<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>I’ve taken over a SI 4G config (not a pretty one to
say the least) from our data center provider and I’m having trouble with
an issue accessing a VIP across VLANs. I have 3 different VLANS …
10.9.33.0/24 for the DMZ, 10.9.34.0/24 for private, and 10.9.35.0/24 for the
servers behind the SI. I have server source-ip’s in all 3
VLANs (management interface resides in 10.9.33.0/24). I have a VIP listening
on 10.9.34.50, with two servers behind it, both servers have two interfaces,
one in 10.9.34.0/24 for domain controller / standard network communications,
and one in 10.9.35.0 where the SI real server traffic hits. A Cisco ASA
serves as the router / firewall between the 3 subnets. The servers have a
default gateway on the 10.9.34.0/24 subnet pointing at the ASA, and the
real-server config in the SI has source-nat enabled.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>My issue is, from the 10.9.34.0/24 subnet, I can access the
VIP on 10.9.34.50 without issue. However, when I attempt to access the
VIP from the 10.9.33.0/24 subnet, it appears I’m getting lost on the
return traffic (looking at the ASA logs I see the outbound connection to the
VIP establish successfully, but then it fails from what seems to be never
getting any return traffic). I’ve pasted the pertinent areas of my
config below, does anyone have any tips or advice on what might be the
issue? I’ve played around with the routing quite a bit, including
forcing the default gateway on the servers (and via static routes) back to the
SI on 10.9.35.7 and 10.9.34.7 with no success….<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>server source-ip 10.9.34.7 255.255.255.0 10.9.34.5<o:p></o:p></p>
<p class=MsoNormal>server source-ip 10.9.35.7 255.255.255.0 10.9.35.5<o:p></o:p></p>
<p class=MsoNormal>server router-ports ethernet 1<o:p></o:p></p>
<p class=MsoNormal>server router-ports ethernet 2<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>server real flapp1 10.9.35.22<o:p></o:p></p>
<p class=MsoNormal> source-nat<o:p></o:p></p>
<p class=MsoNormal> port http<o:p></o:p></p>
<p class=MsoNormal> port http url "HEAD /"<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>server real flapp2 10.9.35.23<o:p></o:p></p>
<p class=MsoNormal> source-nat<o:p></o:p></p>
<p class=MsoNormal> port http<o:p></o:p></p>
<p class=MsoNormal> port http url "HEAD /"<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>server virtual flapp_http 10.9.34.50<o:p></o:p></p>
<p class=MsoNormal> port http<o:p></o:p></p>
<p class=MsoNormal> bind http flapp1 http flapp2 http<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>vlan 1 name DEFAULT-VLAN by port<o:p></o:p></p>
<p class=MsoNormal> no spanning-tree<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>vlan 100 by port<o:p></o:p></p>
<p class=MsoNormal> tagged ethe 1 to 2<o:p></o:p></p>
<p class=MsoNormal> no spanning-tree<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>vlan 101 by port<o:p></o:p></p>
<p class=MsoNormal> tagged ethe 1 to 2<o:p></o:p></p>
<p class=MsoNormal> no spanning-tree<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>vlan 102 by port<o:p></o:p></p>
<p class=MsoNormal> tagged ethe 1 to 2<o:p></o:p></p>
<p class=MsoNormal> no spanning-tree<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>vlan 2 by port<o:p></o:p></p>
<p class=MsoNormal> untagged ethe 4<o:p></o:p></p>
<p class=MsoNormal> no spanning-tree<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>vlan 103 by port<o:p></o:p></p>
<p class=MsoNormal> tagged ethe 1 to 2<o:p></o:p></p>
<p class=MsoNormal>!<o:p></o:p></p>
<p class=MsoNormal>ip address 10.9.33.7 255.255.255.0<o:p></o:p></p>
<p class=MsoNormal>ip default-gateway 10.9.33.5<o:p></o:p></p>
</div>
</body>
</html>