Friday, June 8, 2007

FTP serverfarm on Cisco ACE

This is a mix from Cisco forums and hundreds of trials, being the Cisco ACE Server Load Balancing configuration guide not so clear...

Scenario :

Active FTP :
This is the simpler and it's only a matter of ACE configuration :

probe tcp 21-TCP
port 21
interval 10
passdetect interval 5
passdetect count 1

rserver host SERVER-10.1
ip address

rserver host SERVER-10.2
ip address

serverfarm host FTPFARM_20.1:21
failaction purge
probe 21-TCP
SERVER-10.1 21
rserver SERVER-10.2 21

sticky ip-netmask address source
timeout 20
timeout activeconns
replicate sticky

class-map match-all L4-MAP-FTPFARM_20.1:21
2 match virtual-address any

policy-map type loadbalance first-match L7-
class class-default
sticky-serverfarm STICKY-

policy-map multi-match L4-POLICYMAPMULTI-FTP
class L4-MAP-FTPFARM_20.1:21
loadbalance vip inservice
loadbalance policy
inspect ftp

interface vlan 101
description SERVERSIDE
ip address
no normalization
no shutdown
interface vlan 151
description FIREWALLSIDE
ip address
no normalization
service-policy input L4-POLICYMAPMULTI-FTP
no shutdown

Passive FTP :
In order to make Passive FTP connection work, with the firewall checking consistency of source and destination addresses, youll need to change the FTP server configuration.
On the frox server there's a configuration parameter "PASV Reply Address" that should be set to the VIP ( in order to have the FTP server call back the client (passive mode) with the same address the firewall see for the active client-server communication.


Oleg said...

Interesting how you could run this config, as if you would try to apply "inspect ftp" on that serverfarm you would suppose to get
error message:

Error: This class doesn't have tcp protocol and a specific port

due to the fact that your VIP is with "any"

Al said...

I could run this config on a A1.x ACE.

The A2.x ACEs introduced the check on the any port on protocol inspection.

The release note is much clearer :