to 350000. The default is 350000.
Step 5
•
•
•
Step 6
Related Topics
•
•
Displaying Real Server Statistics and Status Information
You can display statistics and status information for a particular real server.
Procedure
Step 1
The Real Servers table appears.
Step 2
The show rserver name detail CLI command output appears. For details on the displayed output fields, see either the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 2, Configuring Real Servers and Server Farms.
Step 3
Step 4
Related Topics
Managing Real Servers
This section shows how to display and manage the real servers from the Real Servers window (Config > Operations > Real Servers). This window provides you with information about each real server configured on ANM (see the "Displaying Real Servers" section) and provides access to function buttons that allow you to perform tasks such as activate or suspend a real server, display a real server topology map, or display connection statistics graphs.
This section includes the following topics:
•
•
•
Activating Real Servers
You can activate a real server.
Procedure
Step 1
The Real Servers table appears.
Step 2
The Activate Server window appears.
Step 3
You might enter a trouble ticket, an order ticket, or a user message.
Note
Step 4
•
•
Related Topics
•
•
Suspending Real Servers
You can suspend a real server.
Procedure
Step 1
The Real Servers table appears.
Step 2
The Suspend Real Servers window appears.
Step 3
You might enter a trouble ticket, an order ticket, or a user message.
Note
Step 4
•
•
•
Note
Note
To allow ANM to save and reset the weight value when gracefully suspending and then activating the CSM, you must have the device configured to permit SNMP traffic. For each device type, see the corresponding configuration guide to configure the device to permit SNMP traffic.
When the CSM is in the In Service Standby admin state and you perform a graceful suspend operation, ANM does not set the weight to zero.Step 5
•
•
Related Topics
•
•
Modifying Real Servers
You can modify server weight and connection limits for real servers.
Procedure
Step 1
The Real Servers table appears.
Step 2
The Change Weight Real Servers window appears.
Step 3
•
Note
•
Step 4
•
•
Related Topics
•
•
Displaying Real Servers
You can display all real servers by choosing Config > Operations > Real Servers. The Real Servers table appears.
Note
Table 7-2 describes the Real Servers table information.
Table 7-2 Real Server Table Fields
Name
Real server name.
IP address
Real server IP address.
Port
Port used to by the real server for communications.
VM
Virtual machine indicator that specifies if the real server is a VMware vCenter Server virtual machine (Yes) or is not a virtual machine (-).
If the indicator state is Yes, you can click this link to open the Virtual Machine Details pop-up window to display statistical information about the VM. ANM polls the VM on a regular basis to update the displayed information.
Click OK to close the pop-up and return to the Real Servers table.
Vservers
Associated virtual servers.
HA
Indicator that specifies that the real server is part of a high availability pair. The table displays HA pair real servers together in the same row so that they remain together no matter how you sort the information.
SLB Device
Name of the server load-balancing device.
Admin
Administrative state of the real server: In Service, Out Of Service, or In Service Standby.
Oper
Operational state of the real server (see Table 7-3 for descriptions of real server operational states).
Note
Conn
Number of current connections.
Wt
Current server weight.
Locality
Item that pertains only to ACE software version A4(2.0) or later release on either device type (appliance or module). Locality also requires that you have the ACE configured for Dynamic Workload Scaling (see the "Configuring Dynamic Workload Scaling" section).
Location of the real server, which must be a VM and not a physical server. Possible locality states are as follows:
•
•
•
Stat Age
Age of the statistical information.
Server Farm
Associated server farm.
To identify any SNMP-related issues, select the real server's virtual context in the object selector. If there are problems with SNMP, SNMP status appears in the upper right above the content pane.
Table 7-3 Real Server Operational States
Failed
Server has failed and will not be retried for the amount of time specified by its retry timer.
Inband probe failed
Server has failed the inband Health Probe agent.
Inservice
Server is in use as a destination for server load balancing client connections.
Inservice standby
Server is the backup real server, which remains inactive unless the primary real server fails.
Operation wait
Server is ready to become operational but is waiting for the associated redirect virtual server to be in service.
Out of service
Server is not in use by a server load balancer as a destination for client connections.
Probe failed
Server load-balancing probe to this server has failed. No new connections will be assigned to this server until a probe to this server succeeds.
Probe testing
Server has received a test probe from the server load balancer.
Ready to test
Server has failed and its retry timer has expired; test connections will begin flowing to it soon.
Return code failed
Server has been disabled because it returned an HTTP code that matched a configured value.
Test wait
Server is ready to be tested. This state is applicable only when the server is used for HTTP redirect load balancing.
Testing
Server has failed and has been given another test connection. The success of this connection is not known.
Throttle: DFP
DFP has lowered the weight of the server to throttle level; no new connections will be assigned to the server until DFP raises its weight.
Throttle: max clients
Server has reached its maximum number of allowed clients.
Throttle: max connections
Server has reached its maximum number of connections and is no longer being given connections.
Unknown
State of the server is not known.
Related Topics
•
•
•
•
Using the Real Server Connection Statistics Graph
You can display real time and historical statistical information about the connections of a real server. ANM displays the information in graph or chart form. This feature also allows you to compare similar connection information across multiple real servers.
Procedure
Step 1
The Real Servers table appears.
Step 2
You can choose up to four real servers if you want to compare statistical data.
The Real Server Graph window appears, displaying the default graph for each selected real server. For details about using the graph feature, see "Configuring Historical Trend and Real Time Graphs for Devices" section on page 16-46.
Related Topics
•
Using the Real Server Topology Map
You can display the nodes on your network based on the real server that you select.
Procedure
Step 1
The Real Servers table appears.
Step 2
The ANM Topology map appears. The map includes several tools for navigating the network map and zooming in and out. For details about using the map tools, see the "Displaying Network Topology Maps" section on page 16-64.
Step 3
Related Topics
•
CLI Commands Sent from the Real Server Table
Table 7-4 displays the CLI commands dispatched to the device for a given Real Servers table option and is sorted by device type.
Server Weight Ranges
Table 7-5 displays the allowable server weight ranges by device type.
Table 7-5 Real Servers Table Server Weight Ranges
ACE Appliances and Modules
1 to 100
CSMs
0 to 100
CSS Devices
0 to 10
Configuring Dynamic Workload Scaling
Note
This section describes how to configure the ACE Dynamic Workload Scaling feature, which enables an ACE to burst traffic to a remote pool of VMs when the average CPU and/or memory usage of the local VMs has reached a specified maximum threshold value. When the usage drops below a specified minimum threshold value, the ACE stops bursting traffic to the remote VMs.
Dynamic Workload Scaling requires configuring an ACE with the following items:
•
•
•
•
Note
For more information about Dynamic Workload Scaling, see the "ANM Overview" section on page 1-1 and the "Dynamic Workload Scaling Overview" section.
Prerequisites
Dynamic Workload Scaling requires the following configuration elements:
•
•
•
•
•
This section includes the following topics:
•
•
Configuring and Verifying a Nexus 7000 Connection
Note
This procedure describes how to configure an ACE with the Nexus 7000 series switch attributes required to allow the ACE to communicate with the Nexus 7000 using SSH. The ACE uses the Nexus 7000 to obtain VM location information (local or remote).
Guidelines and Restrictions
Configure only one Nexus 7000 per ACE Admin context.
Procedure
Step 1
The Nexus 7000 Setup pane appears.
Step 2
Table 7-6 Nexus 7000 Setup Attributes
Name
Nexus 7000 name (see the Note at the beginning of this chapter for ACE object naming specifications).
Primary IP
Nexus 7000 XML interface IP address in dotted-decimal format (such as 192.168.11.1).
User Name
Username that the ACE uses for access and authentication on the Nexus 7000. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces.
Note
Password
Password that the ACE uses for authentication on the Nexus 7000. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces.
Reenter the password in the Confirm field.
Step 3
Note
Step 4
The ACE show nexus-device device_name detail CLI command output displays in a pop-up window and includes information such as the device name, IP address, and connection information. For more information about the command output, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.
Step 5
Caution
Related Topics•
•
•
•
•
Configuring and Verifying a VM Controller Connection
Note
This procedure describes how to configure an ACE with the VM Controller (VMware vCenter Server) attributes required to allow the ACE to communicate with the VM Controller to obtain local VM load information.
Guidelines and Restrictions
Configure only one VM Controller per ACE Admin context.
Prerequisites
The ACE is configured to communicate with the local Nexus 7000 that enables the ACE to discover the locality of the VM Controller VMs (see the "Configuring and Verifying a Nexus 7000 Connection" section).
Procedure
Step 1
The VM Controller Setup pane appears.
Step 2
Table 7-7 VM Controller Setup
Name
VM Controller name (see the Note at the beginning of this chapter for ACE object naming specifications).
URL
IP address or URL for the VM Controller web services API agent. The URL must point to the VM Controller software development kit (SDK). For example, https://1.2.3.4/sdk. Enter up to 255 characters.
User Name
Username that the ACE uses for access and authentication on the VM Controller. The user must have a read-only role at least or a role with a read privilege. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces.
Password
Password that the ACE uses for authentication on the VM Controller. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces.
Reenter the password in the Confirm field.
Step 3
Note
Step 4
The ACE show vm-controller device_name detail CLI command output displays in a pop-up window and includes information such as the VM Controller status, IP address, and connection information.
Step 5
Note
Related Topics•
•
•
•
•
Configuring Server Farms
You can configure load balancing using server farms, which are groups of networked real servers (physical servers and VMs) that contain the same content and that typically reside in the same physical location in a data center.
Note
Websites often include groups of servers configured in a server farm. Load-balancing software distributes client requests for content or services among the real servers based on the configured policy and traffic classification, server availability and load, and other factors. If one server goes down, another server can take its place and continue to provide the same content to the clients who requested it.
This section includes the following topics:
•
•
•
•
•
Configuring Load Balancing Using Server Farms
Procedure
Step 1
The Server Farms table appears.
Step 2
Step 3
The Server Farms configuration window appears.
Step 4
Table 7-8 Server Farm Attributes
Name
Unique name for this server farm or accept the automatically incremented value in this field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.
Type
Type of server farm as follows:
•
•
Description
Brief description for this server farm. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.
Fail Action
Action that the ACE is to take with respect to connections if any real server in the server farm fails:
•
•
•
Failaction Reassign Across Vlans
Option that is available only for the ACE module A2(3.0), ACE appliance A4(1.0), and later releases of either device type. This field appears only when the Fail Action is set to Reassign.
Check the check box to specify that the ACE reassigns the existing server connections to the backup real server on a different VLAN interface (commonly referred to as a bypass VLAN) if the real server fails. If a backup real server has not been configured for the failing server, this option has no effect and leaves the existing connections untouched in the failing real server.
Note the following configuration requirements and restrictions when you enable this option:
•
•
•
•
•
•
•
•
•
•
To minimize packet loss, we recommend the following probe parameter values on both ACEs: Interval: 2, Faildetect: 2, Passdetect interval: 2, and Passdetect count: 5.
Transparent
Field that appears only for host server farms.
Specify whether network address translation from the VIP address to the server IP is to occur. Check the check box to indicate that network address translation from the VIP address to the server IP address is to occur. Uncheck the check box to indicate that network address translation from the VIP address to the server IP address is not to occur.
Dynamic Workload Scaling
Option that is available only for ACE software version A4(2.0) or later release on either device type (appliance or module). Field that appears only for host server farms.
Allows the ACE to burst traffic to remote VMs when the average CPU or memory usage of the local VMs has reached its specified maximum threshold value. The ACE stops bursting traffic to the remote VMs when the average CPU or memory usage of the local VMs has dropped below its specified minimum threshold value. This option requires that you have the ACE configured for Dynamic Workload Scaling using a Nexus 7000, VM Controller, and VM probe (see the "Configuring Dynamic Workload Scaling" section).
Click one of the following radio button options:
•
•
•
When you choose Burst, the VM Probe Name field displays along with a list of available VM probes. Choose an available VM probe or click Add to display the Health Monitoring pop-up window and create or edit a VM probe (see the "Configuring Health Monitoring" section).
Fail-On-All
Field that appears only for host server farms.
By default, real servers that you configure in a server farm inherit the probes that you configure directly on that server farm. When you configure multiple probes on a server farm, the real servers in the server farm use an OR logic with respect to the probes, which means that if one of the probes configured on the server farm fails, all the real servers in that server farm fail and enter the PROBE-FAILED state. With AND logic, if one server farm probe fails, the real servers in the server farm remain in the operational state. If all the probes associated with the server farm fail, then all the real servers in that server farm fail and enter the PROBE-FAILED state.
Check this check box to configure the real servers in a server farm to use AND logic with respect to multiple server farm probes.
The Fail-On-All function is applicable to all probe types.
Inband-Health Check
Option that is available only for the ACE module A4(1.0), ACE appliance A4(1.0), and later releases of either device type. Field that appears only for host server farms.
By default, the ACE monitors the health of all real servers in a configuration through the use of ARPs and health probes. However, there is latency period between when the real server goes down and when the ACE becomes aware of the state. The inband health monitoring feature allows the ACE to monitor the health of the real servers in the server farm through the following connection failures:
•
•
When you configure the failure-count threshold and the number of these failures exceeds the threshold within the reset-time interval, the ACE immediately marks the server as failed, takes it out of service, and removes it from load balancing. The server is not considered for load balancing until the optional resume-service interval expires.
The Inband-Health Check attributes are as follows:
•
•
•
Connection Failure Threshold Count
This field appears only when the Inband-Health Check is set to Log or Remove.
Enter the maximum number of connection failures that a real server can exhibit in the reset-time interval before ACE marks the real server as failed. Valid entries are as follows:
•
•
Reset Timeout (Milliseconds)
This field appears only when the Inband-Health Check is set to Log or Remove.
Enter the number of milliseconds for the reset-time interval. Valid entries are integers from 100 to 300000. The default interval is 100.
This interval starts when the ACE detects a connection failure. If the connection failure threshold is reached during this interval, the ACE generates a syslog message. If you configure the remove keyword, the ACE also removes the real server from service.
Changing the setting of this option affects the behavior of the real server, as follows:
•
•
Resume Service (Seconds)
Field that appears only when the Inband-Health Check is set to Remove.
Enter the number of seconds after a server has been marked as failed to reconsider it for sending live connections. Valid entries are integers from 30 to 3600. The default setting is 0. The setting of this option affects the behavior of the real server in the inband failed state, as follows:
•
•
•
•
•
•
Partial-Threshold Percentage
Field that appears only for host server farms.
Enter the minimum percentage of real servers in the primary server farm that must remain active for the server farm to stay up. If the percentage of active real servers falls below this threshold, the ACE takes the server farm out of service. Valid entries are from 0 to 99. The default is 0.
Back Inservice
Field that appears only for host server farms.
Enter the percentage of real servers in the primary server farm that must be active again for the ACE to place the server farm back into service. Valid entries are from 0 to 99. The value in this field should be larger than the value in the Partial Threshold Percentage field. The default is 0.
Probes
Field that appears only as follows:
•
•
–
–
The redirect server farm Available probe list contains only probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the "Configuring Health Monitoring for Real Servers" section).
In the Available Items list, choose the probes to use for health monitoring, and click Add. The selected probes appear in the Selected Items list.
Note
To remove probes that you do not want to use for health monitoring, select them in the Selected Items list, and click Remove. The selected probes appear in the Available Items list.
Step 5
•
The window refreshes with additional configuration options:
–
–
–
•
•
Step 6
The show serverfarm name detail CLI command output appears. See the "Displaying Server Farm Statistics and Status Information" section for details.
Related Topics
•
•
•
•
•
Adding Real Servers to a Server Farm
You can add real servers to a server farm. After adding a server farm (see the "Configuring Server Farms" section), you can associate real servers with it and configure predictors and retcode maps. The options for these attributes appear after you have successfully added a new server farm.
Assumptions
This topic assumes the following:
•
•
Procedure
Step 1
The Server Farms table appears.
Step 2
The Real Servers table appears.
Step 3
The Real Servers configuration pane appears.
Step 4
Step 5
•
•
•
Related Topics
•
•
•
•
•
Configuring the Predictor Method for Server Farms
You can configure the predictor method for a server farm. The predictor method specifies how the ACE is to select a server in the server farm when it receives a client request for a service. After adding a server farm (see the "Configuring Server Farms" section), you can associate real servers with it and configure the predictor method and retcode maps. The options for these attributes appear after you have successfully added a new server farm.
Note
Assumptions
This topic assumes the following:
•
•
Procedure
Step 1
The Server Farms table appears.
Step 2
The Predictor configuration pane appears.
Step 3
Step 4
Table 7-10 Predictor Method Attributes
Hash Address
Server selection method that uses a hash value based on the source or destination IP address.
To configure the hash address predictor method, in the Mask Type field, indicate whether server selection is based on source IP address or the destination IP address as follows:
•
•
•
In the IP Netmask field, choose the subnet mask to apply to the address. If none is specified, the default is 255.255.255.255.
Hash Content
Server selection method that uses a hash value based on the specified content string of the HTTP packet body.
a.
Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 13-34 lists the supported characters that you can use for matching string expressions.
b.
Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 13-34 lists the supported characters that you can use for matching string expressions.
c.
The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000.
Note
d.
Hash Cookie
Server selection method that uses a hash value based on the cookie name.
In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters.
Hash Header
Server selection method that uses a hash value based on the header name.
In the Header Name field, choose the HTTP header to be used for server selection as follows:
•
•
Hash Layer4
Layer 4 generic protocol load-balancing method. Use this predictor to load balance packets from protocols that are not explicitly supported by the ACE.
a.
Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 13-34 lists the supported characters that you can use for matching string expressions.
b.
Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 13-34 lists the supported characters that you can use for matching string expressions.
c.
The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000.
Note
d.
Hash URL
Server selection method that uses a hash value based on the URL. Use this method to load balance firewalls.
Enter values in one or both of the pattern fields as follows:
•
•
Valid entries for these fields are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters for each pattern that you configure. The following special characters are also allowed: @ # $
Least Bandwidth
Server with the least amount of network traffic over a specified sampling period.
a.
b.
Least Connections
Server with the fewest number of connections.
In the Slow Start Duration (Seconds) field, enter the slow-start value to be applied to this predictor method. Valid entries are from 1 to 65535, where 1 is the slowest ramp-up value.
The slow-start mechanism is used to avoid sending a high rate of new connections to servers that you have just put into service.
Least Loaded
Least loaded server based on information from SNMP probes.
a.
b.
–
–
The maxload option requires the following ACE software versions:
- ACE appliance—A3(2.7) or A4(1.0) or later
- ACE module—A2(2.4), A2(3.2), or A4(1.0) or later
If you choose the maxload option and the ACE does not support the option, ANM issues a command parse error message.
–
c.
To instruct the ACE to select the server with the lowest load, use the predictor least-loaded command in server farm host or redirect configuration mode. With this predictor, the ACE uses SNMP probes to query the real servers for load parameter values (for example, CPU utilization or memory utilization). This predictor is considered adaptive because the ACE continuously provides feedback to the load-balancing algorithm based on the behavior of the real server.
To use this predictor, you must associate an SNMP probe with it. The ACE queries user-specified OIDs periodically based on a configurable time interval. The ACE uses the retrieved SNMP load value to determine the server with the lowest load.
The syntax of this predictor command is as follows:
predictor least-loaded probe name
The name argument specifies the identifier of the existing SNMP probe that you want the ACE to use to query the server. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
Least Loaded
(continued)For example, to configure the ACE to select the real server with the lowest load based on feedback from an SNMP probe called PROBE_SNMP, enter:
host1/Admin(config)#serverfarm SF1
host1/Admin(config-sfarm-host)#predictor least-loaded probe PROBE_SNMP
host1/Admin(config-sfarm-host-predictor)#To reset the predictor method to the default of round-robin, enter:
host1/Admin(config-sfarm-host)#no predictorResponse
Server selection method based on the lowest response time for a requested response-time measurement.
a.
–
–
–
b.
c.
Round Robin
Server selection method in which The ACE selects the next server in the list of servers based on server weight. This method is the default predictor.
Step 5
Related Topics
•
•
•
•
Configuring Server Farm HTTP Return Error-Code Checking
Note
You can configure HTTP return error-code checking (retcode map) for a server farm. After adding a server farm (see the "Configuring Server Farms" section), you can associate real servers with it and configure the predictor method and retcode maps. These options appear after you have successfully added a server farm.
Assumption
A host type server farm has been added to ANM (see the "Configuring Server Farms" section).
Procedure
Step 1
The Server Farms table appears.
Step 2
The Retcode Map table appears.
Step 3
The Retcode Map configuration pane appears.
Note
Step 4
Valid entries are from 100 to 599. This number must be less than or equal to the number in the Highest Retcode field.
Step 5
Valid entries are from 100 to 599. This number must be greater than or equal to the number in the Lowest Retcode field.
Step 6
Note
Step 7
•
•
•
Related Topics
•
•
•
•
•
Displaying All Server Farms
You can display all server farms associated with a virtual context.
Procedure
Step 1
The Virtual Contexts table appears.
Step 2
The Server Farms table appears with the following information:
•
•
•
•
•
•
You can click on any of the entries in the last three columns to view specific information about those entries.
Related Topics
•
•
•
•
•
Displaying Server Farm Statistics and Status Information
You can display statistics and status information for a particular server farm.
Procedure
Step 1
The Server Farms table appears.
Step 2
The show serverfarm name detail CLI command output appears. For details about the displayed output fields, see the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 2, Configuring Real Servers and Server Farms.
Step 3
The new information appears in a separate panel with a new timestamp; both the old and the new server farm statistics and status information appear side-by-side to avoid overwriting the last updated information.
Step 4
Related Topics
•
•
•
•
Configuring Health Monitoring
You can instruct the ACE to check the health of servers and server farms by configuring health probes (sometimes referred to as keepalives). After you create a probe, you assign it to a real server or a server farm. A probe can be one of many types, including TCP, ICMP, Telnet, HTTP, and so on. You can also configure scripted probes using the TCL scripting language (see the "TCL Scripts" section).
The ACE sends out probes periodically to determine the status of a server, verifies the server response, and checks for other network problems that may prevent a client from reaching a server. Based on the server response, the ACE can place the server in or out of service, and, based on the status of the servers in the server farm, it can make reliable load-balancing decisions.
Health monitoring on the ACE tracks the state of a server by sending out probes. Also referred to as out-of-band health monitoring, the ACE verifies the server response or checks for any network problems that can prevent a client to reach a server. Based on the server response, the ACE can place the server in or out of service, and can make reliable load-balancing decisions.
The ACE identifies the health of a server in the following categories:
•
•
By configuring the ACE for health monitoring, the ACE sends active probes periodically to determine the server state.
The ACE supports 4000 unique probe configurations which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE also allows the opening of 1000 sockets simultaneously.
This section includes the following topics:
•
•
•
•
•
•
•
TCL Scripts
The ACE supports several specific types of health probes (for example HTTP, TCP, or ICMP health probes) when you need to use a diverse set of applications and health probes to administer your network. The basic health probe types supported in the current ACE software release may not support the specific probing behavior that your network requires. To support a more flexible health-probing functionality, the ACE allows you to upload and execute Toolkit Command Language (TCL) scripts on the ACE.
The TCL interpreter code in the ACE is based on Release 8.44 of the standard TCL distribution. You can create a script to configure health probes. Script probes operate similar to other health probes available in the ACE software. As part of a script probe, the ACE executes the script periodically, and the exit code that is returned by the executing script indicates the relative health and availability of specific real servers. For information on health probes, see the "Configuring Health Monitoring for Real Servers" section.
For your convenience, the following sample scripts for the ACE are available to support the TCL feature and are supported by Cisco TAC:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
These scripts are located in the probe: directory and are accessible in both the Admin and user contexts. Note that the script files in the probe: directory are read-only, so you cannot copy or modify them. However, you can copy files from the probe: directory. For more information, see either the Cisco Application Control Engine Module Administration Guide or the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
To load a script into memory on the ACE and enable it for use, use the script file command. For detailed information on uploading and executing TCL scripts on the ACE, see either the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide.
Configuring Health Monitoring for Real Servers
You can establish monitoring of real servers to determine their viability in load-balancing decisions. To check the health and availability of a real server, the ACE periodically sends a probe to the real server. Depending on the server response, the ACE determines whether or not to include the server in its load-balancing decision.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The Health Monitoring window appears.
Step 3
Valid entries are text strings with a maximum of 64 characters.
Step 4
The probe type determines what the probe sends to the real server. See Table 7-12 for the types of probes and their descriptions.
Table 7-12 Probe Types
DNS
Sends a request to a DNS server giving it a configured domain. To determine if the server is up, the ACE must receive the configured IP address for that domain.
ECHO-TCP
Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE retries as configured before the server is marked as failed.
ECHO-UDP
Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE retries as configured before the server is marked as failed.
FINGER
Sends a probe to the server to verify that a defined username is a username on the server.
FTP
Initiates an FTP session. By default, this probe is for an anonymous login with the option of configuring a user ID and password. The ACE performs an FTP GET or LS to determine the outcome of the problem. This probe supports only active connections.
HTTP
Sets up a TCP connection and issues an HTTP request. Any valid HTTP response causes the probe to mark the real server as passed.
HTTPS
Similar to an HTTP probe, but this probe uses SSL to generate encrypted data.
ICMP
Sends an ICMP request and listens for a response. If the server returns a response, the ACE marks the real server as passed. If there is no response and times out, or an ICMP standard error occurs, such as DESTINATION_UNREACHABLE, the ACE marks the real server as failed.
IMAP
Initiates an IMAP session, using a configured user ID and password. Then, the probe attempts to retrieve email from the server and validates the result of the probe based on the return codes received from the server.
POP
Initiates a POP session, using a configured user ID and password. Then, the probe attempts to retrieve email from the server and validates the result of the probe based on the return codes received from the server.
RADIUS
Connects to a RADIUS server and logs into it to determine if the server is up.
RTSP
Establishes a TCP connection and sends a request packet to the server. The ACE compares the response with the configured response code to determine whether the probe succeeded.
Scripted
Executes probes from a configured script to perform health probing. This method allows you to author specific scripts with features not present in standard probes. For ACE appliances, the script probe file name must first be established on the device.
SIP-TCP
Establishes a TCP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.
SIP-UDP
Establishes a UDP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.
SMTP
Initiates an SMTP session by logging into the server.
SNMP
Establishes a UDP connection and sends a maximum of eight SMNP OID queries to probe the server. The ACE weighs and averages the load information that is retrieved and uses it as input to the least-loaded algorithm for load-balancing decisions. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed.
TCP
Initiates a TCP handshake and expects a response. By default, a successful response causes the probe to mark the server as passed. The probe then sends a FIN to end the session. If the response is not valid, or if there is no response, the probe marks the real server as failed.
TELNET
Establishes a connection to the real server and verifies that a greeting from the application was received.
UDP
Sends a UDP packet to a real server. The probe marks the server as failed only if an ICMP Port Unreachable messages is returned.
VM
This probe type requires the following:
•
•
Sends a probe to the VMware VM Controller to determine the average amount of both CPU and memory usage of its associated local VMs. The probe response determines whether the ACE load-balances traffic to the local VMs only or bursts traffic to the remote VMs due to high usage of the local VMs.
Note
Step 5
Note
Table 7-13 Health Monitoring General Attributes
Description
Description for this probe. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.
Probe Interval (Seconds)
Number of seconds that the ACE is to wait before sending another probe to a server marked as passed. Valid entries are from 2 to 65535 for all probe types except the VM probe, which has a range from 300 to 65535. The default values are as follows:
•
•
–
–
Note
Pass Detect Interval (Seconds)
Number of seconds that the ACE is to wait before sending another probe to a server marked as failed. Valid entries are from 2 to 65535. The default values are as follows:
•
•
–
–
Note
Fail Detect
Consecutive number of times that an ACE must detect that probes have failed to contact a server before marking the server as failed. Valid entries are from 1 to 65535. The default is 3.
Note
More Settings (Not applicable for the VM probe type)
Pass Detect Count
Number of successful probe responses from the server before the server is marked as passed. Valid entries are from 1 to 65535. The default is 3.
Receive Timeout (Seconds)
Number of seconds that the ACE is to wait for a response from a server that has been probed before marking the server as failed. Valid entries are from 1 to 65535. The default is 10.
Destination IP Address1
Preferred destination IP address. By default, the probe uses the IP address from the real or virtual server configuration for the destination IP address. To override the destination address that the probe uses, enter the preferred destination IP address in this field using dotted-decimal notation, such as 192.168.11.1.
Is Routed 2
Check box that indicates that the destination IP address is routed according to the ACE internal routing table. Uncheck the check box to indicate that the destination IP address is not routed according to the ACE internal routing table.
Port
By default, the precedence in which the probe inherits the port number is as follows:
•
•
•
•
If you explicitly configure a default port, the ACE always sends the probe to the default port. The probe does not dynamically inherit the port number from the real server in a server farm or from the VIP specified in the class map.
1 The Dest IP Address field is not applicable to the Scripted probe type.
2 The Is Routed field is not applicable to the RTSP, Scripted, SIP-TCP, and SIP-UDP probe types.
Step 6
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Step 7
•
•
•
Step 8
The show probe name detail CLI command output appears. See the "Displaying Health Monitoring Statistics and Status Information" section for details.
Related Topics
•
•
•
•
•
Configuring Probe Attributes
You can configure health monitoring probe-specific attributes.
This section includes the following topics:
Refer to the following topics for additional configuration options for health-monitoring probes:
•
•
•
•
•
DNS Probe Attributes
Table 7-15 lists the DNS probe attributes.
Note
Table 7-15 DNS Probe Attributes
Domain Name
Domain name that the probe is to send to the DNS server. Valid entries are unquoted text strings with a maximum of 255 characters.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
To configure expect addresses for DNS probes, see the "Configuring DNS Probe Expect Addresses" section.
Echo-TCP Probe Attributes
Table 7-16 lists the Echo-TCP probe attributes.
Note
Echo-UDP Probe Attributes
Table 7-17 lists the Echo-UDP probe attributes.
Note
Table 7-17 Echo-UDP Probe Attributes
Send Data
ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Finger Probe Attributes
Table 7-18 lists the Finger probe attributes.
Note
Table 7-18 Finger Probe Attributes
Send Data
ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
FTP Probe Attributes
Table 7-19 lists the FTP probe attributes.
Note
Table 7-19 FTP Probe Attributes
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535. The default is as follows:
•
•
To configure probe expect statuses for FTP probes, see the "Configuring Health Monitoring Expect Status" section.
HTTP Probe Attributes
Table 7-20 lists the HTTP probe attributes.
Note
Table 7-20 HTTP Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Request Method Type
Type of HTTP request method that is to be used for this probe.
Choose one of the following:
•
•
•
Request HTTP URL
Field that appears if you chose Head or Get in the Request Method Type field.
Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/".
More Settings
Is Connection
Check box to indicate that connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
User Name
User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password
Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Reenter the password in the Confirm field.
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Valid entries are from 1 to 4000.
Hash
Check box that indicates that the ACE is to use an MD5 hash for an HTTP GET probe. Uncheck the check box to indicate that the ACE should not use an MD5 hash for an HTTP GET probe.
Hash String
Field that appears if the Hash check box is selected.
Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state.
Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.
To configure probe headers and expect statuses for HTTP probes, see:
•
•
HTTPS Probe Attributes
Table 7-21 lists the HTTPS probe attributes.
Note
Table 7-21 HTTPS Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Request Method Type
Type of HTTP request method that is to be used for this probe.
Choose one of the following:
•
•
•
Request HTTP URL
Field that appears if you chose Head or Get in the Request Method Type field.
Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/'.
Cipher
Choose the cipher suite to be used with this HTTPS probe:
•
•
•
•
•
•
•
•
•
•
•
•
SSL Version
Version of SSL or TLS to be used in ClientHello messages sent to the server as follows:
•
•
•
By default, the probe sends ClientHello messages with an SSL version 3 header and a TLS version 1 message.
More Settings
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
User Name
User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password
Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Reenter the password in the Confirm field.
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000.
Hash
Check box that indicates that the ACE is to use an MD5 hash for an HTTP GET probe. Uncheck this check box to indicate that the ACE is not to use an MD5 hash for an HTTP GET probe.
Hash String
Field that appears if the Hash check box is selected.
Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state.
Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.
To configure probe headers and expect statuses for HTTPS probes, see:
•
•
IMAP Probe Attributes
Table 7-22 lists the IMAPprobe attributes.
Note
Table 7-22 IMAP Probe Attributes
User Name
User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password
Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Reenter the password in the Confirm field.
Mailbox Name
User mailbox name from which to retrieve email for this IMAP probe. Valid entries are unquoted text strings with a maximum of 64 characters.
Request Command
Request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
POP Probe Attributes
Table 7-23 lists the POP probe attributes.
Note
Table 7-23 POP Probe Attributes
User Name
User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password
Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Reenter the password in the Confirm field.
Request Command
Request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout
(seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
RADIUS Probe Attributes
Table 7-24 lists the RADIUS probe attributes.
Note
Table 7-24 RADIUS Probe Attributes
User Secret
Shared secret to be used to allow probe access to the RADIUS server. Valid entries are case-sensitive strings with no spaces and a maximum of 64 characters.
User Name
User identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password
Password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Reenter the password in the Confirm field.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
NAS IP Address
IP address of the Network Access Server (NAS) in dotted-decimal format, such as 192.168.11.1.
RTSP Probe Attributes
Table 7-25 lists the RTSP probe attributes.
Note
Table 7-25 RTSP Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
RTSP Require Header Value
Require header for the probe.
RTSP Proxy Require Header Value
Proxy-Require header for the probe.
RTSP Request Method Type
Request method type:
•
•
More Settings
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
To configure probe expect statuses for RTSP probes, see the "Configuring Health Monitoring Expect Status" section.
Scripted Probe Attributes
Table 7-26 lists the HTTP probe attributes.
Note
Table 7-26 Scripted Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Script Name
Local name that you want to assign to this file on the ACE. This file can reside in the disk0: directory or the probe: directory (if the probe: directory exists).
Note
Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
Script Arguments
Valid arguments, which are unquoted text strings with no spaces; separate multiple arguments with a space. The field limit is 255 characters.
More Settings
Script Needs To Be Copied From Remote Location?
Check box that indicates that the file needs to be copied from a remote server. Uncheck this check box to indicate that the script resides locally.
Protocol
Field that appears if the script is to be copied from a remote server.
Choose the protocol to be used for copying the script:
•
•
User Name
Field that appears if FTP is selected in the Protocol field.
Enter the name of the user account on the remote server.
Password
Field that appears if FTP is selected in the Protocol field.
Enter the password for the user account on the remote server.
Reenter the password in the Confirm field.
Source File Name
Field appears if the script is to be copied from a remote server.
Enter the host IP address, path, and filename of the file on the remote server in the format host-ip/path/filename where:
•
•
•
For example, your entry might be 192.168.11.2/usr/bin/my-script.ext.
SIP-TCP Probe Attributes
Table 7-27 lists the SIP-TCP probe attributes.
Note
Table 7-27 SIP-TCP Probe Attributes
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows
•
•
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000.
To configure probe expect statuses for SIP-TCP probes, see the "Configuring Health Monitoring Expect Status" section.
SIP-UDP Probe Attributes
Table 7-28 lists the SIP-UDP probe attributes.
Note
Table 7-28 SIP-UDP Probe Attributes
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000.
To configure probe expect statuses for SIP-UDP probes, see the "Configuring Health Monitoring Expect Status" section.
SMTP Probe Attributes
Table 7-29 lists the SMTP probe attributes.
Note
Table 7-29 SMTP Probe Attributes
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
To configure probe expect statuses for SMTP probes, see the "Configuring Health Monitoring Expect Status" section.
SNMP Probe Attributes
Table 7-30 lists the SNMP probe attributes.
Note
Table 7-30 SNMP Probe Attributes
SNMP Community
SNMP community string. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
SNMP Version
SNMP version for the probe:
•
•
•
To configure the SNMP OID for SNMP probes, see the "Configuring an OID for SNMP Probes" section.
TCP Probe Attributes
Table 7-31 lists the TCP probe attributes.
Note
Table 7-31 TCP Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Send Data
ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Is Connection
Check box that indicates that the connection parameters are configured. Uncheck the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000.
Telnet Probe Attributes
Table 7-32 lists the Telnet probe attributes.
Note
Table 7-32 Telnet Probe Attributes
More Settings
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection
Check box that indicates that the connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)
Enter the number of seconds to wait when opening a connection with a real server. Valid entries are from 1 to 65535. The default is as follows:
•
•
UDP Probe Attributes
Table 7-33 lists the UDP probe attributes.
Note
Table 7-33 UDP Probe Attributes
Port
Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Send Data
ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Expect Regular Expression
Expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset
Number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are from 1 to 4000.
VM Probe Attributes
Note
You configure the VM probe attributes to control when the ACE bursts traffic to remote VMs based on an average of local VM CPU usage, memory usage, or both. The ACE obtains the usage information by sending the VM probe to the specified VM Controller associated with the local VMs (see Figure 1-1). It calculates the average aggregate load information for all local VMs as a percentage of CPU usage or memory usage and uses either or both percentages to determine when to burst traffic to the remote data center. If the server farm consists of both physical servers and VMs, the ACE considers load information only from the VMs.
By default, the VM probe checks the percentage of usage for either the CPU or memory against the maximum threshold value. Whichever percentage reaches its maximum threshold value first causes the ACE to burst traffic to the remote data center. The default maximum burst threshold value of 99 percent instructs the ACE to always load balance traffic to the local VMs unless the load value is equal to 100 percent or the VMs are not in the Operational state. If you configure the maximum burst threshold value to 1 percent, the ACE always bursts traffic to the remote data center.
When the usage percentage is less than the minimum threshold value, the ACE stops bursting traffic to the remote data center and continues to load balance traffic to the local VMs. Any active connections to the remote data center are allowed to complete.
Table 7-34 lists the VM probe attributes.
Table 7-34 VM Probe Attributes
Max CPU Burst Threshold
Percentage of CPU usage by the local VMs at which the ACE begins to burst traffic to the remote VMs. Enter a value from 1 to 99. The default is 99.
Min CPU Burst Threshold
Percentage of CPU usage by the local VMs below which the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99. The default is 99.
Max Memory Burst Threshold
Percentage of memory usage by the local VMs at which the ACE begins to burst traffic to the remote VMs. Enter a value from 1 to 99. The default is 99.
Min Memory Burst Threshold
Percentage of memory usage by the local VMs below which the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99. The default is 99.
VM Controller Name
Identifier of the VM Controller that is associated with the local VMs and that you configured in the "Configuring and Verifying a VM Controller Connection" section. Click the radio button for the VM Controller.
To associate the VM probe with a server farm, see the "Configuring Server Farms" section.
Related Topics
•
•
Configuring DNS Probe Expect Addresses
You can specify the IP address that the ACE expects to receive in response to a DNS request. When a DNS probe sends a domain name resolve request to the server, it verifies the returned IP address by matching the received IP address with the configured addresses.
Assumption
A DNS probe has been configured. See the "Configuring Health Monitoring for Real Servers" section for more information.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The Expect Addresses table appears.
Step 3
The Expect Address configuration pane appears.
Note
Step 4
Valid entries are unique IP addresses in dotted-decimal notation, such as 192.168.11.1.
Step 5
•
•
•
Related Topics
•
•
Configuring Headers for HTTP and HTTPS Probes
You can specify header fields for HTTP and HTTPS probes.
Assumption
An HTTP or HTTPS probe has been configured. See the "Configuring Health Monitoring for Real Servers" section for more information.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The Probe Headers table appears.
Step 3
The Probe Headers configuration pane appears.
Step 4
Step 5
Valid entries are text strings with a maximum of 255 characters. If the string includes spaces, enclose the string with quotes.
Step 6
•
•
•
Related Topics
•
•
Configuring Health Monitoring Expect Status
You can configure a single or range of code responses that the ACE expects from the probe destination. When the ACE receives a response from the server, it expects a status code to mark a server as passed. By default, there are no status codes configured on the ACE. If you do not configure a status code, any response code from the server is marked as failed.
Expect status codes can be configured for FTP, HTTP, HTTPS, RTSP, SIP-TCP, SIP-UDP, and SMTP probes.
Assumption
An FTP, HTTP, HTTPS, RTSP, SIP-TCP, SIP-UDP or SMTP probe has been configured. See the "Configuring Health Monitoring for Real Servers" section for more information.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The Expect Status table appears.
Step 3
The Expect Status configuration pane appears.
Step 4
a.
b.
Step 5
a.
b.
Step 6
•
•
•
Related Topics
•
•
Configuring an OID for SNMP Probes
You can configure OID queries to probe the server. When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. Least-loaded load balancing bases the server selection on the server with the lowest load value. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed.
The ACE allows a maximum of eight OID queries to probe the server.
Assumption
An SNMP probe has been configured. See the "Configuring Health Monitoring for Real Servers" section for more information.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The SNMP OID for Server Load Query table appears.
Step 3
The SNMP OID configuration pane appears.
Step 4
Valid entries are unquoted strings with a maximum of 255 alphanumeric characters in dotted-decimal notation, such as .1.3.6.1.4.2021.10.1.3.1. The OID string is based on the server type.
Step 5
Valid entries are from 1 to 4294967295.
When the ACE sends a probe with an SNMP OID query, the ACE uses the retrieved value as input to the least-loaded algorithm for load-balancing decisions. By default, the ACE assumes that the retrieved OID value is a percentile value. Use this option to specify that the retrieved OID value is an absolute value.
Step 6
•
•
Step 7
Valid entries are from 0 to 16000.
Step 8
•
•
•
Related Topics
•
•
Displaying Health Monitoring Statistics and Status Information
You can display statistics and status information for a particular probe.
Procedure
Step 1
The Health Monitoring table appears.
Step 2
The show probe name detail CLI command output appears. For details on the displayed output fields, see the Cisco ACE Module Server Load-Balancing Configuration Guide or the Cisco ACE 4700 Series Appliance Server Load-Balancing Configuration Guide, Chapter 4, Configuring Health Monitoring.
Note
Step 3
Step 4
Related Topics
•
Configuring Secure KAL-AP
You can configure a secure keepalive-appliance protocol (KAL-AP) associated with a virtual context. A KAL-AP on the ACE enables communication between the ACE and a Global Site Selector (GSS), which sends KAL-AP requests to report the server states and loads for global-server load-balancing (GSLB) decisions. The ACE uses KAL-AP through a UDP connection to calculate weights and provide information for server availability to the KAL-AP device. The ACE acts as a server and listens for KAL-AP requests. When KAL-AP is initialized on the ACE, the ACE listens on the standard 5002 port for any KAL-AP requests. You cannot configure any other port.
The ACE supports secure KAL-AP for MD5 encryption of data between it and the GSS. For encryption, you must configure a shared secret as a key for authentication between the GSS and the ACE context.
Assumptions
This topic assumes the following:
•
•
Procedure
Step 1
The Secure KAL-AP table appears.
Step 2
The Secure KAL-AP configuration window appears.
Step 3
Enter the IP address in dotted-decimal notation (for example, 192.168.11.1).
Step 4
Enter the shared secret as a case-sensitive string with no spaces and a maximum of 31 alphanumeric characters. The ACE supports the following special characters in a shared secret:
, . / = + - ^ @ ! % ~ # $ * ( )
Step 5
•
•
•
Related Topics
•
•
