Comments on: Cisco Application Control Engine (ACE) – Introduction and Comparison With F5 http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/ Network design, architecture, thinking, working. Tech. Tue, 22 May 2012 13:24:00 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Should I Choose Cisco Service Modules for the Future http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-97 Should I Choose Cisco Service Modules for the Future Sun, 19 Jun 2011 21:08:22 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-97 [...] belief in the Application Control Engine is pretty much over ( I previously reviewed it here ). For load balancers, I’m into F5 if I can get the money or anything else if I can’t. [...] [...] belief in the Application Control Engine is pretty much over ( I previously reviewed it here ). For load balancers, I’m into F5 if I can get the money or anything else if I can’t. [...]

]]> By: SE http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-96 SE Wed, 10 Nov 2010 05:44:18 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-96 F5 includes a performance calculation tool in the IRules editor. Use it, it will show what little tweaks can be made to code that will optimize it. Also read the TCL command syntax as they give you an idea as well. F5 includes a performance calculation tool in the IRules editor. Use it, it will show what little tweaks can be made to code that will optimize it. Also read the TCL command syntax as they give you an idea as well.

]]> By: kris http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-95 kris Tue, 01 Jun 2010 11:15:22 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-95 Hi, Why is that we are not able to access VIP from same vlan ? Hi,

Why is that we are not able to access VIP from same vlan ?

]]> By: Load Balance/Balanceadores de Carga, quem trabalha com WEB sabe a sua import‚ncia. | Coruja de TI http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-94 Load Balance/Balanceadores de Carga, quem trabalha com WEB sabe a sua import‚ncia. | Coruja de TI Thu, 15 Apr 2010 21:50:26 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-94 [...] grandes players, o F5 BIG-IP LTM e o Cisco ACE. Se tratando de performance, v·rios documentos e comparaÁıes dizem que as funcionalidades de load balance do Cisco Ace s„o superiores ao do F5 BIG-IP LTM. O [...] [...] grandes players, o F5 BIG-IP LTM e o Cisco ACE. Se tratando de performance, v·rios documentos e comparaÁıes dizem que as funcionalidades de load balance do Cisco Ace s„o superiores ao do F5 BIG-IP LTM. O [...]

]]> By: Greg Ferro http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-93 Greg Ferro Sat, 08 Aug 2009 10:56:22 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-93 Hi Keith The Cisco ACE4710 has a GUI console much like the ASDM on ASA, or SDM on IOS. You could use that to do a lot fo the configuration. If you are struggling to understand the policy/class-map way of configuring, then you might want to do a search for "C3PL" otherwise Cisco Common Classification Policy Language to get an introduction and to help you understand the way this works. Since I use C3PL is used on all Cisco products (ASA, IOS, and others) I am quite used to used to it, but it did take a while. With regards to F5, until they support virtualisation (currently projected for NEVER) there is no way I will go back. They are not that great. Funky features, but the same problems as the ACE. Hi Keith

The Cisco ACE4710 has a GUI console much like the ASDM on ASA, or SDM on IOS. You could use that to do a lot fo the configuration.

If you are struggling to understand the policy/class-map way of configuring, then you might want to do a search for “C3PL” otherwise Cisco Common Classification Policy Language to get an introduction and to help you understand the way this works.

Since I use C3PL is used on all Cisco products (ASA, IOS, and others) I am quite used to used to it, but it did take a while.

With regards to F5, until they support virtualisation (currently projected for NEVER) there is no way I will go back. They are not that great. Funky features, but the same problems as the ACE.

]]> By: Keith Boblits http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-92 Keith Boblits Fri, 07 Aug 2009 22:15:59 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-92 We have just purchased several sets of ACE appliances (4710) since Cisco has strongly encouraged us not to deploy their CSS product in new environments. I must say there is quite a difference when contrasted with the CSS and the ease of configuration is not so intuitive. I find the ìpolicy mapsî more difficult to work with when creating load balancing rules and the configuration as a whole doesnít appear as structured as the CSS. Iím not a GUI person since I want to see the ìunder the hoodî pieces of the configuration. I do realize the ACE is more feature rich than the CSS, however. Iím not sure if patience will win out but there has been talk of looking into F5 in the future. We have just purchased several sets of ACE appliances (4710) since Cisco has strongly encouraged us not to deploy their CSS product in new environments. I must say there is quite a difference when contrasted with the CSS and the ease of configuration is not so intuitive. I find the ìpolicy mapsî more difficult to work with when creating load balancing rules and the configuration as a whole doesnít appear as structured as the CSS. Iím not a GUI person since I want to see the ìunder the hoodî pieces of the configuration. I do realize the ACE is more feature rich than the CSS, however. Iím not sure if patience will win out but there has been talk of looking into F5 in the future.

]]> By: Greg Ferro http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-91 Greg Ferro Thu, 02 Apr 2009 05:33:37 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-91 I don't find the CLI a problem, and most networking people are don't have a problem. People who are server-focussed sometimes have problems if they are not well practiced in using the CLI. Have you looked at using the Cisco Application Network Manager which is a graphical interface for administering and using the ACE modules ? I found this a lot easier when engaging with people who were used to GUI interfaces and didn't have much experience with CLI. I don’t find the CLI a problem, and most networking people are don’t have a problem. People who are server-focussed sometimes have problems if they are not well practiced in using the CLI.

Have you looked at using the Cisco Application Network Manager which is a graphical interface for administering and using the ACE modules ? I found this a lot easier when engaging with people who were used to GUI interfaces and didn’t have much experience with CLI.

]]> By: Bob http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-90 Bob Wed, 01 Apr 2009 23:07:25 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-90 Our experience with the ACE modules has been abysmal. Performing the simplest function (i.e., uploading an SSL cert) is difficult relative to F5 boxes. We have been working with Cisco TAC for 3 days now to get that little thing accomplished. Their UI is horrible and I can say for certain that there is no hope that our operations team will be able to do the simple things they need to do on their own (ie., move servers in and out of pools). All the power, throughput and price is useless if I need a CCIE and Cisco TAC to upload a simple certificate. The complexity of Cisco gear continues to be another reason why they will lose marketshare. Command line is great, but seems more like machismo at this point. Our experience with the ACE modules has been abysmal. Performing the simplest function (i.e., uploading an SSL cert) is difficult relative to F5 boxes. We have been working with Cisco TAC for 3 days now to get that little thing accomplished. Their UI is horrible and I can say for certain that there is no hope that our operations team will be able to do the simple things they need to do on their own (ie., move servers in and out of pools).

All the power, throughput and price is useless if I need a CCIE and Cisco TAC to upload a simple certificate. The complexity of Cisco gear continues to be another reason why they will lose marketshare. Command line is great, but seems more like machismo at this point.

]]> By: Greg Ferro http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-89 Greg Ferro Mon, 13 Oct 2008 20:20:38 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-89 elpingu I appreciate your feedback. I have found the later code works much better than the earlier releases, and quite a few new features. Probably on parity with the F5 now (at least for the non-microsoft features anyway). elpingu

I appreciate your feedback. I have found the later code works much better than the earlier releases, and quite a few new features. Probably on parity with the F5 now (at least for the non-microsoft features anyway).

]]> By: Greg Ferro http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-88 Greg Ferro Mon, 13 Oct 2008 20:19:01 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-88 mac-sticky is the same as the Distributed Director feature from years ago. Basically the LB remembers the mac-address of the device that the packet was originated from. Then, regardless of ANY other details (like ip routing), it will always send the replay packet from the flow, back to that source. Effectively this is layer 2 load balancing, perfect for load balancing layer 2 devices. mac-sticky is the same as the Distributed Director feature from years ago. Basically the LB remembers the mac-address of the device that the packet was originated from. Then, regardless of ANY other details (like ip routing), it will always send the replay packet from the flow, back to that source.

Effectively this is layer 2 load balancing, perfect for load balancing layer 2 devices.

]]> By: thedin http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-87 thedin Mon, 13 Oct 2008 06:37:21 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-87 I've been trying to figure out how to use ACE to do loadbalance a set of transparent caches. But still couldn't figure out the proper way to direct the return traffic (from the internet to the clients) to the exact cache that processed the outgoing traffic. Several Cisco guys pointed that I use the mac-sticky feature, but none provided as how that would solve the problem. Any ideas here ? I’ve been trying to figure out how to use ACE to do loadbalance a set of transparent caches. But still couldn’t figure out the proper way to direct the return traffic (from the internet to the clients) to the exact cache that processed the outgoing traffic. Several Cisco guys pointed that I use the mac-sticky feature, but none provided as how that would solve the problem. Any ideas here ?

]]> By: elpingu http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-86 elpingu Wed, 08 Oct 2008 04:01:58 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-86 I have many ACES 14 installed...all my equipment carries sup720 and right code.. so the aces fits right in...i can right away use any vlan without moving a single wire... I can say by experience that i have seen the ACE handle live 3.5 million sustanined connections i have seen it handle 990k nat translation sustained i have seen it push 3.5 gigd sustained... pure war story...not made up Now the initial code was buggy...and the replication broke easy... though upgrades replication is seamless and fails over nicely. I am a cli type of person and need so see and use text...dont like GUI too much. now for the bad part... they do advertise that they can handle 4000 vips..I have 550 and my configuration is very large and complicated ..access-list , nat ,vips ,l7. well with a very big configuration the ACE cannot apply the configuration properly and some config does not apply...it does not happen all the time but it happens and spist out an error message .you dont loose the config but it does not apply....they are working on this bug......but is very bad... again this is in very large configuration ..... yes the ACE is a workhorse and i can vouch for it..seen it but at code 2.1.2 they have some configuration size ceiling which sucks... I have many ACES 14 installed…all my equipment carries sup720 and right code..
so the aces fits right in…i can right away use any vlan without moving a single wire…
I can say by experience that i have seen the ACE handle live 3.5 million sustanined connections
i have seen it handle 990k nat translation sustained
i have seen it push 3.5 gigd sustained…
pure war story…not made up

Now the initial code was buggy…and the replication broke easy…
though upgrades replication is seamless and fails over nicely.

I am a cli type of person and need so see and use text…dont like GUI too much.

now for the bad part…
they do advertise that they can handle 4000 vips..I have 550 and my configuration is very large and complicated ..access-list , nat ,vips ,l7.

well with a very big configuration the ACE cannot apply the configuration properly and some config does not apply…it does not happen all the time but it happens and spist out an error message .you dont loose the config but it does not apply….they are working on this bug……but is very bad…

again this is in very large configuration …..

yes the ACE is a workhorse and i can vouch for it..seen it
but at code 2.1.2 they have some configuration size ceiling which sucks…

]]> By: George Smiley http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-85 George Smiley Sat, 03 May 2008 08:53:10 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-85 My company uses both F5 and ACE for LB. The ACE blade have so far shown to be quite unstable and in need of constant reboots. We have been forced to put our high-end customers on the F5 and I do not believe for a minute that ACE is capable of the advertised throughput. The only saving grace for the ACE is TAC appears to do better job in fielding support calls. In another 2 or 3 years, ACE code may become stable and not inundated with of bugs and until then, mission critical stuff stays on the F5. Cheers My company uses both F5 and ACE for LB. The ACE blade have so far shown to be quite unstable and in need of constant reboots. We have been forced to put our high-end customers on the F5 and I do not believe for a minute that ACE is capable of the advertised throughput. The only saving grace for the ACE is TAC appears to do better job in fielding support calls. In another 2 or 3 years, ACE code may become stable and not inundated with of bugs and until then, mission critical stuff stays on the F5.

Cheers

]]> By: My Etherealmind · Rant: F5 LTM and GTM doesn’t do external AAA authorization http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-84 My Etherealmind · Rant: F5 LTM and GTM doesn’t do external AAA authorization Sun, 23 Mar 2008 18:03:01 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-84 [...] and the current method in BigIP is not good enough. I have talked about comparing the F5 and ACE here, minus 5 points to F5. for [...] [...] and the current method in BigIP is not good enough. I have talked about comparing the F5 and ACE here, minus 5 points to F5. for [...]

]]> By: Mikey G http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-83 Mikey G Fri, 15 Feb 2008 17:05:00 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-83 The ACE4700 does use less power than an f5 8800, but the 4700 is more in line with an f5 3400, which is rated at a max power of 300W. Let's agree to disagree on the 6500 and a power budget calculation. Sure, most data centers will have a 6500, but is there a slot available, is it running the proper code (still on CatOs or Hybrid?), does it have a Sup720 or better? Any upgrades to any of those components have both hard and soft costs associated with him. Large enterprises and ISPs may not be able afford the outage to any of said components to prepare a switch for the ACE. No GSLB (GTM) functionality in the ACE is a huge disappointment as well. Good luck with your install... The ACE4700 does use less power than an f5 8800, but the 4700 is more in line with an f5 3400, which is rated at a max power of 300W.

Let’s agree to disagree on the 6500 and a power budget calculation. Sure, most data centers will have a 6500, but is there a slot available, is it running the proper code (still on CatOs or Hybrid?), does it have a Sup720 or better? Any upgrades to any of those components have both hard and soft costs associated with him. Large enterprises and ISPs may not be able afford the outage to any of said components to prepare a switch for the ACE.

No GSLB (GTM) functionality in the ACE is a huge disappointment as well.

Good luck with your install…

]]> By: Greg Ferro http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-81 Greg Ferro Fri, 15 Feb 2008 16:06:27 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-81 I agree with your view up to a point. In my case,the F5 8800 was more expensive than the complete C6500 with ACE and 48 switch ports. We had no special discounts from either party and I refer to real costs, not list price. For most data centres, a C6500 is always available. Its hard to regard it as part of the power budget, but I need the MPLS and routing integration for the virtualization, so I regard the C6509 as a benefit, not a platform for just hosting the ACE blade. Note that the ACE 4700 uses less power than the F5 8800 as well. The F5 BigIP greatest difficulty remains virtualization. The ability to have separate administrative zones with fully separated routing is very valuable. I disagree on performance. The F5 BigIP loses performance when doing complex manipulations, and, because it is so easy to configure 'fancy' load balancing, we do slow it down. I love the interface though. I am currently configuring Cisco Application Network Manager, I will probably post an article on comparing this with the F5 web interface in a few weeks. Thanks for your post. I agree with your view up to a point. In my case,the F5 8800 was more expensive than the complete C6500 with ACE and 48 switch ports. We had no special discounts from either party and I refer to real costs, not list price.

For most data centres, a C6500 is always available. Its hard to regard it as part of the power budget, but I need the MPLS and routing integration for the virtualization, so I regard the C6509 as a benefit, not a platform for just hosting the ACE blade. Note that the ACE 4700 uses less power than the F5 8800 as well.

The F5 BigIP greatest difficulty remains virtualization. The ability to have separate administrative zones with fully separated routing is very valuable.

I disagree on performance. The F5 BigIP loses performance when doing complex manipulations, and, because it is so easy to configure ‘fancy’ load balancing, we do slow it down. I love the interface though.

I am currently configuring Cisco Application Network Manager, I will probably post an article on comparing this with the F5 web interface in a few weeks.

Thanks for your post.

]]> By: Mikey G http://etherealmind.com/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-82 Mikey G Fri, 15 Feb 2008 14:56:52 +0000 http://etherealmind.com/2008/01/25/cisco-application-control-engine-ace-introduction-and-comparison-with-f5/#comment-82 Interesting observations. Your power and cost reduction analysis really only hold water if you already have a 6500 available for the ACE module. Otherwise, cost is a wash and the entire Cisco bundle will consume much more power than a standalone f5 8800. If you add the management licenses in for the ACE, you're cost will far exceed an 8800. I'm glad you mentioned theoretical throughput does not always equate to real application performance. From the studies I've seen, the 8Gbps ACE falls short of an f5 8800 in every respect. Also, consider the ACE does not support HTTP compression, a very important feature for most large enterprises and ISPs and ASPs. Interesting observations. Your power and cost reduction analysis really only hold water if you already have a 6500 available for the ACE module. Otherwise, cost is a wash and the entire Cisco bundle will consume much more power than a standalone f5 8800. If you add the management licenses in for the ACE, you’re cost will far exceed an 8800.

I’m glad you mentioned theoretical throughput does not always equate to real application performance. From the studies I’ve seen, the 8Gbps ACE falls short of an f5 8800 in every respect. Also, consider the ACE does not support HTTP compression, a very important feature for most large enterprises and ISPs and ASPs.

]]>