For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sundogbrew's avatar
sundogbrew
Icon for Altocumulus rankAltocumulus
Jun 08, 2010

Action on service down question

So I am running Big IP 9.3.1 build 40.2 and am looking into the action on service down. I have always used reselect and it has always worked. For this new app, I have tried reject and if I mark the node as disabled it is still available to current connections. I was under the impression that it would send a TCP reset and then the new connection would go to a new node? Is this not the case? Cookie persistence is on by the way but should that be able to over ride this? What I am looking for is to be able to disable a node and have it go away immediately not have to take the node out of the pool which seems to be the only way I can do it right now. Thanks as always. Joe
management
monitoring

3 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jun 11, 2010
    There's a "soft down" and a "hard down" If I recall, disable is soft and forced offline is hard? I believe that's what you want. I believe the enable/disable/forced offline options are in the node screen? Can't recall if they show up in the pool member screen.
  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2010
    There are several states for a Node to be in within a pool:

     

     

    Enabled (All traffic allowed)

     

    Disabled (Only persistent or active connections allowed)

     

    Forced Offline (Only active connections allowed)

     

     

    All of these will allow traffic to remain active and die off slowly (non-service impacting).

     

     

    Enabled - Normal

     

    Disabled - Previous customers with a cookie or active connections will be allowed.

     

    Forced Offline - Previous customers with cookies now denied, but active connectionsn allowed.

     

     

    There are a ways to really and truely make it unavailable, but the best that I've found is by adding a conditional Health Check for it to FAIL, and be marked as Off-Line / Red / Dead. Then everybody must go somewhere else.

     

     

    I'd suggest a custom HTTP Health Check / Health Monitor.

     

     

    This is a good post to look at : http://devcentral.f5.com/Default.aspx?tabid=53&aft=13662

     

  • sundogbrew's avatar
    sundogbrew
    Icon for Altocumulus rankAltocumulus
    Jun 18, 2010
    Thank you for the help. Michael, that is what I ended up doing is create a monitor that I know will fail and just assign it to that node. Then it fails and the action on service down works.

     

    Thanks

     

    Joe