Does ACE replicate SSL sessions?

[Cooky]

We're implementing a redundant ACE module w/ a redundant 6500 chassis, and would like someone to confirm whether or not SSL stateful failover works between the two ACE modules.

If the primary active ACE or 6504 fails, do users need to re-establish all active SSL sessions, or are their sessions kept alive after failover occurs?

If Cisco's ACE doesn't do SSL stateful failover, whose product does it?

 

[spidey07]

Yes, SSL failover is stateful.

 

[Cooky]

Cisco Doc says:
The ACE does not replicate SSL and other terminated (proxied) connections from the active context to the standby context.

 

[nightowl]

The docs are correct. SSL stateful failover is not supported.

 

[spidey07]

dang, could have sworn that is was. sorry for the misinformation.

 

[Cooky]

I couldn't believe SSL failover was not supported, so opened a case w/ Cisco TAC.

Here's their response (trying my best to state it in correct words):
Even though SSL ID's are not replicated over (actually a security feature, so that the ID can't be hijacked), most browsers automatically re-negotiates SSL after it fails over to secondary ACE, and thus it would be transparent to end users.

I guess one can argue SSL failover isn't supported, but to end users' point of view, it is.

=========
Side note:
Right after I opened the SR online (3 minutes or so), I called the 800 number and actually got to the assigned engineer right away, and didn't have to go through any dispatcher and explain any non-sense.

She was in Australia TAC, and pretty much answered all my questions & concerns within 10 minutes.

I generally find Australia TAC more reliable & quicker than the ones in the U.S....no offense in case anyone from SJ or RTP TAC is reading.

 

[cmetz]

Cooky, I'll second your aside - the Austrialia TAC folks are way more helpful and are native English speakers. I've had extremely poor experiences with the SJ TAC. So for everyone with Cisco problems and a support contract that will allow it, call late night when the number gets routed to Australia.

 

[jlazzaro]

+1 on australia...ive actually waited to report late night issues just to make sure i get routed there.