Solved

CSS11501 Content Switch - Load Balancing Web Servers, what should the default gateway for the Servers be?

Posted on 2008-06-11
6
1,734 Views
Last Modified: 2010-04-21
I just joined a company that uses a Cisco CSS11501 to load balance 2 web servers. I'm not familiar with the CSS11501, so I was hoping someone could help me.
The web servers are very slow, and I suspect the default gateway is wrong, here's the network topology.

Public IP of virtual IP address of load balanced Servers. Say it's
67.1.1.2
Cisco Pix Firewall - Static 67.1.1.2 = 192.168.165.100 (it's in our DMZ)
DMZ Interface on PIX - 192.168.165.254
In DMZ
CSS 11501 eth1 - 192.168.165.251 /24
CSS 11501 eth2 - 10.0.0.1 /8 (same vlan, it's the 192.168.165.x vlan)
Web Server 1 - 1st IP = 192.168.165.101 /24, 2nd IP = 10.0.0.101, gateway = 192.168.165.251 (the CSS not the firewall)
Web Server 2 - 1st IP = 192.168.165.102 /24, 2nd IP = 10.0.0.102, gateway = 192.168.165.251 (the CSS not the firewall)

I don't know how the CSS works for sure, and it's all LIVE so I'm loathed to just change it to see, it's used by 32K distributors.

Am I correct, should the default gateway on the Servers be 192.168.165.254 (the firewall)? It seems everything goes back out via the CSS (.251) and it's painfully slow.

Here's the relevent part of the CSS config.

  ip route 0.0.0.0 0.0.0.0 192.168.165.254 1

!************************* INTERFACE *************************
interface e1
  phy 100Mbits-FD

interface e2
  phy 100Mbits-FD
  bridge vlan 10

interface e8
  admin-shutdown

!************************** CIRCUIT **************************
circuit VLAN1

  ip address 192.168.165.251 255.255.255.0

circuit VLAN10

  ip address 10.0.0.1 255.0.0.0

!************************** SERVICE **************************

service www101
  ip address 10.0.0.101
  active

service www102
  ip address 10.0.0.102
  active

!*************************** OWNER ***************************
owner development

  content dev
    balance leastconn
    advanced-balance sticky-srcip
    add service www101
    add service www102
    vip address 192.168.165.100
    active


Thanks in advance for any help!
0
Comment
Question by:gahooper
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 5

Expert Comment

by:WebDOT
ID: 21772248
We run two Cisco 11503 CSS (which I am assuming are very close).  In our environment, we set the default gateway of the servers to the IP address of the VLAN Circuit.

Here is how ours is set up, web servers use default gateway of xxx.xxx.xxx.163

!************************* INTERFACE *************************
interface  1/1
  bridge vlan 68

interface  1/2
  bridge vlan 67

!************************** CIRCUIT **************************
circuit VLAN67

  ip address xxx.xxx.xxx.163 255.255.255.0

So, YES, it appears that your servers are set up correctly.  Now whether or not everything else on the CSS is configured properly is another question...
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 21780393
The servers default gateway should be 10.0.0.1.
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 21780425
Let me add.

Seems like the web servers should have a default gateway of 10.0.0.1 and the CSS should have a default route via the Firewall (192.168.165.254).  I'm not sure why the web servers have interfaces directly on the 192.168.165.0 subnet unless they host sites that aren't load balance via the CSS.
0
Forrester Webinar: xMatters Delivers 261% ROI

Guest speaker Dean Davison, Forrester Principal Consultant, explains how a Fortune 500 communication company using xMatters found these results: Achieved a 261% ROI, Experienced $753,280 in net present value benefits over 3 years and Reduced MTTR by 91% for tier 1 incidents.

 

Author Comment

by:gahooper
ID: 21781048
Thanks everyone for your feedback.

Here's some more info.

The web servers have 2 IP addresses on their NIC, 192.168.165.101/10.0.0.101 for Server 1, and 192.168.165.102/10.0.0.102 for Server 2.

The CSS accesses the Servers via the 10.0.0.x address. The Servers access the Oracle database via their 192.168.165.x address, which is on another subnet 192.168.129.x.

Now, the web servers have a gateway of 192.168.165.251 (the CSS). So it appears to me that all the database access goes via the CSS. If I change the default gateway on the Servers to 192.168.165.254 (the firewall) the Servers work fast, and as I expect. The question is, would this cause the load balancing on the CSS to stop working?

The Web Servers are live, I tested with a test box, I'm loathed to take an outage trying toi find out.

Thanks in advance for your help.
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 21781443
Option 1 is to simply make the web servers default gateway 10.0.0.1 so all traffic is routed via the CSS.  I don't know if this will work any better than your current setup and may require Firewall rule modifications as the source of traffic would now be the 10.0.0.x address when talking with the database servers.

You could make the web servers default gateway 10.0.0.1 but add routes to the web servers for the database servers via the Firewall if you want to bypass the CSS for web to database traffic but in the end, the client traffic to the web servers needs to return to the CSS.

Alternatively, you could make the default gateway the Firewall and use source NAT on the CSS so client addresses appear to the web server as a 10.0.0.x address and will be sent back to the CSS.  All other traffic will be routed to the Firewall.
0
 

Author Closing Comment

by:gahooper
ID: 31466385
Thanks!! I appreciate you help.
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question