Can't see traffic on Web and App Server tiers after Load Balancer

Question

Customer has given us the Load Balancer, Web, App and Database server IP addresses and ports.

However, we can only see the application traffic on the Load Balancer and Database (Oracle) tiers.

We can't see the IP addresses on the Web or App tiers.

Could the load balancer have changed the IP address?

It's a Cisco CSS load balancer configured in bridge mode.

Thanks!

Answer 1

Answer by Ulf T. · Apr 24, 2015 at 02:45 PM

Hi

Do you see the IP addresses in the RUM Console under "Verify Traffic" or in the CAS under "Software Services"?

0 Show 1 · Share

Victor G. · Apr 27, 2015 at 01:20 AM 0

Share

Thanks for your reply, Ulf.

We do see some IP addresses on the Web and App tiers defined, but they are not coming from the Load Balancer (LB) IP adress.

Based on the architecture, we should see:

LB -> Web -> App -> DB (Database)

On the Web tier defined based o the IP addresses and ports (80 and 443) given by the customer, we can't see traffic coming from the LB.

We have installed the SSL key on the Web tier, and can decode SSL traffic.

Cheers!

Answer 2

Answer by Ulf T. · Apr 27, 2015 at 08:32 AM

How is the source of the network traffic set up?

Is it SPAN, TAP or VACL?

/Ulf

0 Show 1 · Share

Victor G. · Apr 27, 2015 at 09:06 AM 0

Share

it's a span, port mirror.

Answer 3

Answer by Ulf T. · Apr 27, 2015 at 09:09 AM

So what is the traffic you see against the servers and can you see any traffic to/from the LB?

Are you sure there are not more than one NIC or that there are some virtual/teaming NIC's o the servers?

0 · Share