Solved

peristance with f5 for load balancing to https sites.

Posted on 2010-09-08
7
1,411 Views
Last Modified: 2012-05-10
We currently load balance two seperate proxy servers at different locations via our BigIP F5 Load Balancer.  We have a two nodes assigned to a pool, then the pool assigned to a virtual server.  All works just fine however we have some https sites that have problems authenticating.  If I disable one member in the pool, everything works fine.  How can I make a connection remain to one proxy server once it is established?

configuration is as follows:

proxy-pool

Allow SNAT:Yes
Allow NAT:Yes
Action on service down: None
slow ramp time: 0
IP toS to client Pass Through
IP ToS to Server Pass Through
Link QoS to Client Pass Through
Link QoS to Server Pass Through

Virtual Server

Service Port: *
State: Enabled
Type: Standard
Protocol: TCP
Protocol Profile (Cliet): tcp
Protocol Profile (Server): (Use Client Profile)
OneConnect Profile: None
HTTP Profile: None
FTP Profile: None
SSL Profile (Client): None
SSL Profile (Server): None
Stream Profile: None
RTSP Profile: None
SMTP Profile: None
SIP Profile: None
Statistics Profile: None
VLAN Traffic: All VLANS
Rate Class: None
Connection Limit: 0
Address Translation: Enabled
Port translation: disabled
SNAT Pool: Auto Map
Clone Pool (Client): None
Clone Pool (Server): None
Last Hop Pool: None

Default Persistence Profile: dest_addr
Fallback Persistence Profile: source_addr
0
Comment
Question by:Kitsap_Technology
  • 4
  • 3
7 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 33633122
Let me make sure I have this.  One F5, one pool with two members.

Is the F5 at the same location as one of the proxy servers?  Could there be a slight performance issue between the F5 and one of the proxies?

A bit off topic, but is there any reason why you don't just use the F5 as the proxy server?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33633152
I also noticed you have no SSL profiles.  So I am assuming you are not doing SSL offload either.

So you are just passing based on IP address, no  SSL offload, no caching, and no compression?
0
 

Author Comment

by:Kitsap_Technology
ID: 33639551
The F5 is at the same location as one of the proxy servers.  The other location is connected via a 1Gig Fiber link.  We have not done SSL offloading yet.  We do not use the F5 as the proxy because we hand off the traffic from the F5 to our iPrism proxy servers so we can do content filtering.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 57

Accepted Solution

by:
giltjr earned 250 total points
ID: 33639731
Since you are doing content filtering, is it safe to assume that this outbound web surfing?

It has been my experience that the F5 will reselect a pool member if the prior selected member does not respond "fast enough."

Now by default the persist record only stays around for 180 after the last transaction in a TCP connection.  So you may need to increase this value.  This is on the persist profile definition.
0
 

Author Comment

by:Kitsap_Technology
ID: 33641544
Yes, this is for outbound websurfing.  I have created a persistence profile and increased the timeout to 900.  The user is testing now.  Should hear back soon if the problem persists (no pun intended).
0
 
LVL 57

Expert Comment

by:giltjr
ID: 33643078
O.K, we don't use our for web surfing.  Our is used for front ending J2EE applications.

Hopefully they don't sit there doing nothing for more that 15 minutes and expect to get back where they were.

0
 

Author Closing Comment

by:Kitsap_Technology
ID: 33667965
Seems to have solved the issue!
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now