<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div>Brian,<br><br>What is the gateway from the real servers back into the network to get to 10.9.34.0/24? <br><br>It would seem, from your description, that traffic is leaving the source on 10.9.33.0/24 network, going via the ASA to the VIP, from the SI to the real on 10.9.35.0/24. Do the reals then have a default route or a specific route back to the .33 network via the ASA or the SI? If it's via the ASA, you're correct, your return traffic will get dropped as it's not aware of the forward connection in that context..<br><br>-Dave<br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">----- Original Message ----<br>From: "Williams, Brian"
<brian_williams@csgsystems.com><br>To: foundry-nsp@puck.nether.net<br>Sent: Wednesday, September 10, 2008 9:06:25 AM<br>Subject: [f-nsp] Multiple VLAN Issue<br><br>
<style>
<!--
_filtered {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:11.0pt;font-family:"Calibri", "sans-serif";}
a:link, span.MsoHyperlink
{color:blue;text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
span.EmailStyle17
{font-family:"Calibri", "sans-serif";color:windowtext;}
.MsoChpDefault
{}
_filtered {margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{}
-->
</style>
<div class="Section1">
<p class="MsoNormal">I’ve taken over a SI 4G config (not a pretty one to
say the least) from our data center provider and I’m having trouble with
an issue accessing a VIP across VLANs. I have 3 different VLANS …
10.9.33.0/24 for the DMZ, 10.9.34.0/24 for private, and 10.9.35.0/24 for the
servers behind the SI. I have server source-ip’s in all 3
VLANs (management interface resides in 10.9.33.0/24). I have a VIP listening
on 10.9.34.50, with two servers behind it, both servers have two interfaces,
one in 10.9.34.0/24 for domain controller / standard network communications,
and one in 10.9.35.0 where the SI real server traffic hits. A Cisco ASA
serves as the router / firewall between the 3 subnets. The servers have a
default gateway on the 10.9.34.0/24 subnet pointing at the ASA, and the
real-server config in the SI has source-nat enabled.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">My issue is, from the 10.9.34.0/24 subnet, I can access the
VIP on 10.9.34.50 without issue. However, when I attempt to access the
VIP from the 10.9.33.0/24 subnet, it appears I’m getting lost on the
return traffic (looking at the ASA logs I see the outbound connection to the
VIP establish successfully, but then it fails from what seems to be never
getting any return traffic). I’ve pasted the pertinent areas of my
config below, does anyone have any tips or advice on what might be the
issue? I’ve played around with the routing quite a bit, including
forcing the default gateway on the servers (and via static routes) back to the
SI on 10.9.35.7 and 10.9.34.7 with no success….</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">server source-ip 10.9.34.7 255..255.255.0 10.9.34.5</p>
<p class="MsoNormal">server source-ip 10.9..35.7 255.255.255.0 10.9.35.5</p>
<p class="MsoNormal">server router-ports ethernet 1</p>
<p class="MsoNormal">server router-ports ethernet 2</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">server real flapp1 10.9.35.22</p>
<p class="MsoNormal"> source-nat</p>
<p class="MsoNormal"> port http</p>
<p class="MsoNormal"> port http url "HEAD /"</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">server real flapp2 10.9.35.23</p>
<p class="MsoNormal"> source-nat</p>
<p class="MsoNormal"> port http</p>
<p class="MsoNormal"> port http url "HEAD /"</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">server virtual flapp_http 10.9.34.50</p>
<p class="MsoNormal"> port http</p>
<p class="MsoNormal"> bind http flapp1 http flapp2 http</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">vlan 1 name DEFAULT-VLAN by port</p>
<p class="MsoNormal"> no spanning-tree</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">vlan 100 by port</p>
<p class="MsoNormal"> tagged ethe 1 to 2</p>
<p class="MsoNormal"> no spanning-tree</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">vlan 101 by port</p>
<p class="MsoNormal"> tagged ethe 1 to 2</p>
<p class="MsoNormal"> no spanning-tree</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">vlan 102 by port</p>
<p class="MsoNormal"> tagged ethe 1 to 2</p>
<p class="MsoNormal"> no spanning-tree</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">vlan 2 by port</p>
<p class="MsoNormal"> untagged ethe 4</p>
<p class="MsoNormal"> no spanning-tree</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">vlan 103 by port</p>
<p class="MsoNormal"> tagged ethe 1 to 2</p>
<p class="MsoNormal">!</p>
<p class="MsoNormal">ip address 10.9.33.7 255.255.255.0</p>
<p class="MsoNormal">ip default-gateway 10.9.33.5</p>
</div>
</div></div></div></body></html>