For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jim_43682's avatar
Jim_43682
Icon for Nimbostratus rankNimbostratus
Apr 17, 2012

Disabled nodes still getting connections, No Persistence On, TCP only VS

Hello All,

 

 

I am running into an issue with a VS instance that's pool has 10 nodes in it. 9 are disabled, 1 enabled. There are currently no connections going to the VS. However when connection I can see the 1 connection being proxied to 1 of the 9 disabled nodes.... Why is this?

 

 

Thank you for your help.

 

 

-Jim

 

config
design

4 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Apr 17, 2012
    Disabled how? The default level of disablement only disables new SESSIONS. So depending on your persistence the connection could be a new one from a persisted session, OR a connection that was made to the pool member before it was disabled.

     

     

    H
  • Jim_43682's avatar
    Jim_43682
    Icon for Nimbostratus rankNimbostratus
    Apr 17, 2012
    User Disabled. There is no persistence for this Virtual Server. Is there something else I can check?
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Apr 17, 2012
    'User Disabled' on a pool member, can really be one of two different modes. Disable for new sessions. Disable for new sessions and new connections.

     

     

    Plus there's 'node down'. Which is disable for all connections, including possibly existing ones (Which then have the 'Action on service down' option in the pool of ignore (i.e. pass through which is the default), drop, reset or rebalance). IIRC you can't set a node actually down from the GUI except by adding a monitor that will mark it down.

     

     

    Was this by any chance an existing connection when you disabled it? Or is it confirmed as a new connection? What is the Action on service down set to in the pool?

     

     

    Can you confirm (With a tcpdump) that it's a new connection being balanced to a downed node? If so there's always a possibility you're hitting http://www.f5networks.co.uk/kb/en-us/solutions/public/12000/900/sol12920.html (Pool members of a disabled node may receive new connections).

     

     

     

    H