Skip Links

Network World

  • Social Web 
  • Email 
  • Close
 

Question of the Day

Proxy CSS1500 issue

I have an issue with load-balancing connections from a proxy server.

The issue is some of the services I am running on the backend server farm require persistance. This is posing a problem as with source IP persistance - the connections will all always go to the same real server as the connection are all being sourced by the proxy server.

I have thought about cookie persistance, but think the same issue will occur as the cookie will be placed on the proxy and not the real client intiating the request.

I have also thought of using L4 persistance but once again we will hit the same issue as the same port will alway be coming from the proxy server.

Has anyone come across this issue before and know how to resolve it? Any help would be greatly appreciated.

Nutter
Answer by Ron Nutter

Expert's answer

To see where changes need to be made, we need to look at each step in the communications process. Starting with the CS1500, I would make sure you are running the latest version of firmware available for the device. If this doesn't resolve the problem, try opening a case with Cisco TAC to see if there are any configuration changes that you can make that will help resolve the problem. I will assume that you are using a commercial proxy server for the rest of the options that I will discuss. While Cisco TAC may push back a bit because you are using a third-party proxy server, they should still be able to provide some troubleshooting steps to help you identify where the problem is and possibly how to resolve it.

Try to white list the internal servers that you are having problems with. Whitelisting in the context I have used it will tell the proxy server not to do anything in terms of caching the server or anything else. If this appears to fix things, then you need to start digging deeper into the proxy server configuration to see how you can get things to work the way you need them to.

As with the CSS1500, I would suggest that you installe the lastest firmware/software for the proxy server. This could either fix the problem or give you some additional tools to work with. The next troubleshooting step is to run a proctocol analyzer at three different points - between the CSS1500 and the external part of your network where the users are, between the proxy server and the CSS1500 and between the servers and the proxy server. Sniffing the traffic between each of these points should give you additional information as to where configuration changes to consider. It will also provide the vendor technical support folks you will be working with good information to help identify a fix.

When looking for a fix for a problem when the traffic is flowing between a load balancer and a proxy server, document the steps you took to find the information about how the communications are flowing. I worked with one of my readers last year who was in a similar configuration and found that with one of the applications on their network that each time the application was upgraded that they had to make minor tweaks to the previous fix to get things to work again. Having the initial resolution documented helped to quickly identify what had to be changed to get things working again.

Recently Asked Questions

Telecom software certification?

Average: 5 (1 vote)

Hi,

I am a software engineer in the telecom sector, working on VoIP on Session Initiation Protocol.

I like to know which are the certification courses that can be benificial in my career growth as per learning and as per growth prospectives.

Whether CCNA will help me regarding my career growth.

Regards,
KD

Nutter
Answer by Ron Nutter

Expert's answer

KD:

Having your CCNA certainly wouldn't hurt: It'll help give you a good grounding in the OSI model, the math you will need to be comfortable with in handling a network of any size, the basics of routing, etc.

There are several areas that you can look at moving onto from there. Which ones will depend on your focus in VoIP and the the hardware that you will be running it on.

Cisco has several options worth considering. A newly announced certification, CCNA Voice, might be the next step - you'll need to have your CCNA for this. CCNA Wireless starts to move you into VoIP specific parts of Cisco Unified Messaging. Depending on how far you want to take it, at least on the Cisco side of things, you can then look at CCVP, which is a series of 4 exams taking you deeper into the VoIP world.

There are a host of other VOIP related certifications that you can pursue from companies such as CompTIA, Lucent and Alcatel. What you should consider pursuing will depend in part as to what hardware platforms you plan on being involved with or would like exposure to.

Connecting 2 LAN cards in a single system

I have XP operated and win98 SE operating system. I am using VSNL Broadband connection in XP I had two lan cards located in XP one is on board (Realtek) and another is D-Link. I am connecting to internet using Realtek which have ip#192.1681.1 and defa gateway#192.168.1.254 and dns which are provided by ISP.
Now I want to connect both systems in P2P using other lancard I had installed drivers but In system tray its showing as lancard unplugged (whcih I want to used for P2P).

Please tell me how can I connect both the systems (xp & 98) along this can I share internet.

Blass
Answer by Steve Blass

Expert's answer

If you are connecting the XP and Win98 computers with a cable going directly from one computer's ethernet port to the other you will need to use a "null-modem ethernet cable" rather than a standard ethernet cable.

If you are going through a hub or router then you would use regular ethernet cable.

If you are using the proper cabling then after double checking that your physical connections are securely in place open up the control panel on the XP system and dig down into the System/Hardware/Device Manager applet and expand the Network adapters section of the tree and verify that both cards are listed there. If they are not both listed in the Network adapters list you may need to find the missing adapter under the big yellow question mark section and delete the device from the list, reboot, and re-install the driver software.

If they are both in the Network adapters list check the properties of each to ensure that there are no conflicts listed in the Resources panel of the Properties dialog. If there are conflicts identified you may need to change settings on one or the other network adapter to eliminate the conflicts.

Another possibility is to use a hub and the single working network adapter in the XP box along with Internet Connection Sharing to connect the Win98 machine to the Internet by setting up Internet Connection Sharing on the XP system, connecting both machines to the hub, the hub to the internet, and aiming the Win98 system's gateway address at the XP machine.

Problem connecting to wireless at home

Average: 1 (1 vote)

I used to be able to connect to my home wireless with no problems. I recently reformatted my laptop and of course I had to download drivers and such. However, now I'm having problems getting a connection wirelessly. I am connected with excellent signal strength but the status says "limited or no connectivity". I don't think anything is wrong with the modem because I am able to establish a wired connection. Thanks for any attempts to help.

Nutter
Answer by Ron Nutter

Expert's answer

There are several things to look at. The first is to get a copy of inSSIDer from the folks at MetaGeek.net. I used to suggest Netstumbler but it doesn't have support for WPA. If you can see your access point (AP) with inSSIDer, that would indicate that the AP is OK and the area you need to concentrate is your laptop.

You don't mention the version of Windows that you are running on. If it is XP, you really want to install XP SP 3, because it fixes several wireless-related problems. If you are on Vista, make sure you have the latest patches installed. Make sure that you have the latest firmware installed on your AP.

You may need to taking things down a step or two on your AP depending on how hard you have it locked down. If you have broadcasting turned off for your SSID, try enabling it just to make it easier for the laptop to find the AP. If inSSIDer shows the SSID for your AP, try using the wireless survey functionality that is included with most to see if it also sees the AP as well. I like using different apps that do the same test just to make sure you get the same results.

If you have encryption turned on at the AP (and you should), temporarily turn off encryption to see if it is a setting problem between AP and your laptop. Depending on the type and level of encryption used, you might have a setting problem between the two devices that could explain the problem. For example WPA and WPA2 are similar encryption methods but you can't use WPA to talk to WPA2. Depending on who made the wireless card in your laptop (it is probably Intel), go directly to the wireless-car vendor's Web site and get the latest drivers (it's possible that the latest drivers are not on the laptop vendor's website).

Look for things in the immediate area of your laptop and access point that may have changed. If you have a cordless phone, see if it is in the same frequency range as your AP. If the phone is labeled with something like 2.4 somewhere on the phone, try removing power from the phone and see if your wireless problem goes away. If that fixes it, you will need to change out your wireless phone to one that uses either 900-Mhz or the 5-Gigahertz range.

Netflow in CS-MARS

Average: 5 (1 vote)

Hi all,

NetFlow is also involved in CS-MARS for anomaly detection. Can anyone tell me is there any any difference when NetFlow data used in NFC Engine/CS-MARS.Is there any performance issues result over the Netflow data used in NFC/CS-MARS.

Regards,
Srini

Blass
Answer by Steve Blass

Expert's answer

This Cisco security presentation discusses using Netflow with CS-Mars and indicates that enabling Netflow 5 and exporting data can increase CPU load on the router between 15 and 20 percent and that Netflow traffic may represent between 1 and 1.5 percent of the network traffic being monitored. The Device Configuration Guide for Cisco Security MARS, Release 6.x says that NSEL, which is an adaptation of Netflow 9 can transmit much of the same information in a less CPU-intensive, more secure, and more bandwidth-efficient way. The performance difference between using CS-MARS or the Netflow Collector Engine is going to depend on the hardware and which version(s) of software you are running.

Making the jump from IT Director

I have been in IT for almost 20 years now and have worked my way all the way up from the help desk to an IT Director in the Healthcare industry.

I have been lucky enough to have hands on and management experience in cutting edge technology as well as experience in integrating IT services into acute/critical business processes with great success. I am very comfortable with the technology part as well as the managing of those departments and setting course for future direction.

My question is; how would one make the jump from an IT Director to a more senior level position?

I have been told once you get out of the Director chair it is more about "who" you know rather than "what" you know. Having spent most of my career on the "what", I am looking for direction to fine tune my skills in the "who" portion.

Blass
Answer by Steve Blass

Expert's answer

The easiest way to become a CEO is to start your own company.

Rising from a director level position to a more senior management or CxO level position otherwise is not something I have a lot of experience with. The people around me in corporate settings who made that move to the next level successfully were invited upstairs so there may be some validity in your statement about who you know versus what you know. The key seemed to be ensuring that senior management knows you well enough to have good knowledge about what you could accomplish beyond meeting the expectations of the current position. I have also seen people move from Director level positions in large enterprises to CxO level positions in small or mid-market enterprises where the companies they moved to were comparable in size and complexity to the department or division they were in before.

Perhaps there are readers with more experience than I who can share their wisdom on the subject.

What does 'Show Process CPU' on a 6509 router do?

When I enter Show Process CPU on a 6509 router, I am getting following results, in that i can see "Port manager per" process. I want to know the meaning of that particular process.

Blass
Answer by Steve Blass

Expert's answer

n/a