Device Manager GUI Guide vA5(1.0) and vA5(1.2), Cisco ACE 4700 Series Application Control Engine Appliance

•Configuring Virtual Servers

•Configuring Secure KAL-AP

Server Load Balancing Overview

Server load balancing (SLB) is the process of deciding to which server a load-balancing device should send a client request for service. For example, a client request can consist of an HTTP GET for a Web page or an FTP GET to download a file. The job of the load balancer is to select the server that can successfully fulfill the client request and do so in the shortest amount of time without overloading either the server or the server farm as a whole.

Depending on the load-balancing algorithm or predictor that you configure, the ACE appliance performs a series of checks and calculations to determine the server that can best service each client request. The ACE appliance bases server selection on several factors, including the server with the fewest connections with respect to load, source or destination address, cookies, URLs, or HTTP headers.

The ACE Device Manager allows you to configure load balancing using:

•Virtual servers—See Configuring Virtual Servers.

•Real servers—See Configuring Real Servers.

•Dynamic Workload Scaling—See Configuring Dynamic Workload Scaling.

•Server farms—See Configuring Server Farms.

•Sticky groups—See Configuring Sticky Groups.

•Parameter maps—See Configuring Parameter Maps.

For information about SLB as configured and performed by the ACE appliance, see:

•Load-Balancing Predictors

•Real Servers

•Dynamic Workload Scaling Overview

•Server Farms

•TCL Scripts

•Configuring Stickiness

Load-Balancing Predictors

The ACE appliance uses the following predictors to select the best server to satisfy a client request:

•Hash Address—Selects the server using a hash value based on either the source or destination IP address, or both. Use these predictors for firewall load balancing (FWLB).

Note FWLB allows you to scale firewall protection by distributing traffic across multiple firewalls on a per-connection basis. All packets belonging to a particular connection must go through the same firewall. The firewall then allows or denies transmission of individual packets across its interfaces. For more information about configuring FWLB on the ACE appliance, see the Server Load-Balancing Guide, Cisco ACE Application Control Engine.

•Hash Content— Selects the server by using a hash value based on the specified content string of the HTTP packet body

•Hash Cookie—Selects the server using a hash value based on a cookie name.

•Hash Secondary Cookie—The ACE selects the server by using the hash value based on the specified cookie name in the URL query string, not the cookie header.

•Hash Header—Selects the server using a hash value based on the HTTP header name.

•Hash Layer4—Selects the server using a Layer 4 generic protocol load-balancing method.

•Hash URL—Selects the server using a hash value based on the requested URL.You can specify a beginning pattern and an ending pattern to match in the URL. Use this predictor method to load-balance cache servers. Cache servers perform better with the URL hash method because you can divide the contents of the caches evenly if the traffic is random enough. In a redundant configuration, the cache servers continue to work even if the active ACE appliance switches over to the standby ACE appliance. For information about configuring redundancy, see Configuring High Availability.

•Least Bandwidth—Selects the server with the least amount of network traffic or a specified sampling period. Use this type for server farms with heavy traffic, such as downloading video clips.

•Least Connections—Selects the server with the fewest number of active connections based on server weight. For the least connection predictor, you can configure a slow-start mechanism to avoid sending a high rate of new connections to servers that you have just put into service.

•Least Loaded—Selects the server with the lowest load as determined by information from SNMP probes.

•Response—Selects the server with the lowest response time for a specific response-time measurement.

•Round Robin—Selects the next server in the list of real servers based on server weight (weighted roundrobin). Servers with a higher weight value receive a higher percentage of the connections. This is the default predictor.

Note The different hash predictor methods do not recognize the weight value that you configure for real servers. The ACE uses the weight that you assign to real servers only in the round-robin and least-connections predictor methods.

Real Servers

To provide services to clients, you configure real servers on the ACE appliance. Real servers are dedicated physical servers or VMware virtual machines (VMs) that you configure in groups called server farms.

Note VMs that you define as real servers are VMs that the ACE recognizes when configured for Dynamic Workload Scaling (see "Configuring Dynamic Workload Scaling" section).

These servers provide client services such as HTTP or XML content, Web site hosting, FTP file uploads or downloads, redirection for Web pages that have moved to another location, and so on. You identify real servers with names and characterize them with IP addresses, connection limits, and weight values. The ACE appliance also allows you to configure backup servers in case a server is taken out of service for any reason.

After you create and name a real server on the ACE appliance, you can configure several parameters, including connection limits, health probes, and weight. You can assign a weight to each real server based on its relative importance to other servers in the server farm. The ACE appliance uses the server weight value for the weighted round-robin and the least-connections load-balancing predictors. The load-balancing predictor algorithms (for example, round-robin, least connections, and so on) determine the servers to which the ACE appliance sends connection requests. For a listing and brief description of the load-balancing predictors, see Load-Balancing Predictors.

The ACE appliance uses traffic classification maps (class maps) within policy maps to filter out interesting traffic and to apply specific actions to that traffic based on the SLB configuration. You use class maps to configure a virtual server address and definition.

If a primary real server fails, the ACE appliance takes that server out of service and no longer includes it in load-balancing decisions. If you configured a backup server for the real server that failed, the ACE appliance redirects the primary real server connections to the backup server. For information about configuring a backup server, see the Configuring Virtual Server Layer 7 Load Balancing.

The ACE appliance can take a real server out of service for the following reasons:

•Probe failure

•ARP timeout

•Neighbor Discovery (ND) failure (IPv6 only)

•Retcode failure

•Reaching the maximum number of connections

•Specifying Out Of Service as the administrative state of a real server

•Specifying In Service Standby as the administrative state of a real server

The Out Of Service and In Service Standby selections both provide the graceful shutdown of a server.

Related Topics

•Configuring Health Monitoring for Real Servers

Dynamic Workload Scaling Overview

The ACE Dynamic Workload Scaling feature permits on-demand access to remote resources, such as VMs, that you own or lease from an Internet service provider or cloud service provider. This feature uses Cisco Nexus 7000 series switches with Overlay Transport Virtualization (OTV) technology to create a Data Center Interconnect (DCI) on a Layer 2 link over an existing IP network between geographically distributed data centers. The local data center Nexus 7000 contains an OTV forwarding table that lists the MAC addresses of the Layer 2 extended virtual private network (VPN) and identifies the addresses as either local or remote.

When you configure the ACE to use this feature, the ACE uses an XML query to poll the Nexus 7000 and obtain the OTV forwarding table information to determine the locality of the local or remote VMs. The ACE also uses a health monitor probe that it sends to the local VMware vCenter Server to monitor the load of the local VMs based on CPU usage, memory usage, or both. When the average CPU or memory usage of the local VMs reaches its configured maximum threshold value, the ACE bursts traffic to the remote VMs. The ACE stops bursting traffic to the remote VMs when the average CPU or memory usage of the local VMs drops below its configured minimum threshold value.

To use Dynamic Workload Scaling, you configure the ACE to connect to the Data Center Interconnect device (Cisco Nexus 7000 series switch) and the VMware Controller associated with the local and remote VMs. You also configure the ACE with the probe type VM to monitor a server farm's local VM CPU and memory usage, which determines when the ACE bursts traffic to the remote VMs.

For more details on this feature, see the Server Load-Balancing Guide, Cisco ACE Application Control Engine.

Related Topics

Server Farms

Typically, in data centers, servers are organized into related groups called server farms. Servers within server farms often contain identical content (referred to as mirrored content) so that if one server becomes inoperative, another server can take its place immediately. Also, having mirrored content allows several servers to share the load of increased demand during important local or international events, such as the Olympic Games. This phenomenon of a sudden large demand for content is called a flash crowd.

After you create and name a server farm, you can add existing real servers to it and configure other server farm parameters, such as the load-balancing predictor, server weight, backup server, health probe, and so on. For a listing and brief description of load-balancing predictors, see Load-Balancing Predictors.

Configuring Real Servers

Real servers are dedicated physical servers that are typically configured in groups called server farms. These servers provide services to clients, such as HTTP or XML content, streaming media (video or audio), TFTP or FTP services, and so on. When configuring real servers, you assign names to them and specify IP addresses, connection limits, and weight values.

The ACE appliance uses traffic classification maps (class maps) within policy maps to filter specified traffic and to apply specific actions to that traffic based on the load-balancing configuration. A load-balancing predictor algorithm (round-robin or least connections) determines the servers to which the ACE appliance sends connection requests. For information about configuring class maps, see Configuring Virtual Context Class Maps.

Use this procedure to configure load balancing on real servers.

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Real Servers. The Real Servers table appears.

Step 2 Click Add to add a new real server, or select a real server you want to modify, then click Edit. The Real Servers configuration screen appears.

Step 3 Configure the server using the information in Table 6-1.

Table 6-1 Real Server Attributes
Field	Description
Name	Either accept the automatically incremented value in this field, or enter a unique name for this server. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.
Type	Select the type of server: •Host—Indicates that this is a typical real server that provides content and services to clients. •Redirect—Indicates that this server is used to redirect traffic to a new location.
State	Select the state of this real server: •In Service—The real server is in service. •Out Of Service—The real server is out of service.
Description	Enter a brief description for this real server. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.
IP Address Type	These selections appear for only real servers specified as hosts. Select the IP address type of this real server: •IPv6—The real server has an IPv6 address. •IPv4—The real server has an IPv4 address.
IPv6/IPv4 Address	This field appears for only real servers specified as hosts. Enter a unique IP address as indicated by the IP Address Type field. The IP address cannot be of an existing virtual IP address (VIP), real server or interface in the context.
Fail-On-All	This field appears only for real servers identified as host servers. By default, real servers with multiple probes configured for them have an OR logic associated with them. This means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state. Click this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic). The Fail-On-All function is applicable to all probe types.
Min. Connections	Enter the minimum number of connections to be allowed on this server before the ACE appliance starts sending connections again after it has exceeded the Max. Connections limit. This value must be less than or equal to the Max. Connections value. By default, this value is equal to the Max. Connections value. Valid entries are integers from 1 to 4000000.
Max. Connections	Enter the maximum number of active connections allowed on this server. When the number of connections exceeds this value, the ACE appliance stops sending connections to this server until the number of connections falls below the Min. Connections value. Valid entries are integers from 1 to 4000000, and the default is 4000000.
Weight	This field appears only for real servers identified as hosts. Enter the weight to be assigned to this real server in a server farm. Valid entries are integers from 1 to 100, and the default is 8.
Web Host Redirection	URL string used to redirect requests to another server. This field appears only for real servers identified as redirect servers. Enter the URL and port used to redirect requests to another server. Valid entries are in the form http://host.com:port where host is the name of the server and port is the port to be used. Valid host entries are unquoted text strings with no spaces and a maximum of 255 characters. Valid port numbers are from 1 to 65535. The relocation string supports the following special characters: •%h—Inserts the hostname from the request Host header •%p—Inserts the URL path string from the request
Redirection Code	This field appears only for real servers identified as redirect servers. Select the appropriate redirection code: •N/A—Indicates that the webhost redirection code is not defined. •301—Indicates that the requested resource has been moved permanently. For future references to this resource, the client should use one of the returned URIs. •302—Indicates that the requested resource has been found, but has been moved temporarily to another location. For future references to this resource, the client should use the request URI because the resource may be moved to other locations from time to time.
Probes	In the Probes field, select the probes that are to be used for health monitoring in the list on the left, then click Add. The selected probes appear in the list on the right. Note The probe must have the same IP address type (IPv6 or IPv4) as the real server. For example, you cannot configure an IPv6 probe to an IPv4 real server. The redirect real server probe list contains only configured probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the "Configuring Health Monitoring for Real Servers" section). Note The Probes field list on the left does not display the VM probe type. To remove probes that you do not want to use for health monitoring, select them in the list on the right, then click Remove. The selected probes appear in the list on the left.
Rate Bandwidth	The bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions. Specify the real server bandwidth limit in bytes per second. Valid entries are integers from 1 to 300000000.
Rate Connection	The connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server. Specify the limit for connections per second. Valid entries are integers from 1 to 350000.

Step 4 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit the procedure without saving your entries and to return to the Real Servers table.

•The Add another icon to save your entries and to configure another real server.

Step 5 To display statistics and status information for an existing real server, choose a real server from the Real Servers table, then click Details. The show rserver name detail CLI command output appears. See the "Displaying Real Server Statistics and Status Information" section for details.

Displaying Real Server Statistics and Status Information

You can display statistics and status information for a particular real server.

Procedure

Step 1 Choose Config > Virtual Contexts > context > Load Balancing > Real Servers.

The Real Servers table appears.

Step 2 In the Real Servers table, choose a real server from the Real Servers table, and click Details.

The show rserver name detail CLI command output appears. For details on the displayed output fields, see the Server Load-Balancing Guide, Cisco ACE Application Control Engine, Chapter 2, Configuring Real Servers and Server Farms.

Step 3 Click Update Details to refresh the output for the show rserver name detail CLI command. The new information appears in a separate panel with a new timestamp; both the old and the new real server statistics and status information appear side-by-side to avoid overwriting the last updated information.

Step 4 Click Close to return to the Real Servers table.

Related Topics

Managing Real Servers

The Real Servers table (Config > Operations > Real Servers) provides the following information by default for each server:

•Server name

•IP address

•Port

•Associated virtual server

•Associated virtual context

•Admin State (In Service, Out Of Service, or In Service Standby)

•Operational state (See Table 6-3 for descriptions of real server operational states.)

•Number of current connections

•Current server weight

•Locality

•Stat Age, time as the page load since the SNMP values were polled

•Associated server farm

In the table, Disabled indicates that either the information is not available from the database or that it is not being collected via SNMP. To identify any SNMP-related issues, select the real server's virtual context in the object selector. If there are problems with SNMP, SNMP status will appear in the upper right above the content pane.

The following options are available from the Real Servers table:

•Suspending Real Servers

•Modifying Real Servers

Activating Real Servers

Use this procedure to activate a real server.

Procedure

Step 1 Select Config > Operations > Real Servers. The Real Servers table appears.

Step 2 Select the servers that you want to activate, then click Activate. The Activate Server screen appears.

Step 3 In the Task field, confirm that this is the server that you want to activate.

Step 4 In the Reason field, enter a reason for this action. You might enter a trouble ticket, an order ticket, or a user message. Do not enter a password in this field.

Step 5 Click:

•Deploy Now to deploy this configuration and to return to the Real Servers table. The server appears in the table with the status Inservice.

•Cancel to exit this procedure without activating the server and to return to the Real Servers table.

Related Topics

•Suspending Real Servers

Suspending Real Servers

Use this procedure to suspend a real server.

Procedure

Step 1 Select Config > Operations > Real Servers. The Real Servers table appears.

Step 2 Select the server that you want to suspend, then click Suspend. The Suspend Server screen appears.

Step 3 In the Reason field, enter the reason for this action. You might enter a trouble ticket, an order ticket, or a user message. Do not enter a password in this field.

Step 4 Select one of the following from the Type drop down menu:

•Graceful

•Suspend

•Suspend and Clear Connections to clear the existing connections to this server as part of the shutdown process

Step 5 Click:

•Deploy Now to deploy this configuration and to return to the Real Servers table. The server appears in the table with the status Out Of Service.

•Cancel to exit this procedure without suspending the server and to return to the Real Servers table.

Related Topics

Modifying Real Servers

Use this procedure to modify weight and connection limits for real servers.

Procedure

Step 1 Select the servers whose configuration you want to modify, then click Change Weight below the table to the right of Activate and Suspend. The Change Weight Real Servers window appears.

Step 2 Enter the following information for the selected server:

•Reason for change—Such as trouble ticket, order ticket or user message. Do not enter a password in this field.

•Weight—Select a value from 1 to 100.

Step 3 Click:

•Deploy Now to accept your entries and to return to the Real Servers table. The server appears in the table with the updated information.

•Cancel to exit this procedure without saving your entries and to return to the Real Servers table.

Related Topics

Viewing All Real Servers

To view all real servers, select Config > Operations > Real Servers. The Real Servers table displays the following information in Table 6-2 by default:

Table 6-2 Real Server Table Fields
Item	Description
Name	Real server name.
IP address	Real server IP address.
Port	Port used to by the real server for communications.
Vservers	Associated virtual server.
Context	Associated virtual context.
Admin	Administrative state of the real server: In Service, Out Of Service, or In Service Standby.
Oper	Operational state of the real server (see Table 6-3 for descriptions of real server operational states).
Conn	Number of current connections.
Wt	Current server weight.
Locality	Locality requires that you configure the Dynamic Workload Scaling on the ACE (see the "Configuring Dynamic Workload Scaling" section). Location of the real server, which must be a VM and not a physical server. Possible locality states are as follows: •N/A—he ACE cannot determine the real server location (local or remote). A possible cause for this issue is that Dynamic Workload Scaling is not configured correctly. •Local—The real server is located in the local network. •Remote—The real server is located in the remote network. The ACE bursts traffic to this server when the CPU or memory usage of the local real server reaches the specified maximum threshold value.
Stat Age	Time as of the page load when the SNMP values were polled.
Server Farm	Associated server farm.

Table 6-3 Real Server Operational States
State	Description
ARP Failed	An ARP request to this server has failed.
Failed	The server has failed and will not be retried for the amount of time specified by its retry timer.
Inactive	The server is disabled as it has become inactive such as in the case when the real server is not associated to any server farm.
Inband probe failed	The server has failed the inband Health Probe agent.
Inservice	The server is in use as a destination for server load balancing client connections.
Inservice standby	The server is in standby state. No connections will be assigned to it unless the primary server fails.
Max. Load	The server is under maximum load and cannot receive any additional connections.
ND Failed	For IPv6, Neighbor Discovery (ND) was unable to resolve the address of the real server.
Operation wait	The server is ready to become operational but is waiting for the associated redirect virtual server to be in service.
Out of service	The server is not in use by a server load balancer as a destination for client connections.
Probe failed	The server load-balancing probe to this server has failed. No new connections will be assigned to this server until a probe to this server succeeds.
Probe testing	The server has received a test probe from the server load balancer.
Ready to test	The server has failed and its retry timer has expired; test connections will begin flowing to it soon.
Return code failed	The server has been disabled because it returned an HTTP code that matched a configured value.
Test wait	The server is ready to be tested. This state is applicable only when the server is used for HTTP redirect load balancing.
Testing	The server has failed and has been given another test connection. The success of this connection is not known.
Throttle: DFP	DFP has lowered the weight of the server to throttle level; no new connections will be assigned to the server until DFP raises its weight.
Throttle: max clients	The server has reached its maximum number of allowed clients.
Throttle: max connections	The server has reached its maximum number of connections and is no longer being given connections.
Unknown	The state of the server is not known.

Related Topics

•Configuring and Verifying a Nexus 7000 Connection

•Suspending Real Servers

•Modifying Real Servers

Configuring Dynamic Workload Scaling

This section describes how to configure the ACE Dynamic Workload Scaling (DWS) feature. DWS enables an ACE to burst traffic to a remote pool of VMs when the average CPU or memory usage of the local VMs has reached a specified maximum threshold value. When the usage drops to a specified minimum threshold value, the ACE stops bursting traffic to the remote VMs. For more information about the Dynamic Workload Scaling feature, see the "Dynamic Workload Scaling Overview" section.

DWS requires configuring an ACE with the following:

•Nexus 7000 series switches—XML interface IP address of the local Cisco Nexus 7000 series switches that the ACE polls to obtain VM location information (local or remote).

Note With Device Manager software Version A5(1.2), you can specify up to two Nexus 7000 switches that the ACE is to poll. With Device Manager software Version A5(1.1), you can specify only one Nexus 7000 switch.

•VM Controller—IP address of the VM Controller (also known as VMware vCenter Server) that the ACE sends a health probe to monitor local VM load.

•VM probe—Probe that the ACE sends to the VM Controller to monitor local VM load based on CPU usage, memory usage, or both (see the "Configuring Health Monitoring" section).

•Server Farms—Groups of networked real servers (physical servers and VMs) that provide content delivery. See the "Configuring Server Farms" section.

Note To enable the ACE to use the VMs associated with DWS for load balancing, you must configure them as real servers on the ACE (see the "Configuring Real Servers" section).

Prerequisites

Dynamic Workload Scaling requires the following configuration elements:

•A Nexus 7000 series switch configured for DCI/OTV in the local data center and in the remote data center. For details about configuring a Nexus 7000 for DCI/OTV, see the Cisco Nexus 7000 NX-OS OTV Configuration Guide, Release 5.x.

•VMware vCenter Server 4.0 or later.

•Multiple local and remote VMs configured as real servers and associated with server farms configured on the ACE.

•ACE backend interface MTU set to 1430 or less to accommodate DCI encapsulation and the Don't Fragment (DF) bit is automatically set on the DCI link. For details about setting the ACE MTU, see the Routing and Bridging Guide, Cisco ACE Application Control Engine.

This section includes the following topics:

•Configuring and Verifying a VM Controller Connection

Configuring and Verifying a Nexus 7000 Connection

This procedure describes how to configure an ACE with the Nexus 7000 series switch attributes required to allow the ACE to communicate with the Nexus 7000 using SSH. The ACE uses the Nexus 7000 to obtain VM location information (local or remote).

You can also use this procedure to edit the attributes of an existing Nexus 7000 series switch profile or remove a switch profile.

Guidelines and Restrictions

Configure up to two Nexus 7000 series switches per ACE in the Admin context.

Procedure

Step 1 Choose Config > Virtual Contexts > Load Balancing > Dynamic Workload Scaling > Nexus 7000 Setup.

The Nexus 7000 Setup pane appears.

Note If existing Nexus 7000 series switch profiles already exist, the Name field lists their profile names in drop-down list on the right.

Step 2 From the Nexus 7000 Setup pane, do one of the following:

•Define a new Nexus 7000 series switch profile as follows:

a. From the Name field, click the text box radio button if it is not already selected and enter a Nexus 7000 name with a maximum of 64 characters. See the Note at the beginning of this chapter for ACE object naming specifications.

b. From the Primary IP filed, enter the Nexus 7000 XML interface IP address in dotted-decimal format (such as 192.168.11.1).

c. From the User Name field, enter the username that the ACE uses for access and authentication on the Nexus 7000. Valid entries are unquoted text strings with a maximum of 64 characters with no spaces.

Note The user must have either the vdc-admin or network-admin role to receive the Nexus 7000 output for the VM location information in XML format.

d. From the Password field, enter the password that the ACE uses for authentication on the Nexus 7000. Valid entries are unquoted text strings with a maximum of 64 characters with no spaces.

e. From the Confirm field, reenter the password and go to Step 3.

•Edit an existing Nexus 7000 series switch profile as follows:

a. From the Name field, click the radio button for the drop down list that contains the list of existing switch profile names.

b. From the drop down list, choose the switch profile to edit. The current profile attributes display.

c. Edit the profile fields as described in the procedure above for creating a new profile and go to Step 3.

Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entry to the running-configuration and startup-configuration files. If you specified a new switch profile, it is added to the drop down list located in the Name field.

Note Configuring the ACE for Dynamic Workload Scaling also requires configuring the ACE with the VM Controller information (see "Configuring and Verifying a VM Controller Connection" section) and configuring a VM health probe (see the "Configuring Health Monitoring" section).

Step 4 (Optional) Use the function buttons available from this window as follows:

•Click Details to verify connectivity between the ACE and the selected Nexus 7000 switch profile.

The ACE show nexus-device device_name detail CLI command output displays in a pop-up window and includes the device name, IP address, and connection information. For more information about the command output, see the Server Load-Balancing Guide, Cisco ACE Application Control Engine.

•Click Delete to delete the currently selected Nexus 7000 switch profile.

Caution

If the ACE is currently configured for Dynamic Workload Scaling, deleting a Nexus 7000 switch profile disables the feature if only one switch profile is defined.

•Dynamic Workload Scaling Overview

Configuring and Verifying a VM Controller Connection

This procedure describes how to configure an ACE with the VM Controller (VMware vCenter Server) attributes required to allow the ACE to communicate with the VM Controller to obtain local VM load information.

Guidelines and Restrictions

Configure only one VM Controller per ACE Admin context.

Prerequisites

The ACE is configured to communicate with the local Nexus 7000 that enables the ACE to discover the locality of the VM Controller VMs (see the "Configuring and Verifying a Nexus 7000 Connection" section).

Procedure

Step 1 Choose Config > Virtual Contexts > Load Balancing > Dynamic Workload Scaling > VM Controller Setup.

The VM Controller Setup pane appears.

Step 2 From the VM Controller Setup pane, define the VM Controller using the information in Table 6-4.

Table 6-4 VM Controller Setup
Field	Description
Name	VM Controller name (see the Note at the beginning of this chapter for ACE object naming specifications).
URL	IP address or URL for the VM Controller web services API agent. The URL must point to the VM Controller software development kit (SDK), for example, https://1.2.3.4/sdk). Enter a maximum of 255 characters.
User Name	Username that the ACE uses for access and authentication on the VM Controller. The user must have a read-only role at least or a role with a read privilege. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces.
Password	Password to be used for authentication on the VM Controller. Valid entries are unquoted text strings with a maximum of 64 characters and no spaces. Reenter the password in the Confirm field.

Step 3 Click Deploy Now to deploy this configuration on the ACE and save your entries to the running-configuration and startup-configuration files.

Note Configuring the ACE for Dynamic Workload Scaling also requires configuring the ACE with the Nexus 7000 information (see "Configuring and Verifying a Nexus 7000 Connection" section) and configuring a VM health probe (see the "Configuring Health Monitoring" section).

Step 4 (Optional) Click Details to verify connectivity between the ACE and the remote VM Controller.

The ACE show vm-controller device_name detail CLI command output displays in a pop-up window and includes VM Controller status, IP address, and connection information.

Step 5 (Optional) Click Delete to delete the currently configured VM Controller.

Note If the ACE is currently configured to use the Dynamic Workload Scaling, before you can delete the VM controller, you must delete the associated VM health probe (see the "Configuring Health Monitoring" section).

•Dynamic Workload Scaling Overview

–Adding Real Servers to a Server Farm

Configuring Server Farms

Server farms are groups of networked real servers (physical servers and VMs) that contain the same content and that typically reside in the same physical location in a data center.

Note With Dynamic Workload Scaling configured on the ACE, the real servers that are VMs can also reside in a remote datacenter (see the "Configuring Dynamic Workload Scaling" section).

Web sites often comprise groups of servers configured in a server farm. Load-balancing software distributes client requests for content or services among the real servers based on the configured policy and traffic classification, server availability and load, and other factors. If one server goes down, another server can take its place and continue to provide the same content to the clients who requested it.

Note A server farm can support a mix of IPv6 and IPv4 real servers, and can be associated with both IPv6 and IPv4 probes.

Use this procedure to configure load balancing on server farms.

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Server Farms. The Server Farms table appears.

Step 2 Click Add to add a new server farm, or select an existing server farm, then click Edit. The Server Farms configuration screen appears.

Step 3 Enter the server farm attributes (see Table 6-5).

Table 6-5 Server Farm Attributes
Field	Description
Name	Either accept the automatically incremented value in this field, or enter a unique name for this server farm. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.
Type	Select the type of server farm: •Host—Indicates that this is a typical server farm that consists of real servers that provide content and services to clients •Redirect—Indicates that this server farm consists only of real servers that redirect client requests to alternate locations specified in the real server configuration. (See Configuring Real Servers.)
Description	Enter a brief description for this server farm. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.
Fail Action	Select the action the ACE appliance is to take with respect to connections if any real server in the server farm fails: •N/A—Indicates that the ACE appliance is to take no action if any server in the server farm fails. •Purge—Indicates that the ACE appliance is to remove connections to a real server if that real server in the server farm fails. The ACE appliance sends a reset command to both the client and the server that failed. •Reassign—The ACE is to reassign the existing server connections to the backup real server (if configured) if the real server fails after you enter this command. If a backup real server has not been configured for the failing server, this selection leaves the existing connections untouched in the failing real server.
Failaction Reassign Across Vlans	This field appears only when the Fail Action is set to Reassign. Check the check box to specify that the ACE reassigns the existing server connections to the backup real server on a different VLAN interface (commonly referred to as a bypass VLAN) if the real server fails. If a backup real server has not been configured for the failing server, this option has no effect and leaves the existing connections untouched in the failing real server. Note the following configuration requirements and restrictions when you enable this option: •Enable the Transparent option (see the next Field) to instruct the ACE not to use NAT to translate the ACE VIP address to the server IP address. The Failaction Reassign Across Vlans option is intended for use in stateful firewall load balancing (FWLB) on your ACE, where the destination IP address for the connection coming in to the ACE is for the end-point real server, and the ACE reassigns the connection so that it is transmitted through a different next hop. •Enable the MAC Sticky option on all server-side interfaces to ensure that packets that are going to and coming from the same server in a flow will traverse the same firewalls or stateful devices (see the "Configuring Virtual Context VLAN Interfaces" section). •Configure the Predictor Hash Address option. See the "Configuring the Predictor Method for Server Farms" section for the supported predictor methods and configurable attributes for each predictor method. •You must configure identical policies on the primary interface and the backup-server interface. The backup interface must have the same feature configurations as the primary interface. •If you configure a policy on the backup-server interface that is different from the policies on the primary-server interface, that policy will be effective only for new connections. The reassigned connection will always have only the primary-server interface policies. •Interface-specific features (for example, NAT, application protocol inspection, outbound ACLs, or SYN cookie) are not supported. •You cannot reassign connections to the failed real server after it comes back up. This restriction also applies to same-VLAN backup servers. •Real servers must be directly connected to the ACE. This requirement also applies to same-VLAN backup server. •You must disable sequence number randomization on the firewall (see the "Configuring Connection Parameter Maps" section). •Probe configurations should be similar on both ACEs and the interval values should be low. For example, if you configure a high interval value on ACE-1 and a low interval value on ACE-2, the reassigned connections may become stuck because of the probe configuration mismatch. ACE-2 with the low interval value will detect the primary server failure first and will reassign all its incoming connections to the backup-server interface VLAN. ACE-1 with the high interval value may not detect the failure before the primary server comes back up and will still point to the primary server. To minimize packet loss, we recommend the following probe parameter values on both ACEs: Interval: 2, Faildetect: 2, Passdetect interval: 2, and Passdetect count: 5.
Dynamic Workload Scaling	This field appears only for host server farms. Allows the ACE to burst traffic to remote VMs when the average CPU or memory usage of the local VMs has reached it's specified maximum threshold value. The ACE stops bursting traffic to the remote VMs when the average CPU or memory usage of the local VMs has dropped below its specified minimum threshold value. This option requires that you configure the ACE for Dynamic Workload Scaling using a Nexus 7000, VM Controller, and VM probe (see the "Configuring Dynamic Workload Scaling" section). Click one of the following radio button options: •N/A—Not applicable (default). •Local—Restricts the ACE to use of local VMs only for server load balancing. •Burst—Enables the ACE to burst traffic to remote VMs when needed. When you choose Burst, the VM Probe Name field appears along with a list of available VM probes. Choose an available VM probe or click Add to display the Health Monitoring pop-up window and create a new VM probe or edit an existing one (see the "Configuring Health Monitoring" section).
Fail-On-All	This field appears only for host server farms. By default, real servers that you configure in a server farm inherit the probes that you configure directly on that server farm. When you configure multiple probes on a server farm, the real servers in the server farm use an OR logic with respect to the probes, which means that if one of the probes configured on the server farm fails, all the real servers in that server farm fail and enter the PROBE-FAILED state. With AND logic, if one server farm probe fails, the real servers in the server farm remain in the operational state. If all the probes associated with the server farm fail, then all the real servers in that server farm fail and enter the PROBE-FAILED state. Click this checkbox to configure the real servers in a server farm to use AND logic with respect to multiple server farm probes. The Fail-On-All function is applicable to all probe types.
Inband-Health Check	This field appears only for host server farms. By default, the ACE monitors the health of all real servers in a configuration through the use of ARPs and health probes. However, there is latency period between when the real server goes down and when the ACE becomes aware of the state. The inband health monitoring feature allows the ACE to monitor the health of the real servers in the server farm through the following connection failures: •For TCP, resets (RSTs) from the server or SYN timeouts. •For UDP, ICMP Host, Network, Port, Protocol, and Source Route unreachable messages. When you configure the failure-count threshold and the number of these failures exceeds the threshold within the reset-time interval, the ACE immediately marks the server as failed, takes it out of service, and removes it from load balancing. The server is not considered for load balancing until the optional resume-service interval expires. Choose one of the following: •Count—Tracks the total number of TCP or UDP failures, and increments the counters as displayed by the show serverfarm name inband CLI command. •Log—Logs a syslog error message when the number of events reaches the configured connection failure threshold. •Remove—Logs a syslog error message when the number of events reaches the threshold and removes the server from service. Note You can configure this feature and health probes to monitor a server. When you do, both are required to keep a real server in service within a server farm. If either feature detects a server is out of service, the ACE does not select the server for load balancing.
Connection Failure Threshold Count	This field appears only when the Inband-Health Check is set to Log or Remove. Enter the maximum number of connection failures that a real server can exhibit in the reset-time interval before ACE marks the real server as failed. Valid entries are integers from 1 to 4294967295.
Reset Timeout (Milliseconds)	This field appears only when the Inband-Health Check is set to Log or Remove. Enter the number of milliseconds for the reset-time interval. Valid entries are integers from 100 to 300000. The default interval is 100. This interval starts when the ACE detects a connection failure. If the connection failure threshold is reached during this interval, the ACE generates a syslog message.When Inband-Health Check is set to Remove, the ACE also removes the real server from service. Changing the setting of this option affects the behavior of the real server, as follows: •When the real server is in the OPERATIONAL state, even if several connection failures have occurred, the new reset-time interval takes effect the next time that a connection error occurs. •When the real server in the INBAND-HM-FAILED state, the new reset-time interval takes effect the next time that a connection error occurs after the server transitions to the OPERATIONAL state.
Resume Service (Seconds)	This field appears only when the Inband-Health Check is set to Remove. Enter the number of seconds after a server has been marked as failed to reconsider it for sending live connections. Valid entries are integers from 30 to 3600. By default, this field is not configured. The setting of this option affects the behavior of the real server in the inband failed state, as follows: •When this field is not configured, the real server remains in the failed state until you manually suspend and then reactivate it. •When this field is not configured and then you configure this option with an integer between 30 and 3,600, the failed real server immediately transitions to the Operational state. •When you configure this field and then increase the value, the real server remains in the failed state for the duration of the previously-configured value. The new value takes effect the next time the real server transitions to the failed state. •When you configure this field and then decrease the value, the failed real server immediately transitions to the Operational state. •When you configure this field with an integer between 30 and 3,600 and then reset it deleting the value from the field, the real server remains in the failed state for the duration of the previously-configured value. The unconfigured setting takes effect the next time the real server transitions to the failed state. Then the real server remains in the failed state until you manually suspend and then reactivate it. •When you change this field within the reset-time interval and the real server is in the OPERATIONAL state with several connection failures, the new threshold interval takes effect the next time that a connection error occurs, even if it occurs within the current reset-time interval.
Transparent	This field appears only for real servers identified as host servers. Check the check box to specify that network address translation from the VIP address to the server IP is to occur. Clear the check box to indicates that network address translation from the VIP address to the server IP address is not to occur (default).
Partial-Threshold Percentage	This field appears only for host server farms. Enter the minimum percentage of real servers in the primary server farm that must remain active for the server farm to stay up. If the percentage of active real servers falls below this threshold, the ACE takes the server farm out of service. Valid entries are integers from 0 to 99. After you configure a value in this field, enter a value in the Back Inservice field to bring the primary server farm back into service.
Back Inservice	This field appears only for host server farms. Enter the percentage of real servers in the primary server farm that must be active again for the ACE to place the server farm back into service. Valid entries are integers from 0 to 99. The value in this field must be greater than or equal the value in the Partial Threshold Percentage field.
Probes	In the Available list, choose the probes to use for health monitoring, and click Add. The selected probes appear in the Selected list. The redirect server farm probe list contains only configured probes of the type Is Routed, which means that the ACE routes the probe address according to the ACE internal routing table (see the "Configuring Health Monitoring for Real Servers" section). Note You can associate both IPv6 and IPv4 probes to a server farm. Note The list of Available probes does not display the VM probe type. To choose a VM probe for monitoring local VM usage, see the Dynamic Workload Scaling field. To remove probes that you do not want to use for health monitoring, select them in the Selected list, then click Remove. The selected probes appear in the Available list.

Step 4 Click:

•Deploy Now to deploy this configuration on the ACE appliance. To add real servers to the farm and to configure server farm attributes, see:

–Configuring Health Monitoring

–Configuring Server Farm HTTP Return Error-Code Checking

•Cancel to exit the procedure without saving your entries and to return to the Server Farms table.

•Next to save your entries and to configure another server farm.

Step 5 (Optional) To display statistics and status information for an existing server farm, choose a server farm from the Server Farms table, and click Details.

The show serverfarm name detail CLI command output appears. See the "Displaying Server Farm Statistics and Status Information" section for details.

•Configuring Server Farm HTTP Return Error-Code Checking

Adding Real Servers to a Server Farm

After adding a server farm, (see Configuring Server Farms), you can associate real servers with it and configure predictors and retcode maps. The configuration screens for these attributes appear beneath the Server Farms table or after you have successfully added a new server farm.

Note If you do not see these tabs beneath the Server Farms table, click the Switch between Configure and Browse Modes button.

When creating or editing a server farm, if the real server to be added has the same name as an existing global real server but contains a different IP address (or no IP address), the Device Manager displays the following error message:

IP address of pre-existing real sever cannot be changed: "<rs-name>" (ip-addr>).

If this error message appears, ensure that you specify an existing real server with the matching IP address.

Use this procedure to add real servers to a server farm.

Assumptions

•A server farm has been added to the ACE Device Manager. (See Configuring Server Farms.)

•At least one real server exists.

Consideration

A server farm can support a mix of IPv6 and IPv4 real servers.

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Server Farms. The Server Farms table appears.

Step 2 Select the server farm you want to associate with real servers, then select the Real Servers tab. The Real Servers table appears.

Step 3 Click Add to add a new entry to the Real Servers table, or select an existing server, then click Edit to modify it. The Real Servers configuration screen appears.

Step 4 Configure the real server using the information in Table 6-6.

Table 6-6 Real Server Configuration Attributes
Field	Description
Name	Select the server that you want to associate with the server farm.
Port	Enter the port number to be used for server port address translation (PAT). Valid entries are integers from 1 to 65535.
Backup Server Name	Select the server that is to act as the backup server for the server farm. Leave this field blank to indicate that there is no designated backup server for the server farm.
Backup Server Port	If you select a backup server, enter the backup server port number. Valid entries are integers from 1 to 65535.
State	Select the state of this server: •In Service—Indicates that this server is in service. •In Service Standby—Indicates that this server is a backup server and is to remain inactive unless the primary server fails. If the primary server fails, the backup server becomes active and starts accepting connections. •Out Of Service—Indicates that this server is out of service.
Fail-On-All	This field appears only for real servers identified as host servers. By default, real servers with multiple probes configured for them have an OR logic associated with them. This means that if one of the real server probes fails, the real server fails and enters the PROBE-FAILED state. Click this checkbox to configure a real server to remain in the OPERATIONAL state unless all probes associated with it fail (AND logic). The Fail On All function is applicable to all probe types.
Min. Connections	Enter the minimum number of connections that the number of connections must fall below before the ACE appliance resumes sending connections to the server after it has exceeded the number in the Max. Connections field. The number in this field must be less than or equal to the number in the Max. Connections field. 1 to 4000000. The default value is 4000000.
Max. Connections	Enter the maximum number of active connections that can be sent to the server. When the number of connections exceeds this number, the ACE appliance stops sending connections to the server until the number of connections falls below the number specified in the Min. Connections field. Valid entries are integers from 1 to 4000000. The default is 4000000.
Weight	Enter the weight to assign to the server. Valid entries are integers from 1 to 100, and the default is 8.
Cookie String	This field appears only for real servers identified as hosts. Enter a cookie string value of the real server, which is to be used for HTTP cookie insertion when establishing a sticky connection. Valid entries are text strings with a maximum of 32 alphanumeric characters. You can include spaces and special characters in a cookie string value. Use cookie insertion when you want to use a session cookie for persistence if the server is not currently setting the appropriate cookie. With this feature enabled, the ACE inserts the cookie in the Set-Cookie header of the response from the server to the client. See Chapter 7 "Configuring Stickiness" for details on HTTP cookie sticky connections.
Probes	Select the probes in the Available list that you want to apply to this server, then click Add. The selected probes appear in the Selected list. To remove probes you do not want to apply to this server, select the probes in the Selected list, then click Remove. Note The Available list does not display the VM probe type.
Rate Bandwidth	The bandwidth rate is the number of bytes per second and applies to the network traffic exchanged between the ACE and the real server in both directions. Specify the bandwidth limit in bytes per second. Valid entries are integers from 1 to 300000000.
Rate Connection	The connection rate is the number of connections per second received by the ACE and applies only to new connections destined to a real server. Specify the limit for connections per second. Valid entries are integers from 1 to 350000.

Step 5 When you finish configuring this server for this server farm, click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Real Servers table.

•Next to save your entries and to add another real server for this server farm.

•Configuring Server Farm HTTP Return Error-Code Checking

Configuring the Predictor Method for Server Farms

After adding a server farm, (Configuring Server Farms), you can associate real servers with it and configure the predictor method and retcode maps. The configuration screens for these attributes appear beneath the Server Farms table or after you have successfully added a new server farm.

Note If you do not see these tabs beneath the Server Farms table, click the Switch between Configure and Browse Modes button.

Use this procedure to configure the predictor method for a server farm. The predictor method specifies how the ACE appliance is to select a server in the server farm when it receives a client request for a service.

Note You can configure only one predictor method per server farm.

Assumptions

•A server farm has been added to the ACE Device Manager. (See Configuring Server Farms.)

•At least one real server exists.

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Server Farms. The Server Farms table appears.

Step 2 Select the server farm you want to configure the predictor method for, then select the Predictor tab. The Predictor configuration screen appears.

Step 3 In the Type field, select the method that the ACE appliance is to use to select a server in this server farm when it receives a client request. Table 6-7 lists the available options and describes them.

Step 4 Enter the required information for the selected predictor method. Round Robin is the default predictor method. See Table 6-7.

Table 6-7 Predictor Method Attributes
Predictor Method	Description / Action
Hash Address	The ACE selects the server using a hash value based on the source or destination IP address. To configure the hash address predictor method: 1. In the Mask Type field, indicate whether server selection is based on source IP address or the destination IP address: –N/A—This option is not defined. –Destination—The server is selected based on the destination IP address. –Source—The server is selected based on the source IP address. Note If you configure the server farm with IPv6 and IPv4 Hash Address predictors at the same time, both predictors must have the same mask type. 2. In the IP Netmask field, select the subnet mask to apply to the address. If none is specified, the default is 255.255.255.255. 3. In the IPv6 Prefix-Length field, enter the IPv6 prefix length. If none is specified, the default is 128.
Hash Content	The ACE selects the server by using a hash value based on the specified content string of the HTTP packet body. 1. In the Begin Pattern field, enter the beginning pattern of the content string and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 12-31 lists the supported characters that you can use for matching string expressions. 2. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 12-31 lists the supported characters that you can use for matching string expressions. 3. In the Length field, enter the length in bytes of the portion of the content (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are integers from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. You cannot specify both the length and the end-pattern options for a Hash Content predictor. 4. In the HTTP Content Offset field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are integers from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content.
Hash Cookie	The ACE selects the server by using a hash value based on the cookie name. In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters.
Hash Secondary Cookie	The ACE selects the server by using the hash value based on the specified cookie name in the URL query string, not the cookie header. In the Cookie Name field, enter a cookie name in the form of an unquoted text string with no spaces and a maximum of 64 characters.
Hash Header	The ACE selects the server by using a hash value based on the header name. In the Header Name field, select the HTTP header to be used for server selection: •To specify an HTTP header that is not one of the standard HTTP headers, select the first radio button and enter the HTTP header name in the Header Name field. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters. •To specify one of the standard HTTP headers, select the second radio button, then select one of the HTTP headers from the list.
Hash Layer4	The ACE selects the server by using a Layer 4 generic protocol load-balancing method. Use this predictor to load balance packets from protocols that are not explicitly supported by the ACE. 1. In the Begin Pattern field, enter the beginning pattern of the Layer 4 payload and the pattern string to match before hashing. If you do not specify a beginning pattern, the ACE starts parsing the HTTP body immediate following the offset byte. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 12-31 lists the supported characters that you can use for matching string expressions. 2. In the End Pattern field, enter the pattern that marks the end of hashing. If you do not specify either a length or an end pattern, the ACE continues to parse the data until it reaches the end of the field or the end of the packet, or until it reaches the maximum body parse length. You cannot configure different beginning and ending patterns for different server farms that are part of the same traffic classification. Valid entries are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters. The ACE supports regular expressions for matching string expressions. Table 12-31 lists the supported characters that you can use for matching string expressions. 3. In the Length field, enter the length in bytes of the portion of the payload (starting with the byte after the offset value) that the ACE uses for sticking the client to the server. Valid entries are integers from 1 to 1000 bytes. The offset and length can vary from 0 to 1000 bytes. If the payload is longer than the offset but shorter than the offset plus the length of the payload, the ACE sticks the connection based on that portion of the payload starting with the byte after the offset value and ending with the byte specified by the offset plus the length. The total of the offset and the length cannot exceed 1000. You cannot specify both the length and end-pattern options for a Hash Layer 4 predictor. 4. In the HTTP Content Offset field, enter the portion of the content that the ACE uses to stick the client on a particular server by indicating the bytes to ignore starting with the first byte of the payload. Valid entries are integers from 0 to 999 bytes. The default is 0, which indicates that the ACE does not exclude any portion of the content.
Hash URL	The ACE selects the server using a hash value based on the URL. Use this method to load balance firewalls. Enter values in one or both of the pattern fields: •In the URL Begin Pattern field, enter the beginning pattern of the URL and the pattern string to parse. •In the URL End Pattern field, enter the ending pattern of the URL and the pattern string to parse. Valid entries for these fields are unquoted text strings with no spaces and a maximum of 255 alphanumeric characters for each pattern you configure. The following special characters are also allowed: @ # $
Least Bandwidth	The ACE selects the server with the least amount of network traffic over a specified sampling period. 1. In the Assess Time field, enter the number of seconds for which the ACE is to collect traffic information. Valid entries are integers from 1 to 10 seconds. 2. In the Least Bandwidth Samples field, enter the number of samples over which you want to weight and average the results of the probe query to calculate the final load value. Valid entries are 1, 2, 4, 8, and 16 (integers from 1 to 16 that are also a power of 2).
Least Connections	The ACE selects the server with the fewest number of connections. In the Slow Start Duration field, enter the slow-start value to be applied to this predictor method. Valid entries are integers from 1 to 65535, where 1 is the slowest ramp-up value. The slow-start mechanism is used to avoid sending a high rate of new connections to servers that you have just put into service.
Least Loaded	The ACE selects the server with the lowest load based on information from SNMP probes. 1. In the SNMP Probe Name field, select the name of the SNMP probe to use. 2. In the Auto Adjust field, configure the autoadjust feature to instruct the ACE to apply the maximum load of 16000 to a real server whose load reaches zero or override the default behavior. By default, the ACE applies the average load of the server farm to a real server whose load is zero. The ACE periodically adjusts this load value based on feedback from the server SNMP probe and other configured options. Options include: –Average—Applies the average load of the server farm to a real server whose load is zero. This setting allows the server to participate in load balancing, while preventing it from being flooded by new connections. This is the default setting. –Maxload—Instruct the ACE to apply the maximum load of 16000 to a real server whose load reaches zero. –Off—Instruct the ACE to send all new connections to the server that has a load of zero until the next load update arrives from the SNMP probe for this server. If two servers have the same lowest load (either zero or nonzero), the ACE load balances the connections between the two servers in a round-robin manner. 3. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Clear the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation. To instruct the ACE to select the server with the lowest load, use the predictor least-loaded command in server farm host or redirect configuration mode. With this predictor, the ACE uses SNMP probes to query the real servers for load parameter values (for example, CPU utilization or memory utilization). This predictor is considered adaptive because the ACE continuously provides feedback to the load-balancing algorithm based on the behavior of the real server. To use this predictor, you must associate an SNMP probe with it. The ACE queries user-specified OIDs periodically based on a configurable time interval. The ACE uses the retrieved SNMP load value to determine the server with the lowest load. The syntax of this predictor command is as follows: predictor least-loaded probe name The name argument specifies the identifier of the existing SNMP probe that you want the ACE to use to query the server. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. For example, to configure the ACE to select the real server with the lowest load based on feedback from an SNMP probe called PROBE_SNMP, enter: `host1/Admin(config)#` serverfarm SF1 `host1/Admin(config-sfarm-host)#` predictor least-loaded probe PROBE_SNMP `host1/Admin(config-sfarm-host-predictor)#` To reset the predictor method to the default of Round Robin, enter: `host1/Admin(config-sfarm-host)#` no predictor
Response	The ACE selects the server with the lowest response time for a requested response-time measurement. 1. In the Response Type field, select the type of measurement to use: –App-Req-To-Resp—The response time from when the ACE sends an HTTP request to a server to the time that the ACE receives a response from the server for that request. –Syn-To-Close—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a CLOSE from the server. –Syn-To-Synack—The response time from when the ACE sends a TCP SYN to a server to the time that the ACE receives a SYN-ACK from the server. 2. In the Response Samples field, enter the number of samples over which you want to average the results of the response-time measurement. Valid entries are 1, 2, 4, 8, and 16 (integers from 1 to 16 that are also a power of 2). 3. In the Weight Connection field, check the check box to instruct the ACE to use the current connection count in the final load calculation for a real server. When you configure this option, the ACE includes the current connection count in the total load calculation for each real server in a server farm. Clear the check box to reset the behavior of the ACE to the default of excluding the current connection count from the load calculation.
Round Robin	The ACE selects the next server in the list of servers based on server weight. This is the default predictor method.

Step 5 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the t Connection field table.

•Adding Real Servers to a Server Farm

•Configuring Server Farm HTTP Return Error-Code Checking

•Configuring Virtual Context Class Maps

Configuring Server Farm HTTP Return Error-Code Checking

Use this procedure to configure HTTP return error-code checking (retcode map) for a server farm.

Note This feature is available only for server farms configured as hosts. It is not available for server farms configured with the type Redirect.

Assumption

A host type server farm has been added to the ACE Device Manager. (See Configuring Server Farms.)

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Server Farms. The Server Farms table appears.

Step 2 Select the server farm you want to configure return error-code checking for, then select the Retcode Map tab. The Retcode Map table appears. If you do not see tabs beneath the Server Farms table, click the Switch Between Configure And Browse Modes button.

Step 3 Click Add to add a new entry to the table. The Retcode Map configuration screen appears.

Note You cannot modify an entry in the Retcode Map table. Instead, delete the existing entry, then add a new one.

Step 4 In the Lowest Retcode field, enter the minimum value for an HTTP return error code. Valid entries are integers from 100 to 599. This number must be less than or equal to the number in the Highest Retcode field.

Step 5 In the Highest Retcode field, enter the maximum number for an HTTP return error code. Valid entries are integers from 100 to 599. This number must be greater than or equal to the number in the Lowest Retcode field.

Step 6 In the Type field, specify the action to be taken and related options using the information in Table 6-8.

Table 6-8 Return-Code Type Configuration Options
Option	Description
Count	The ACE tracks the total number of return codes received for each return code number that you specify.
Log	The ACE generates a syslog error message when the number of events reaches a specified threshold. 1. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message. Valid entries are integers from 1 to 4294967295. 2. In the Reset field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are integers from 1 to 2147483647 seconds.
Remove	The ACE generates a syslog error message when the number of events reaches a specified threshold and then removes the server from service. 1. In the Threshold field, enter the number of events that the ACE is to receive before generating a syslog error message and removing the server from service. Valid entries are integers from 1 to 4294967295. 2. In the Reset field, enter the time interval in seconds for which the ACE checks for the return code. Valid entries are integers from 1 to 2147483647 seconds. 3. In the Resume Service field, enter the number of seconds that the ACE waits before it resumes service for the real server automatically after taking the real server out of service. Valid entries are 30 to 3600 seconds. By default, this field is not configured. The setting of this field affects the behavior of the real server in the failed state, as follows: –When this field is not configured, the real server remains in the failed state until you manually remove it from service and read it. –When this field is not configured and then you configure it with an integer between 30 and 3,600, the failed real server immediately transitions to the Operational state. –When you configure this field and then increase the value, the real server remains in the failed state for the duration of the previously-configured value. The new value takes effect the next time the real server transitions to the failed state. –When you configure this field and then decrease the value, the failed real server immediately transitions to the Operational state. –When you configure this field with an integer between 30 and 3,600 and then reset it by deleting the value from the field, the real server remains in the failed state for the duration of the previously-configured value. The unconfigured setting takes effect the next time the real server transitions to the failed state. Then the real server remains in the failed state until you manually remove it from service and read it.

Step 7 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Retcode Map table.

•Next to save your entries and to add another retcode map.

Related Topics

•Using Virtual Contexts

•Configuring Virtual Context Policy Maps

Viewing All Server Farms

Use this procedure to view all server farms associated with a virtual context.

Procedure

Step 1 Select Config > Virtual Contexts. The All Virtual Contexts table appears.

Step 2 Select the virtual context with the server farms you want to view, then click Load Balancing > Server Farms. The Server Farms table appears with the following information:

•Server farm name

•Server farm type (either host or redirect)

•Description

Depending on the server farms selected, additional tables appear below the Server Farms table. These tables include:

•Real Servers—This table identifies the real servers associated with the selected server farm.

•Predictor—This configuration screen displays the selected predictor method for the selected server farm.

•Retcode Map—This table displays the HTTP return error-code checking that has been configured for the selected server farm.

Related Topics

•Adding Real Servers to a Server Farm

•Configuring Server Farm HTTP Return Error-Code Checking

Displaying Server Farm Statistics and Status Information

You can display statistics and status information for a particular server farm.

Procedure

Step 1 Choose Config > Virtual Contexts > context > Load Balancing > Server Farms.

The Server Farms table appears.

Step 2 In the Server Farms table, choose a server farm from the Server Farms table, and click Details.

The show serverfarm name detail CLI command output appears. For details about the displayed output fields, see the Server Load-Balancing Guide, Cisco ACE Application Control Engine, Chapter 2, Configuring Real Servers and Server Farms.

Step 3 Click Update Details to refresh the output for the show serverfarm name detail CLI command.

The new information appears in a separate panel with a new timestamp; both the old and the new server farm statistics and status information appear side-by-side to avoid overwriting the last updated information.

Step 4 Click Close to return to the Server Farms table.

Related Topics

•Viewing All Server Farms

•Adding Real Servers to a Server Farm

•Configuring Server Farm HTTP Return Error-Code Checking

•Configuring DNS Probe Expect Addresses

Configuring Health Monitoring

You can instruct the ACE appliance to check the health of servers and server farms by configuring health probes (sometimes referred to as keepalives). After you create a probe, you assign it to a real server or a server farm. A probe can be one of many types, including TCP, ICMP, Telnet, HTTP, and so on. You can also configure scripted probes using the TCL scripting language (see TCL Scripts).

The ACE appliance sends out probes periodically to determine the status of a server, verifies the server response, and checks for other network problems that may prevent a client from reaching a server. Based on the server response, the ACE appliance can place the server in or out of service, and, based on the status of the servers in the server farm, can make reliable load-balancing decisions.

Health monitoring on the ACE appliance tracks the state of a server by sending out probes. Also referred to as out-of-band health monitoring, the ACE appliance verifies the server response or checks for any network problems that can prevent a client to reach a server. Based on the server response, the ACE appliance can place the server in or out of service, and can make reliable load balancing decisions.

Note You can configure the inband health monitoring feature and health probes to monitor the health of the real servers in a server farm. For more information on inband health monitoring, see the "Configuring Server Farms" section.

The ACE appliance identifies the health of a server in the following categories:

•Passed—The server returns a valid response.

•Failed—The server fails to provide a valid response to the ACE or the ACE is unable to reach a server for a specified number of retries.

By configuring the ACE appliance for health monitoring, the ACE appliance sends active probes periodically to determine the server state.

The ACE appliance supports 4000 unique probe configurations which includes ICMP, TCP, HTTP, and other predefined health probes. The ACE appliance also allows the opening of 1000 sockets simultaneously.

•TCL Scripts

TCL Scripts

The ACE appliance supports several specific types of health probes (for example HTTP, TCP, or ICMP health probes) when you need to use a diverse set of applications and health probes to administer your network. The basic health probe types supported in the current ACE appliance software release may not support the specific probing behavior that your network requires. To support a more flexible health-probing functionality, the ACE appliance allows you to upload and execute TCL scripts on the ACE appliance.

The TCL interpreter code in the ACE appliance is based on Release 8.44 of the standard TCL distribution. You can create a script to configure health probes. Script probes operate similar to other health probes available in the ACE appliance software. As part of a script probe, the ACE appliance executes the script periodically, and the exit code that is returned by the executing script indicates the relative health and availability of specific real servers. For information on health probes, see Configuring Health Monitoring for Real Servers.

For your convenience, the following sample scripts for the ACE appliance are available to support the TCL feature and are supported by Cisco TAC:

•ECHO_PROBE_SCRIPT

•FINGER_PROBE_SCRIPT

•FTP_PROBE_SCRIPT

•HTTP_PROBE_SCRIPT

•HTTPCONTENT_PROBE

•HTTPHEADER_PROBE

•HTTPPROXY_PROBE

•IMAP_PROBE

•LDAP_PROBE

•MAIL_PROBE

•POP3_PROBE

•PROBENOTICE_PROBE

•RTSP_PROBE

•SSL_PROBE_SCRIPT

These scripts are located in the probe: directory and are accessible in both the Admin and user contexts. Note that the script files in the probe: directory are read-only, so you cannot copy or modify them. However, you can copy files from the probe: directory. For more information, see the Administration Guide, Cisco ACE Application Control Engine.

To load a script into memory on the ACE appliance and enable it for use, use the script file command. For detailed information on uploading and executing Toolkit Command Language (TCL) scripts on the ACE appliance, refer to the Server Load-Balancing Guide, Cisco ACE Application Control Engine.

Configuring Health Monitoring for Real Servers

To check the health and availability of a real server, the ACE appliance periodically sends a probe to the real server. Depending on the server response, the ACE appliance determines whether to include the server in its load-balancing decision.

Note You can configure the inband health monitoring feature and health probes to monitor the health of the real servers in a server farm. When you do, both are required to keep a real server in service within a server farm. If either feature detects a server is out of service, the ACE does not select the server for load balancing. For more information on inband health monitoring, see the "Configuring Server Farms" section.

Use this procedure to establish monitoring of real servers to determine their viability in load-balancing decisions.

Procedure

Step 1 Select Config > Virtual Contexts > context > Load Balancing > Health Monitoring. The Health Monitoring table appears.

Step 2 Click Add to add a new health monitoring probe, or select an existing entry, then click Edit to modify it. The Health Monitoring screen appears.

Step 3 In the Name field, enter a name that identifies the probe and that associates the probe with the real server. Valid entries are unquoted text strings with no spaces and a maximum of 64 characters.

Step 4 In the Type field, select the type of probe you want to use. The probe type determines what the probe sends to the real server. See Table 6-9 for the types of probes and their descriptions.

Table 6-9 Probe Types
Probe Type	Description
DNS	Sends a request to a DNS server giving it a configured domain. To determine if the server is up, the ACE appliance must receive the configured IP address for that domain.
ECHO-TCP	Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE appliance retries as configured before the server is marked as failed.
ECHO-UDP	Sends a string to the server and compares the response with the original string. If the response string matches the original, the server is marked as passed. If not, the ACE appliance retries as configured before the server is marked as failed.
FINGER	Sends a probe to the server to verify that a defined username is a username on the server.
FTP	Initiates an FTP session. By default, this probe is for an anonymous login with the option of configuring a user ID and password. The ACE appliance performs an FTP GET or LS to determine the outcome of the problem. This probe supports only active connections.
HTTP	Sets up a TCP connection and issues an HTTP request. Any valid HTTP response causes the probe to mark the real server as passed.
HTTPS	Similar to an HTTP probe, but this probe uses SSL to generate encrypted data.
ICMP	Sends an ICMP request and listens for a response. If the server returns a response, the ACE appliance marks the real server as passed. If there is no response and times out, or an ICMP standard error occurs, such as DESTINATION_UNREACHABLE, the ACE appliance marks the real server as failed.
IMAP	Initiates an IMAP session, using a configured user ID and password. Then, the probe attempts to retrieve e-mail from the server and validates the result of the probe based on the return codes received from the server.
POP	Initiates a POP session, using a configured user ID and password. Then, the probe attempts to retrieve e-mail from the server and validates the result of the probe based on the return codes received from the server.
RADIUS	Connects to a RADIUS server and logs into it to determine if the server is up.
RTSP	Establishes a TCP connection and sends a request packet to the server. The ACE compares the response with the configured response code to determine whether the probe succeeded.
Scripted	Executes probes from a configured script to perform health probing. This method allows you to author specific scripts with features not present in standard probes.
SIP-TCP	Establishes a TCP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.
SIP-UDP	Establishes a UDP connection and sends an OPTIONS request packet to the user agent on the server. The ACE compares the response with the configured response code or expected string, or both, to determine whether the probe has succeeded. If you do not configure an expected status code, any response from the server is marked as failed.
SMTP	Initiates an SMTP session by logging into the server.
SNMP	Establishes a UDP connection and sends a maximum of eight SMNP OID queries to probe the server. The ACE weighs and averages the load information that is retrieved and uses it as input to the least-loaded algorithm for load-balancing decisions. If the retrieved value is within the configured threshold, the server is marked as passed. If the threshold is exceeded, the server is marked as failed.
TCP	Initiates a TCP handshake and expects a response. By default, a successful response causes the probe to mark the server as passed. The probe then sends a FIN to end the session. If the response is not valid, or if there is no response, the probe marks the real server as failed.
TELNET	Establishes a connection to the real server and verifies that a greeting from the application was received.
UDP	Sends a UDP packet to a real server. The probe marks the server as failed only if an ICMP Port Unreachable messages is returned.
VM	Sends a probe to the VMware VM Controller to determine the average amount of both CPU and memory usage of its associated local VMs. The probe response determines whether the ACE load-balances traffic to the local VMs only or bursts traffic to the remote VMs due to high usage of the local VMs. Note Use a VM probe when you configure the ACE for Dynamic Workload Scaling (see the "Configuring Dynamic Workload Scaling" section).

Step 5 Enter health monitoring general attributes (see Table 6-10).

Note Click More Settings to access the additional general attributes for the selected probe type. By default, the Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-10 Health Monitoring General Attributes
Field	Action
Description	Enter a description for this probe. Valid entries are unquoted alphanumeric text strings with no spaces and a maximum of 240 characters.
Probe Interval (Seconds)	Enter the number of seconds that the ACE is to wait before sending another probe to a server marked as passed. Valid entries are from 2 to 65535 for all probe types except the VM probe, which has a range from 300 to 65535. The default is 15 for all probe types except the VM probe, which has a default of 300 seconds.
Pass Detect Interval (Seconds)	Enter the number of seconds that the ACE is to wait before sending another probe to a server marked as failed. Valid entries are integers from 2 to 65535 with a default of 60. Note This field is not applicable for the VM probe type.
Fail Detect	Enter the consecutive number of times that an ACE must detect that probes have failed to contact a server before marking the server as failed. Valid entries are integers from 1 to 65535 with a default of 3. Note This field is not applicable for the VM probe type.
More Settings (Not applicable for the VM probe type)
Pass Detect Count	Enter the number of successful probe responses from the server before the server is marked as passed. Valid entries are integers from 1 to 65535 with a default of 3.
Receive Timeout (Seconds)	Enter the number of seconds the ACE is to wait for a response from a server that has been probed before marking the server as failed. Valid entries are integers from 1 to 65535 with a default of 10.
Destination IPv4/IPv6 Address¹	By default, the probe uses the IP address from the real or virtual server configuration for the destination IP address. To override the destination address that the probe uses, enter the preferred destination IP address in this field. Note The following probes support IPv6 destination addresses: DNS, HTTP, HTTPS, ICMP, TCP, and UDP. Note When you assign a probe to a real server, they must be configured with the same IP address type (IPv6 or IPv4).
Is Routed²	Check the check box to indicate that the destination IP address is routed according to the ACE internal routing table. Clear the check box to indicate that the destination IP address is not routed according to the ACE internal routing table.
Port	By default, the precedence in which the probe inherits the port number is as follows: •The port number that you configure for the probe. •The configured port number from the real server in server farm. •The configured port number from the VIP in a Layer 3 and Layer 4 class map. •The default port number. Table 6-11 lists the default port number for each probe type. If you explicitly configure a default port, the ACE always sends the probe to the default port. The probe does not dynamically inherit the port number from the real server in a server farm or from the VIP specified in the class map.

¹The Dest IP Address field is not applicable to the Scripted probe type.

²The Is Routed field is not applicable to the RTSP, Scripted, SIP-TCP, and SIP-UDP probe types.

Table 6-11 Default Port Numbers for Probe Types
Probe Type	Default Port Number
DNS	53
Echo	7
Finger	79
FTP	21
HTTP	80
HTTPS	443
ICMP	Not applicable
IMAP	143
POP3	110
RADIUS	1812
RTSP	554
Scripted	1
SIP (both TCP and UDP)	5060
SMTP	25
SNMP	161
Telnet	23
TCP	80
UDP	53
VM	443

Step 6 Enter the attributes for the specific probe type selected:

•For DNS probes, see Table 6-12.

•For Echo-TCP probes, see Table 6-13.

•For Echo-UDP probes, see Table 6-14.

•For Finger probes, see Table 6-15.

•For FTP probes, see Table 6-16.

•For HTTP probes, see Table 6-17.

•For HTTPS probes, see Table 6-18.

•There are no specific attributes for ICMP probes.

•For IMAP probes, see Table 6-19.

•For POP probes, see Table 6-20.

•For RADIUS probes, see Table 6-21.

•For RTSP probes, see Table 6-22.

•For Scripted probes, see Table 6-23.

•For SIP-TCP probes, see Table 6-24.

•For SIP-UDP probes, see Table 6-25.

•For SMTP probes, see Table 6-26.

•For SNMP probes, see Table 6-27.

•For TCP probes, see Table 6-28.

•For Telnet probes, see Table 6-29.

•For UDP probes, see Table 6-30.

•For VM probes, see Table 6-31.

Step 7 Click:

•Deploy Now to deploy this configuration on the ACE appliance.

•Cancel to exit this procedure without saving your entries and to return to the Health Monitoring table.

•Next to save your entries and to configure another probe.

Step 8 (Optional) To display statistics and status information for a particular probe, choose the probe from the Health Monitoring table, and click Details.

The show probe name detail CLI command output appears. See the "Displaying Health Monitoring Statistics and Status Information" section for details.

Related Topics

•Configuring DNS Probe Expect Addresses

Probe Attribute Tables

Refer to the following topics to configure health monitoring probe-specific attributes:

•DNS Probe Attributes

•Echo-TCP Probe Attributes

•Echo-UDP Probe Attributes

•Finger Probe Attributes

•FTP Probe Attributes

•HTTP Probe Attributes

•HTTPS Probe Attributes

•IMAP Probe Attributes

•POP Probe Attributes

•RADIUS Probe Attributes

•RTSP Probe Attributes

•Scripted Probe Attributes

•SIP-TCP Probe Attributes

•SIP-UDP Probe Attributes

•SMTP Probe Attributes

•SNMP Probe Attributes

•TCP Probe Attributes

•Telnet Probe Attributes

•UDP Probe Attributes

•VM Probe Attributes

Refer to the following topics for additional configuration options for health monitoring probes:

•Configuring an OID for SNMP Probes

DNS Probe Attributes

Note Click More Settings to access the additional attributes for the DNS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-12 DNS Probe Attributes
Field	Action
Domain Name	Enter the domain name that the probe is to send to the DNS server. Valid entries are unquoted text strings with a maximum of 255 characters.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.

To configure expect addresses for DNS probes, see Configuring DNS Probe Expect Addresses.

Echo-TCP Probe Attributes

Note Click More Settings to access the additional attributes for the Echo-TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-13 Echo-TCP Probe Attributes
Field	Action
Send Data	Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

Echo-UDP Probe Attributes

Note Click More Settings to access the additional attributes for the Echo-UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-14 Echo-UDP Probe Attributes
Field	Action
Send Data	Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.

Finger Probe Attributes

Note Click More Settings to access the additional attributes for the Finger probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-15 Finger Probe Attributes
Field	Action
Send Data	Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

FTP Probe Attributes

Note Click More Settings to access the additional attributes for the FTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-16 FTP Probe Attributes
Field	Action
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

To configure probe expect statuses for FTP probes, see Configuring Health Monitoring Expect Status.

HTTP Probe Attributes

Note Click More Settings to access the additional attributes for the HTTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-17 HTTP Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Request Method Type	Select the type of HTTP request method that is to be used for this probe: •N/A—This option is not defined. •Get—The HTTP request method is a GET with a URL of "/". This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method. •Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and therefore changed hash values.
Request HTTP URL	This field appears if you select Head or Get in the Request Method Type field. Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/'.
More Settings
Append Port Host Tag	Check the check box to append port information in the HTTP Host header when you configure a non-default destination port for an HTTP probe. Clear the check box to not append the port information in the HTTP Host header.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.
User Name	Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password	Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field.
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Valid entries are integers from 1 to 4000.
Hash	Check the Hash check box to indicate that the ACE is to use an MD5 hash for an HTTP GET probe. Clear the Hash check box to indicate that the ACE should not use an MD5 hash for an HTTP GET probe.
Hash String	This field appears if the Hash check box is selected. Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state. Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.

To configure probe headers and expect statuses for HTTP probes, see:

HTTPS Probe Attributes

Note Click More Settings to access the additional attributes for the HTTPS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-18 HTTPS Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Request Method Type	Select the type of HTTP request method that is to be used for this probe: •N/A—This option is not defined. •Get—The HTTP request method is a GET with a URL of "/". This request method directs the server to get the page, and the ACE calculates a hash value for the content of the page. If the page content information changes, the hash value no longer matches the original hash value and the ACE assumes the service is down. This is the default request method. •Head—The server is to only get the header for the page. Using this method can prevent the ACE from assuming that the service is down due to changed content and therefore changed hash values.
Request HTTP URL	This field appears if you select Head or Get in the Request Method Type field. Enter the URL path on the remote server. Valid entries are strings of up to 255 characters specifying the URL path. The default path is "/'.
Cipher	Select the cipher suite to be used with this HTTPS probe: •RSA_ANY—The HTTPS probe accepts all RSA-configured cipher suites and that no specific suite is configured. This is the default action. •RSA_EXPORT1024_WITH_DES_CBC_SHA •RSA_EXPORT1024_WITH_RC4_56_MD5 •RSA_EXPORT1024_WITH_RC4_56_SHA •RSA_EXPORT_WITH_DES40_CBC_SHA •RSA_EXPORT_WITH_RC4_40_MD5 •RSA_WITH_3DES_EDE_CBC_SHA •RSA_WITH_AES_128_CBC_SHA •RSA_WITH_AES_256_CBC_SHA •RSA_WITH_DES_CBC_SHA •RSA_WITH_RC4_128_MD5 •RSA_WITH_RC4_128_SHA
SSL Version	Select the version of SSL or TLS to be used in ClientHello messages sent to the server: •All—The probe is to use all SSL versions. •SSLv3—The probe is to use SSL version 3. •TLSv1—The probe is to use TLS version 1. By default, the probe sends ClientHello messages with an SSL version 3 header and a TLS version 1 message.
More Settings
Append Port Host Tag	Check the check box to append port information in the HTTP Host header when you configure a non-default destination port for an HTTPS probe. Clear the check box to not append the port information in the HTTP Host header.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.
User Name	Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password	Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field.
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.
Hash	Check the Hash check box to indicate that the ACE is to use an MD5 hash for an HTTP GET probe. Clear this check box to indicate that the ACE is not to use an MD5 hash for an HTTP GET probe.
Hash String	This field appears if the Hash check box is selected. Enter the 32-bit hash value that the ACE is to compare with the hash that is generated from the HTTP page sent by the server. If you do not provide this value, the ACE generates a value the first time it queries the server, stores this value, and matches this value with other responses from the server. A successful comparison causes the probe to maintain an Alive state. Enter the MD5 hash value as a quoted or unquoted hexadecimal string with 16 characters.

To configure probe headers and expect statuses for HTTPS probes, see:

IMAP Probe Attributes

Note Click More Settings to access the additional attributes for the IMAP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-19 IMAP Probe Attributes
Field	Action
User Name	Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password	Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field.
Mailbox Name	Enter the user mailbox name from which to retrieve e-mail for this IMAP probe. Valid entries are unquoted text strings with a maximum of 64 characters.
Request Command	Enter the request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

POP Probe Attributes

Note Click More Settings to access the additional attributes for the POP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-20 POP Probe Attributes
Field	Action
User Name	Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password	Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field.
Request Command	Enter the request method command for this probe. Valid entries are text strings with a maximum of 32 characters and no spaces.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

RADIUS Probe Attributes

Note Click More Settings to access the additional attributes for the RADIUS probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-21 RADIUS Probe Attributes
Field	Action
User Secret	Enter the shared secret to be used to allow probe access to the RADIUS server. Valid entries are case-sensitive strings with no spaces and a maximum of 64 characters.
User Name	Enter the user identifier to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters.
Password	Enter the password to be used for authentication on the real server. Valid entries are unquoted text strings with a maximum of 64 characters. Reenter the password in the Confirm field.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
NAS IP Address	Enter the IP address of the Network Access Server (NAS) in dotted-decimal format, such as 192.168.11.1.

RTSP Probe Attributes

Note Click More Settings to access the additional attributes for the RTSP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-22 RTSP Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
RTSP Require Header Value	Enter the Require header for this probe.
RTSP Proxy Require Header Value	Enter the Proxy-Require header for this probe.
RTSP Request Method Type	Select the request method type: •N/A—No request method is selected. •Describe—This probe is to use the DESCRIBE request method.
Request HTTP URL	This field appears if you select Describe in the RTSP Request Method Type field. Enter the URL path for the URL request of the RTSP media stream on the server. Valid entries are strings with a maximum of 255 characters.
More Settings
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

To configure probe expect statuses for RTSP probes, see Configuring Health Monitoring Expect Status.

Scripted Probe Attributes

Note Click More Settings to access the additional attributes for the Scripted probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-23 Scripted Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Script Name	Enter the local name that you want to assign to this file on the ACE. This file can reside in the disk0: directory or the probe: directory (if the probe: directory exists). Note The script file must first be established on the ACE device and the name must be entered exactly as is appears on the device. Please refer to your ACE documentation for more details. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
Script Arguments	Valid arguments are unquoted text strings with no spaces; separate multiple arguments with a space. The field limit is 255 characters.
More Settings
Script Needs To Be Copied From Remote Location?	Check this check box to indicate that the file needs to be copied from a remote server. Clear this check box to indicate that the script resides locally.
Protocol	This field appears if the script is to be copied from a remote server. Select the protocol to be used for copying the script: •FTP—The script is to be copied using FTP. •TFTP—The script is to be copied using TFTP.
User Name	This field appears if FTP is selected in the Protocol field. Enter the name of the user account on the remote server.
Password	This field appears if FTP is selected in the Protocol field. Enter the password for the user account on the remote server. Reenter the password in the Confirm field.
Source File Name	This field appears if the script is to be copied from a remote server. Enter the host IP address, path, and filename of the file on the remote server in the format host-ip/path/filename where: •host-ip represents the IP address of the remote server. •path represents the directory path of the file on the remote server. •filename represents the filename of the file on the remote server. For example, your entry might resemble 192.168.11.2/usr/bin/my-script.ext.

SIP-TCP Probe Attributes

Note Click More Settings to access the additional attributes for the SIP-TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-24 SIP-TCP Probe Attributes
Field	Action
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

To configure probe expect statuses for SIP-TCP probes, see Configuring Health Monitoring Expect Status.

SIP-UDP Probe Attributes

Note Click More Settings to access the additional attributes for the SIP-UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-25 SIP-UDP Probe Attributes
Field	Action
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Enable Rport	Check the check box to indicate that the server will be forced to send a reply from the same port on which the request was received. Clear the check box to indicate that the server can send the reply from a different port than the port from which the request was received.
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings with a maximum of 255 characters. This field accepts both single and double quotes. Double quotes are considered delimiters so they don't appear on the device. Single quotes will appear on the device.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

To configure probe expect statuses for SIP-UDP probes, see Configuring Health Monitoring Expect Status.

SMTP Probe Attributes

Note Click More Settings to access the additional attributes for the SMTP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-26 SMTP Probe Attributes
Field	Action
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

To configure probe expect statuses for SMTP probes, see Configuring Health Monitoring Expect Status.

SNMP Probe Attributes

Note Click More Settings to access the additional attributes for the SNMP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-27 SNMP Probe Attributes
Field	Action
SNMP Community	Enter the SNMP community string. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
SNMP Version	Select the SNMP version for this probe: •N/A—No version is selected. •SNMPv1—This probe is to use SNMP version 1. •SNMPv2c—This probe is to use SNMP version 2c.

To configure the SNMP OID for SNMP probes, see Configuring an OID for SNMP Probes.

TCP Probe Attributes

Note Click More Settings to access the additional attributes for the TCP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-28 TCP Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Send Data	Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

Telnet Probe Attributes

Note Click More Settings to access the additional attributes for the Telnet probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-29 Telnet Probe Attributes
Field	Action
More Settings
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Is Connection	Check the check box to indicate that connection parameters are configured. Clear the check box to indicate that connection parameters are not configured.
Open Timeout (Seconds)	Enter the number of seconds to wait when opening a connection with a real server. Valid entries are integers from 1 to 65535, and the default value is 1.

UDP Probe Attributes

Note Click More Settings to access the additional attributes for the UDP probe type. By default, ACE appliance Device Manager hides the probe attributes with default values and the probe attributes which are not commonly used.

Table 6-30 UDP Probe Attributes
Field	Action
Port	Enter the port number that the probe is to use. By default, the probe uses port inheritance to determine the port number. For more information, see the general attribute Port field description.
Send Data	Enter the ASCII data that the probe is to send to the server. Valid entries are unquoted text strings with no spaces and a maximum of 255 characters.
More Settings
Expect Regular Expression	Enter the expected response data from the probe destination. Valid entries are text strings (quotes allowed) with a maximum of 255 characters.
Expect Regex Offset	Enter the number of characters into the received message or buffer where the ACE is to begin looking for the string specified in the Expect Regular Expression field. Value entries are integers from 1 to 4000.

VM Probe Attributes

Note Use a VM probe when you configure the ACE for Dynamic Workload Scaling (see the "Configuring Dynamic Workload Scaling" section).

Configure the VM probe attributes to control when the ACE bursts traffic to remote VMs based on an average of local VM CPU usage, memory usage, or both. The ACE obtains the usage information by sending the VM probe to the specified VM Controller associated with the local VMs It calculates the average aggregate load information for all local VMs as a percentage of CPU usage or memory usage and uses either or both percentages to determine when to burst traffic to the remote data center. If the server farm consists of both physical servers and VMs, the ACE considers load information only from the VMs.

By default, the VM probe checks the percentage of usage for either the CPU or memory against the maximum threshold value. Whichever percentage reaches its maximum threshold value first causes the ACE to burst traffic to the remote data center. The default maximum burst threshold value of 99 percent instructs the ACE to always load balance traffic to the local VMs unless the load value is equal to 100 percent or the VMs are not in the OPERATIONAL state. If you configure the maximum burst threshold value to1 percent, the ACE always bursts traffic to the remote data center.

When the usage percentage is less than the minimum threshold value, the ACE stops bursting traffic to the remote data center and continues to load balance traffic to the local VMs. Any active connections to the remote data center are allowed to complete.

Table 6-31 lists the VM probe attributes, which allow you to control when the ACE bursts traffic to remote VMs.

Table 6-31 VM Probe Attributes
Field	Action
Probe Interval (seconds)	Frequency in seconds with which the ACE sends probes to the VM controller. Enter an integer from 300 to 65535. The default is 300 (5 minutes).
Max CPU Burst Threshold	Threshold for the maximum percentage of the CPU usage based on the average load information for all local VMs. When the CPU usage percentage reaches or exceeds this threshold, the ACE starts bursting traffic to the remote VMs. Enter a value from 1 to 99. The default is 99.
Min CPU Burst Threshold	Threshold for the minimum percentage of the CPU usage based on the average load information for all local VMs. When the CPU usage percentage drops below this threshold, the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99 percent. The default is 99.
Max Memory Burst Threshold	Threshold for the maximum percentage of the memory usage based on the average load information for all local VMs. When the memory usage percentage reaches or exceeds this threshold, the ACE starts bursting traffic to the remote VMs. Enter a value from 1 to 99 percent. The default is 99
Min Memory Burst Threshold	Threshold for the minimum percentage of the memory usage based on the average load information for all local VMs. When the memory usage percentage drops below this threshold, the ACE stops bursting traffic to the remote VMs. Enter a value from 1 to 99 percent. The default is 99.
VM Controller Name	Identifier of the VM controller that you configured in the "Configuring and Verifying a VM Controller Connection" section. Click the radio button for the VM controller.

Related Topics