For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

domi_232490's avatar
domi_232490
Icon for Nimbostratus rankNimbostratus
May 09, 2016

cookie persistance

Hi, I'm trying to make LB to decide based on server attached cookie. Client asks for a page from intermediate server > it goes to LB which based on URI sends it to appropriate pool. Back-end server attaches cookie and response to intermediate server (now it has LB+server cookie). Intermediate server forwards the response to the client. Based on details from the reply (URL and the cookies) client's been redirected and goes back to LB which doesn't recognize it as old request but as new and sends it to any back-end server from pool. I've tried to insert parts of irules I've found to the one which is applied (redirects to pools based on http_request URI) but without success.

 

Thanks

 

5 Replies

  • Are you persisting in the Big-IP by cookie insert and the request passes through to an intermediate server before arrives to Big-IP? So, did you see that Big-IP cookie arrives to client browser through HTTP headers? If so, it has the same domain and you it is sent back to the intermediate server then to the Big-IP in a new request? Isn't clear for me, sorry about that.
  • Can you attach the configuration for the virtual server, persistence profile, and any associated iRules with which you are trying to do persistence, please?
  • BinaryCanary_19's avatar
    BinaryCanary_19
    Historic F5 Account
    YOu may want to take a look at cookie hash persistence: https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6586.html?sr=53668191
  • Hello, thank you all for for your comments, sorry for being late had a problem uploading reply. I will try to answer to questions and explain better. @cjunior - The answer to the questions 1 and 2 answer is yes. Last question: After IM server gets reply to the initial request from back-end server, it has cookie named SAP set by back-end server and it BigIp cookie set by LB. IM server edits the reply and forwards to the client which makes it to go back directly to LB (different domain which leads it to Virtual server but same URI) and should be redirected to the same back-end server based on SAP cookie where initial request was authenticated and authorized. When, round robin accidentally chooses same backend I get the page otherwise I get blank page. On client I can see two BigIP cookies and one SAP cookie. So the main point and idea from my perspective is to force LB to decide on SAP cookie and ignore the BigIP one. Of course other conditions in http_request check shouldn't be affected. Somehow iRule should be edited to decide on cookie SAP if it's in the request if it isn't > go to dedicated pool (first request). @ FKnuckles: Will check and confirm on cookie hash persistence. Here is the requested part of config: ltm virtual /Common/Z4-P8 { description "Z4-P8" destination /Common/10.1.2.239%4:80 ip-protocol tcp mask 255.255.255.255 persist { /Common/P8-cookie { default yes } } pool /Common/SERVERFARM_P8-AE-TEST profiles { /Common/custom_client_TCP { } /Common/http-P8 { } } rules { /Common/Z4_p8_redirect } source 0.0.0.0%4/0 source-address-translation { pool /Common/Z4-SNAT25 type snat } translate-address enabled translate-port enabled vlans { /Common/Z4-VLAN20 /Common/Z4-VLAN20 } vlans-enabled } ltm persistence cookie /Common/P8-cookie { app-service none defaults-from /Common/cookie expiration 1:0:0 timeout 180 } ltm rule /Common/Z4_p8_redirect { when HTTP_REQUEST { switch -glob [string tolower [HTTP::uri]] { "/dd*" { pool Z4-P8-7001-2 persist cookie insert 01:00:00 } "/sap/icn*" { pool Z4-P8-ICN-7001-2 persist cookie insert 01:00:00 } "/activity*" { pool Z4-P8-7002-3 persist cookie insert 01:00:00 } "/sap*" { pool Z4-P8-7004-5 persist cookie insert 01:00:00 } default { return } } log local0.info "pool selected: [LB::server pool] [HTTP::uri]" } } Thanks