Forum Discussion
APM migration to iseries causes VPN network access tunnels to close
We are working on a migration from old hardware 5250v to new iseries i5800 and have extended the APM cluster and configuration is fully in sync. We failover and active the new cluster member a night before and next working day people start to work with the new solution witouth any issues. After some time, when more users are connected users are being disconnected from the VPN and in APM logs we see that the tunnels are being closed and started again. During this time data is being stalled on the tunnel and not working however the VPN client is still connected, similar to this bug.
https://cdn.f5.com/product/bugtracker/ID600985.html
This seems to be a performance issue however we dont see any CPU utilization issue. The hardware is also using a dedicated Coleto Creek CPU for SSL and compression offloading. GZIP compression offloading is used on the network access tunnels. On the old hardware there is no stability issue with exact same configuration , the only difference is that there the Cave Creek dedicated CPU is used for hardware offloading.
In this article it is stated that using compression in APM network access could cause CPU spikes only when there is no hardware offloading used.
https://support.f5.com/csp/article/K12524516
Could there perhaps be a bug to perform hardware compression offloading (GZIP deflate) on the new Coleto Creek CPU? If hardware compression offloading is used this should not increase the TMM assigned CPU cores as this is not processed in software?
Better test disabling the GZIP and if needed check again with ihealth and the bug tracker (https://support.f5.com/csp/bug-tracker ) and if needed go to support . Outside of that test DTLS VPN as per what I have seen it does wonders.
K54955814: How to create a DTLS Virtual Server for Network Access VPN
https://support.f5.com/csp/article/K54955814
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com