Solved

peristance with f5 for load balancing to https sites.

Posted on 2010-09-08
7
1,399 Views
Last Modified: 2012-05-10
We currently load balance two seperate proxy servers at different locations via our BigIP F5 Load Balancer.  We have a two nodes assigned to a pool, then the pool assigned to a virtual server.  All works just fine however we have some https sites that have problems authenticating.  If I disable one member in the pool, everything works fine.  How can I make a connection remain to one proxy server once it is established?

configuration is as follows:

proxy-pool

Allow SNAT:Yes
Allow NAT:Yes
Action on service down: None
slow ramp time: 0
IP toS to client Pass Through
IP ToS to Server Pass Through
Link QoS to Client Pass Through
Link QoS to Server Pass Through

Virtual Server

Service Port: *
State: Enabled
Type: Standard
Protocol: TCP
Protocol Profile (Cliet): tcp
Protocol Profile (Server): (Use Client Profile)
OneConnect Profile: None
HTTP Profile: None
FTP Profile: None
SSL Profile (Client): None
SSL Profile (Server): None
Stream Profile: None
RTSP Profile: None
SMTP Profile: None
SIP Profile: None
Statistics Profile: None
VLAN Traffic: All VLANS
Rate Class: None
Connection Limit: 0
Address Translation: Enabled
Port translation: disabled
SNAT Pool: Auto Map
Clone Pool (Client): None
Clone Pool (Server): None
Last Hop Pool: None

Default Persistence Profile: dest_addr
Fallback Persistence Profile: source_addr
0
Comment
Question by:Kitsap_Technology
  • 4
  • 3
7 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 33633122
Let me make sure I have this.  One F5, one pool with two members.

Is the F5 at the same location as one of the proxy servers?  Could there be a slight performance issue between the F5 and one of the proxies?

A bit off topic, but is there any reason why you don't just use the F5 as the proxy server?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33633152
I also noticed you have no SSL profiles.  So I am assuming you are not doing SSL offload either.

So you are just passing based on IP address, no  SSL offload, no caching, and no compression?
0
 

Author Comment

by:Kitsap_Technology
ID: 33639551
The F5 is at the same location as one of the proxy servers.  The other location is connected via a 1Gig Fiber link.  We have not done SSL offloading yet.  We do not use the F5 as the proxy because we hand off the traffic from the F5 to our iPrism proxy servers so we can do content filtering.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 57

Accepted Solution

by:
giltjr earned 250 total points
ID: 33639731
Since you are doing content filtering, is it safe to assume that this outbound web surfing?

It has been my experience that the F5 will reselect a pool member if the prior selected member does not respond "fast enough."

Now by default the persist record only stays around for 180 after the last transaction in a TCP connection.  So you may need to increase this value.  This is on the persist profile definition.
0
 

Author Comment

by:Kitsap_Technology
ID: 33641544
Yes, this is for outbound websurfing.  I have created a persistence profile and increased the timeout to 900.  The user is testing now.  Should hear back soon if the problem persists (no pun intended).
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33643078
O.K, we don't use our for web surfing.  Our is used for front ending J2EE applications.

Hopefully they don't sit there doing nothing for more that 15 minutes and expect to get back where they were.

0
 

Author Closing Comment

by:Kitsap_Technology
ID: 33667965
Seems to have solved the issue!
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

What do we know about Legacy Video Conferencing? - Full IT support needed! - Complicated systems at outrageous prices! - Intense training required! Highfive believes we need to embrace a new alternative.
This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now