Solved

peristance with f5 for load balancing to https sites.

Posted on 2010-09-08
7
1,451 Views
Last Modified: 2012-05-10
We currently load balance two seperate proxy servers at different locations via our BigIP F5 Load Balancer.  We have a two nodes assigned to a pool, then the pool assigned to a virtual server.  All works just fine however we have some https sites that have problems authenticating.  If I disable one member in the pool, everything works fine.  How can I make a connection remain to one proxy server once it is established?

configuration is as follows:

proxy-pool

Allow SNAT:Yes
Allow NAT:Yes
Action on service down: None
slow ramp time: 0
IP toS to client Pass Through
IP ToS to Server Pass Through
Link QoS to Client Pass Through
Link QoS to Server Pass Through

Virtual Server

Service Port: *
State: Enabled
Type: Standard
Protocol: TCP
Protocol Profile (Cliet): tcp
Protocol Profile (Server): (Use Client Profile)
OneConnect Profile: None
HTTP Profile: None
FTP Profile: None
SSL Profile (Client): None
SSL Profile (Server): None
Stream Profile: None
RTSP Profile: None
SMTP Profile: None
SIP Profile: None
Statistics Profile: None
VLAN Traffic: All VLANS
Rate Class: None
Connection Limit: 0
Address Translation: Enabled
Port translation: disabled
SNAT Pool: Auto Map
Clone Pool (Client): None
Clone Pool (Server): None
Last Hop Pool: None

Default Persistence Profile: dest_addr
Fallback Persistence Profile: source_addr
0
Comment
Question by:Kitsap_Technology
  • 4
  • 3
7 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 33633122
Let me make sure I have this.  One F5, one pool with two members.

Is the F5 at the same location as one of the proxy servers?  Could there be a slight performance issue between the F5 and one of the proxies?

A bit off topic, but is there any reason why you don't just use the F5 as the proxy server?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33633152
I also noticed you have no SSL profiles.  So I am assuming you are not doing SSL offload either.

So you are just passing based on IP address, no  SSL offload, no caching, and no compression?
0
 

Author Comment

by:Kitsap_Technology
ID: 33639551
The F5 is at the same location as one of the proxy servers.  The other location is connected via a 1Gig Fiber link.  We have not done SSL offloading yet.  We do not use the F5 as the proxy because we hand off the traffic from the F5 to our iPrism proxy servers so we can do content filtering.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 57

Accepted Solution

by:
giltjr earned 250 total points
ID: 33639731
Since you are doing content filtering, is it safe to assume that this outbound web surfing?

It has been my experience that the F5 will reselect a pool member if the prior selected member does not respond "fast enough."

Now by default the persist record only stays around for 180 after the last transaction in a TCP connection.  So you may need to increase this value.  This is on the persist profile definition.
0
 

Author Comment

by:Kitsap_Technology
ID: 33641544
Yes, this is for outbound websurfing.  I have created a persistence profile and increased the timeout to 900.  The user is testing now.  Should hear back soon if the problem persists (no pun intended).
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33643078
O.K, we don't use our for web surfing.  Our is used for front ending J2EE applications.

Hopefully they don't sit there doing nothing for more that 15 minutes and expect to get back where they were.

0
 

Author Closing Comment

by:Kitsap_Technology
ID: 33667965
Seems to have solved the issue!
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Monitor input from a computer is usually nothing special.  In this instance it prevented anyone from using the computer.  This was a preconfiguration that didn't work.
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question