For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

EdH_135054's avatar
EdH_135054
Icon for Nimbostratus rankNimbostratus
Oct 13, 2015

cookie persistence snafu - f5 -> httpd and nginx

I am hoping you can help. Although I am not an f5 guy, just a mere downstream consumer and lowly architect who came up with the idea.

 

client -> F5: f5 needs to look at the request http://website.com/getContent or http://website.com/otherPath/getOtherStuff and determine which path to send the request to. We have no issue directing the calls, but it is the session stickiness that gets broken.

 

client -> f5 -> httpd: Client calls destination which is an httpd server retrieving content and f5 establishes stickiness.

 

client -> f5 -> nginx: Subsequent call is to getOtherStuff service which the f5 directs based on the url parsing of /otherpath to the nginx server which works however; it (f5) does not recognize this as the same session and creates a new cookie and losing the stickiness as a result.

 

What can I tell my F5 guy to direct him down the right path?

 

2 Replies

  • giltjr's avatar
    giltjr
    Icon for Nimbostratus rankNimbostratus

    What do you mean by "httpd" and "nginx"? Are those two different hosts? Or two different destination ports on the same host?

     

    Either way, they are "different" so they are different sessions. A "session" from the HTTP point of view must go to the same host and same destination port.

     

    I'm assuming that they are the same host, but different ports. Instead of a cookie he would need to write a iRule and use UIE persistence.

     

  • f5 fronts the calls which are directed to either an apache httpd server(s) (we use as an appl load balancer) connecting to tomcat servers or an nginx server (we use as a proxy server to internal services).

     

    So yes, they are two different hosts on two separate ports.

     

    I will forward your suggestion thanks.