Cisco ACE 4700 Series Application Control Engine Appliance

138 Pages·2012·2.98 MB·English

Quick Start Guide, Cisco ACE 4700
Series Application Control Engine
Appliance
Software Version A5(1.0)
September 2011
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-25334-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
Copyright © 2011, Cisco Systems, Inc. All rights reserved.
C O N T E N T S
Preface ix
Audience x
How to Use This Guide x
Related Documentation xi
Symbols and Conventions xiii
Obtaining Documentation, Obtaining Support, and Security Guidelines xv
CHAPTER 1 Overview 1-1
ACE Technologies 1-2
Setting Up an ACE Appliance 1-3
Creating Virtual Contexts 1-3
Configuring Access Control Lists 1-3
Configuring Role-Based Access Control 1-3
Configuring a Virtual Server 1-3
Configuring a Load-Balancing Predictor 1-4
Configuring Server Persistence Using Stickiness 1-5
Configuring SSL Security 1-5
Configuring Health Monitoring Using Health Probes 1-5
Configuring Redundancy 1-6
Configuring Bridged Mode 1-6
Configuring One-Armed Mode 1-6
Where to Go Next 1-7
CHAPTER 2 Setting Up an ACE Appliance 2-1
Information About Setting Up an ACE 2-1
Prerequisites for Setting Up an ACE 2-3
Default Settings 2-3
Setting Up an ACE 2-4
Establishing a Console Connection on the ACE 2-4
Enabling Management Connectivity Using the Setup Script 2-6
Assigning a Name to the ACE 2-9
Setting Up an ACE Appliance Using the Device Manager GUI 2-9
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
OL-25334-01 iii
Contents

Logging in to the Device Manager GUI 2-9
Configuring a Second Gigabit Ethernet Interface Port 2-11
Configuring a Third Gigabit Ethernet Interface Port 2-12
Setting Up an ACE Appliance Using the CLI 2-12
Logging in to the ACE 2-13
Configuring the First Gigabit Ethernet Port 2-13
Allocating the First Gigabit Ethernet Port to a VLAN 2-14
Configuring a Management VLAN Interface on the ACE 2-15
Configuring a Second Gigabit Ethernet Interface Port 2-16
Configuring a Third Gigabit Ethernet Interface Port 2-16
Configuring Remote Management Access to the ACE 2-16
Accessing the ACE through a Telnet Session 2-18
Where to Go Next 2-18
CHAPTER 3 Creating a Virtual Context 3-1
Information About Virtualization 3-1
Licensing Requirements for Virtual Contexts 3-2
Configuring a Virtual Context 3-3
Creating a Virtual Context Using the Device Manager GUI 3-3
Creating a Resource Class 3-3
Creating a Virtual Context 3-4
Configuring the Client-Side VLAN Interface 3-5
Configuring the Server-Side VLAN Interface 3-6
Creating a Virtual Context Using the CLI 3-7
Configuring a Resource Class 3-7
Creating a Virtual Context 3-8
Configuring a Management VLAN Interface to the User Context 3-8
Configuring Remote Management Access to the User Contexts 3-9
Configuring the Client-Side VLAN Interface 3-10
Configuring the Server-Side VLAN Interface 3-11
Configuration Examples for Configuring a Virtual Context 3-12
Admin Context Configuration Example 3-12
VC_web Configuration Example 3-13
Where to Go Next 3-13
CHAPTER 4 Configuring Access Control Lists 4-1
Information About ACLs 4-1
Guidelines and Restrictions 4-2
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
iv OL-25334-01
Contents

Configuring an ACL 4-2
Configuring an ACL Using the Device Manager GUI 4-2
Configuring an ACL Using the CLI 4-3
Configuration Example for Configuring an ACL 4-4
Where to Go Next 4-4
CHAPTER 5 Configuring Role-Based Access Control 5-1
Information About Role-Based Access Control 5-1
Configuring RBAC 5-3
Configuring RBAC Using the Device Manager GUI 5-3
Configuring RBAC Using the CLI 5-4
Configuration Example for Configuring RBAC 5-5
Where to Go Next 5-5
CHAPTER 6 Configuring Server Load Balancing 6-1
Information About Server Load Balancing 6-1
Configuring Server Load Balancing 6-2
Configuring Layer 7 Server Load Balancing Using the Device Manager GUI 6-2
Configuring Layer 7 Server Load Balancing Using the CLI 6-4
Configuring Real Servers 6-4
Creating a Server Farm 6-5
Creating a Virtual Server Traffic Policy 6-6
Configuration Example for Configuring Server Load Balancing 6-8
Where to Go Next 6-9
CHAPTER 7 Configuring a Load-Balancing Predictor 7-1
Information About Load-Balancing Predictors 7-1
Configuring a Hash Header Predictor 7-2
Configuring a Hash Header Predictor Using the Device Manager GUI 7-2
Configuring a Hash Header Predictor Using the CLI 7-2
Configuration Example for the Hash Header Predictor 7-3
Where to Go Next 7-4
CHAPTER 8 Configuring Server Persistence Using Stickiness 8-1
Information About Configuring Stickiness 8-1
Configuring HTTP Cookie Stickiness 8-4
Configuring HTTP Cookie Stickiness Using the Device Manager GUI 8-4
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
OL-25334-01 v
Contents

Configuring HTTP Cookie Stickiness Using the CLI 8-4
Configuration Example for the Hash Header Predictor 8-6
Where to Go Next 8-7
CHAPTER 9 Configuring SSL Security 9-1
Information About SSL 9-1
Licensing Requirements for SSL 9-4
Prerequisites for Configuring SSL 9-4
Configuring SSL Termination 9-5
Configuring the ACE for SSL Termination Using the Device Manager GUI 9-5
Configuring the ACE for SSL Termination Using the CLI 9-6
Configuration Example for SSL Termination 9-8
Where to Go Next 9-9
CHAPTER 10 Configuring Health Monitoring Using Health Probes 10-1
Information About Configuring Health Monitoring 10-1
Prerequisites for Configuring Health Monitoring 10-2
Configuring an HTTP Health Probe 10-2
Configuring an HTTP Health Probe Using the Device Manager GUI 10-2
Configuring an HTTP Health Probe Using the CLI 10-3
Configuration Example for an HTTP Health Probe 10-4
Where to Go Next 10-5
CHAPTER 11 Configuring Redundant ACEs 11-1
Information About Redundancy 11-1
Guidelines and Limitations 11-2
Configuring Redundancy 11-4
Configuring Redundancy Using the Device Manager GUI 11-4
Configuring High Availability Peers 11-4
Configuring ACE High Availability Groups 11-6
Configuring Redundancy Using the CLI 11-7
Configuring an FT VLAN 11-7
Configuring an FT Peer 11-8
Configuring an Alias IP Address 11-8
Configuring an FT Group 11-9
Configuration Example for Redundancy 11-10
Where to Go Next 11-11
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
vi OL-25334-01
Contents

CHAPTER 12 Configuring Bridged Mode 12-1
Information About Configuring Bridged Mode 12-1
Prerequisites 12-2
Guidelines and Limitations 12-2
Configuring Bridged Mode on the ACE 12-4
Configuring Server Load Balancing 12-4
Configuring Bridged Mode Using the Device Manager GUI 12-5
Configuring Bridged Mode Using the CLI 12-6
Configuration Example for Bridged Mode 12-8
Where to Go Next 12-9
CHAPTER 13 Configuring One-Arm Mode 13-1
Information About One-Arm Mode 13-1
Guidelines and Limitations 13-2
Prerequisites for One-Arm Mode on the ACE 13-2
Configuring One-Arm Mode on the ACE 13-3
Configuring Server Load Balancing and Source NAT 13-3
Configuring One-Arm Mode Using the Device Manager GUI 13-4
Configuring One-Arm Mode Using the CLI 13-5
Configuration Example for One-Arm Mode 13-6
Where to Go Next 13-7
INDEX
Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
OL-25334-01 vii
Contents

Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance
viii OL-25334-01
Preface
This guide provides the following information:
• An overview of the major functions and features of the Cisco 4700 Series Application Control
Engine (ACE) appliance
(cid:129) Instructions on how to initially configure the ACE to allow traffic and basic load balancing
(cid:129) Instructions on how to configure the ACE to provide various scalability and security capabilities
(cid:129) References to find the information in the documentation set
This preface contains the following major sections:
(cid:129) Audience
(cid:129) How to Use This Guide
(cid:129) Related Documentation
(cid:129) Symbols and Conventions
(cid:129) Obtaining Documentation, Obtaining Support, and Security Guidelines
Getting Started Guide, Cisco ACE 4700 Series Application Control Engine Appliance
OL-25334-01 ix
Preface

Audience
This guide is intended for the following trained and qualified service personnel who are responsible for
configuring the ACE:
(cid:129) Web master
(cid:129) System administrator
(cid:129) System operator
How to Use This Guide
This guide is organized as follows:
Chapter Description
Chapter 1, Overview Provides an overview of the major functions and
features of the ACE
Chapter 2, Setting Up an Provides procedures to initially configure the ACE to
ACE Appliance allow the passing of traffic and remote access
Chapter 3, Creating a Provides procedures to partition the ACE into virtual
Virtual Context contexts for more efficient operation
Chapter 4, Configuring Provides procedures to configure an access control
Access Control Lists list in an ACE to secure your network
Chapter 5, Configuring Provides procedures to configure a user with
Role-Based Access permission to perform limited operations and access
Control a subset of your network
Chapter 6, Configuring Provides procedures to configure the ACE to allow
Server Load Balancing basic server load balancing
Chapter 7, Configuring a Provides procedures to select a predefined predictor
Load-Balancing for server load balancing
Predictor
Chapter 8, Configuring Provides procedures to configure server persistence
Server Persistence Using for requests from a client using stickiness
Stickiness
Chapter 9, Configuring Provides procedures to configure SSL security for
SSL Security your network
Chapter 10, Configuring Provides procedures to configure server health
Health Monitoring Using monitoring using health probes
Health Probes
Chapter 11, Configuring Provides procedures for configuring fault tolerance
Redundant ACEs in your network.
Getting Started Guide, Cisco ACE 4700 Series Application Control Engine Appliance
x OL-25334-01