For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

8 Replies

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Apr 30, 2014
    Just a few questions to make it easier for us to help: What do you mean with the same domain? What do you mean by not being communicate? What is your network topology like? Does the servers use the loadbalancer as default gateway? Kind regards, Patrik
  • psheen_152489's avatar
    psheen_152489
    Icon for Nimbostratus rankNimbostratus
    Apr 30, 2014

    Hi Patrik,

     

    our network has multiple domains our web servers are in one domain and the load balancer in another When we look at the F5 trying to send data to the server it looks like it tries to handshake with it but then the connection drops before it can be completed

     

    Don't think the servers use the F5 as a default gateway, pretty sure that they dont

     

    What sort of network toplogy information would be useful?

     

    Thanks Paul

     

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    May 01, 2014

    Hi mate!

     

    By domain, do I guess you mean network? Have you tried using snat automap (can be found in the virtual server settings, address translation)?

     

    /Patrik

     

  • psheen_152489's avatar
    psheen_152489
    Icon for Nimbostratus rankNimbostratus
    May 01, 2014

    Hi Patrik, so our load balancer is in an .com domain whereas our server(s) are in an .net domain.

     

    WE have been told by Oracle that we need to:

     

    For customers that use a load balancer, Oracle recommends using a cookie (session) based load balancer

     

    And also:

     

    It is required that the load balancer and PeopleSoft WebLogic web servers are in the same domain.

     

    We have tried using DSR with an IP monitor and whilst that does now allow traffic to reach the web server this causes issues with the application as we get pagelets that won't load and timeouts on some pages.

     

    As soon as we put cookie peristence back on we lose the ability for the F5 to to pass traffic to the web servers.

     

    I assume that DSR is causing responses from the server to be directed back to the F5 whereas when we use cookie persistence the server tries to respond via the default gateway?

     

    So if we use SNAT inbound we can cause the server respond back to the F5 rather than via the default gateway?

     

    Thanks Paul

     

  • psheen_152489's avatar
    psheen_152489
    Icon for Nimbostratus rankNimbostratus
    May 02, 2014

    Ok so now we ahev load balancing set up and working, we had to enable http communication between the F5 and the server with SSL off loading. Now we are seeing an issue in Peoplesoft whereby we get users logging on but they see a session that was previously opened by a previous user. We are using cookie persistence so maybe this coule be the cause?

     

    • Patrik_Jonsson's avatar
      Patrik_Jonsson
      Icon for MVP rankMVP
      May 03, 2014
      The cookie persistence adds a cookie between the user and the load balancer. This cookie is removed though before sending it onwards to the server. I find it strange that users can re-use each others sessions, but I'm sorry to say that I lack any experience in terms of peoplesoft. /Patrik
  • Cyril_M's avatar
    Cyril_M
    Icon for Altostratus rankAltostratus
    May 05, 2014

    Hi, I do administrate several PeopleSoft applications so I may be able to help you ... Regarding the cookie persistance, it's mandatory that you enable the "oneconnect" feature on your virtual server, otherwise you could observe some issues with visitors switching their session ... If you want to use https between client and load-balancer, then http between load balancer and web servers (weblogic or Apache proxypassing to weblogic), on the F5 you must enable the "redirectrewrite" feature of the http profile ; and you must also configure PeopleSoft to force https (peopletools > webprofile > webprofile configuration) otherwise the urls within the application will be http:// instead of https://

     

    hope this will help