For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jozef_Hamar's avatar
Jozef_Hamar
Icon for Altostratus rankAltostratus
Feb 22, 2015

Active connections still sent to Pool member marked down by monitor

Hello,

 

In the documentation, I found following note:

 

"difference between a disabled pool member, and a pool memberthat a monitor reports as down, is that a disabled pool member continues toprocess persistent and active connections. Conversely, a pool member reportedas down processes no connections whatsoever."

 

I simulated the scenario: set up a malformed HTTP monitor to the pool members, waited until the monitor marks the pool and VS as down, and started a tcpdump on the server. In the background I was constantly refreshing the browser window so it won't close the active TCP connection.

 

However, even if the whole VS was marked down because of all members were down as well, the requests kept coming to the server. I know the difference between "disabled" and "forced offline" pool members, but this is something new.

 

Can someone point me to the right place in the documentation where I can find the exact explanation, please? Because this in contradiction whit what I found.

 

I'm running version 11.6 and found the expected (but not working in real) behavior here: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_0_0/ltm_pools.html

 

Thank you.

 

Jozef

 

application delivery
availability
deployment
LTM

3 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Feb 22, 2015

    if you just want to test the behavior, it may be better to use another protocol such as telnet, ssh rather than http because it is easier to tell whether it is existing or new connection.

     

    just my 2 cents.

     

  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Feb 22, 2015

    Hi Jozef,

     

    In case you are using OneConnect (for http only) you will notice that due to the request switching mode a pool member state will be taken into account.

     

    So the basic behaviour remains unchanged (keep-alive connection between BIG-IP and poolmember is still up until you modify the action on service down settings), but new requests are only forwarded to available poolmembers only.

     

    Be aware, that OneConnect maintains serverside connections, even if the client already closed it´s connection to the virtual server.

     

    That´s why configuration changes may not always have an immediate effect if OneConnect is applied as changes will work for new connections only.

     

    Thanks, Stephan