For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VFB's avatar
VFB
Icon for Cirrus rankCirrus
Jan 22, 2018

Header persistence from client

I'm working on an iRule to look at the POST header from a client to look at "jsessionid" and add a 10 minute persistence timer. I created the universal profile and the iRule, but the F5 is only sending data to 1 server.

 

*when HTTP_REQUEST { if {[HTTP::header exists "jsessionid"]} { persist uie {persist_600}} *

 

16 Replies

  • Jeff_Maddox_394's avatar
    Jeff_Maddox_394
    Historic F5 Account

    ok, so the SessionID value is set in the original POST? Then is that header sent in every subsequent HTTP request?

     

  • No dice on that iRule either. The issue is the uie profile doesn't have a sticky persistence, only idle. How do I add persistence once the iRule sees the header? There is no cookie involved in this session from the above responses.

     

  • Jeff_Maddox_394's avatar
    Jeff_Maddox_394
    Historic F5 Account

    I go the following rule to work. It times out after 10 seconds, which is the value I used to test: I sent curl commands with 2 different values for the header and it created 2 different persist records.

     

    when HTTP_REQUEST { set hVal [HTTP::header value "SessionId"] if { $hVal ne "" } { persist uie $hVal 10 } }

     

    root@(localhost)(cfg-sync Standalone)(Active)(/Common)(tmos) show ltm persistence persist-records all-properties Sys::Persistent Connections

     

    universal - 192.168.1.105:80 - 172.16.0.100:80

    TMM 1

     

    Mode universal

     

    Value 45345dddd

     

    Age (sec.) 3

     

    Virtual Name /Common/test

     

    Virtual Addr 192.168.1.105:80

     

    Node Addr 172.16.0.100:80

     

    Pool Name /Common/dvwa-secure

     

    Client Addr 192.168.1.100

     

    Owner entry

     

    universal - 192.168.1.105:80 - 172.16.0.100:80

    TMM 0

     

    Mode universal

     

    Value 12345

     

    Age (sec.) 4

     

    Virtual Name /Common/test

     

    Virtual Addr 192.168.1.105:80

     

    Node Addr 172.16.0.100:80

     

    Pool Name /Common/dvwa-secure

     

    Client Addr 192.168.1.100

     

    Owner entry

     

    Total records returned: 2

     

  • This is the Cisco ACE configuration I've been attempting to replicate. While I can see the persistence record, I still get traffic with the same header go to a different server.

     

    sticky http-header SessionID http-session-id serverfarm dp-serverfarm timeout 35

     

    My current iRule:

     

    when HTTP_RESPONSE { if { [HTTP::header exists SessionID] } { persist on the server persist add uie [HTTP::header value SessionID] } } when HTTP_REQUEST { if { [HTTP::header exists SessionID] } { Back to the server persist uie [HTTP::header value SessionID] } }

     

  • Jeff_Maddox_394's avatar
    Jeff_Maddox_394
    Historic F5 Account

    OK, if the persist entry is being made, but requests still going to different servers, take a look at this: https://support.f5.com/csp/article/K7964 It explains how the LB and persist work together. You will need oneconnect OR a LB::detach statement, as explained in the KB article.