F5 and IIOP

Well, it looks like the question you raise, and the solution from A10 are slightly different. My guess, is that you have an HTTP profile enabled on the F5 virtual server, which tells the F5 to look for HTTP type traffic. Your assumption about dropping non-HTTP traffic is correct, it will definitely get dropped if it does not conform to http standards.

 

 

If that is true, you have a couple options:

 

 

First, for a test, try setting the HTTP profile to None on the virtual server. This essentially makes the virtual server work at L4, and ignores the tcp payload contents. If IIOP traffic passes normally, then you have confirmed it. However, if you are using any advanced F5 HTTP features, it may not let you do this, and may actually break the HTTP traffic processing, so don't do this in the middle of work hours. A safer test would be to set up a new virtual server for IIOP, and try it.

 

 

If you really want to separate the traffic, you have three choices.

 

 

1. Separate using different virtual servers with a different IP addresses. If I read the A10 solution correctly, this is what was configured.

 

2. Separate using different TCP ports, like 80 for the HTTP traffic, and 8000 for IIOP ( or any other port except 80 ), but on the same IP address. Remember, an F5 can only have one virtual server with a single a.b.c.d:80 vip.

 

3. Separate using an iRule that would inspect the TCP payload, and then select the correct pool for the traffic ( one pool for HTTP, one pool for IIOP ).

 

 

Number 1 and 2 are probably the easiest and best options, number 3 means you have roll up your sleeves and spend more time on DevCentral to learn you to parse tcp traffic and select pools :-)

 

 

You also might consider what would be a supported solution from the Oracle perspective, you certainly don't want to build something that they won't support.

 

 

You would need to post the configuration of your virtual server to confirm the above.