For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

easyfan_179507's avatar
easyfan_179507
Icon for Nimbostratus rankNimbostratus
Apr 18, 2015

[Help] Persistence Hash and Load Balancing together, Possible?

[Help] Persistence Hash and Load Balancing together, Possible?

I know the request sounds weird... But it is true. Here is the thing:

We know that F5 supplied a persistence CARP hash since 10.0.0. Follow the document: https://support.f5.com/kb/en-us/solutions/public/11000/300/sol11362.html, we can create a virtual server that route request into a specified pool member by identical something as the hash key. In my case, we decide to use the part of the URL if it matches pattern like '/AAAAA/BBBBB/CCC/{hash_value}', or if not the whole URL to be the hash key. For dealing this, I supplied an iRule like below:

when HTTP_REQUEST {
  if {[string match "/AAAAA/BBBBB/CCC/*" [HTTP::uri]]} {
    persist carp [substr [HTTP::uri] 18 [string length [HTTP::uri]]-18]
  }
  else {
    persist carp [HTTP::uri]
  }
}

It works fine, so far so good.

But and additional request came in yesterday: for the request that does not match said pattern, sould be routed into pool member load balancing way. So I change the pool loading balancing method to "round robin", and change the iRule into:

when HTTP_REQUEST {
  if {[string match "/AAAAA/BBBBB/CCC/*" [HTTP::uri]]} {
    persist carp [substr [HTTP::uri] 18 [string length [HTTP::uri]]-18]
  }
}

Or:

when HTTP_REQUEST {
  if {[string match "/AAAAA/BBBBB/CCC/*" [HTTP::uri]]} {
    persist carp [substr [HTTP::uri] 18 [string length [HTTP::uri]]-18]
  }
  else {
    pool the_pool
  }
}

Seems does not work. Maybe an iRule for persistence profile can not turn back to load balancing way? I have no idea at all.

Any one could give any help on this? Pretty thanks!

12 Replies

  • The first change is good, but you need to remember the load balancing decision is only made at the start of the TCP connection after the first HTTP request. If you try to change the destination thereafter in the same connection, it will be ignored. Does that explain what you are seeing?

     

    • easyfan_179507's avatar
      easyfan_179507
      Icon for Nimbostratus rankNimbostratus
      Sorry, Kevin, I still confused. Are you saying that "the first change" does not work because that I have done anything "change the destination thereafter in the same connection"?
    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      @Kevis, I am a bit confused about "LB decision is only made at the..." in relation to pool selection, from this article (https://support.f5.com/kb/en-us/solutions/public/9000/800/sol9800.html) it seems that explicit pool selection is performed for every HTTP request, only issue is with VS without OneConnect when there is no match in iRule and instead of default pool set for VS last pool chosen by iRule is used - or I mixed different situations here? Piotr
    • easyfan_179507's avatar
      easyfan_179507
      Icon for Nimbostratus rankNimbostratus
      I do config the "onconnect" profile within the Virtual Server, and try requesting the VS by different client machine, but only 1 node access. So I don't think the issue is related to "change the destination thereafter in the same connection".
  • But and additional request came in yesterday: for the request that does not match said pattern, sould be routed into pool member load balancing way. So I change the pool loading balancing method to "round robin", and change the iRule into:

     

    why do you think it is not working? if result is not round robin, can you try to disable cmp?

     

    sol14358: Overview of Clustered Multiprocessing (11.3.0 and later)

     

    https://support.f5.com/kb/en-us/solutions/public/14000/300/sol14358.html

     

    • easyfan_179507's avatar
      easyfan_179507
      Icon for Nimbostratus rankNimbostratus
      hi, nitass, Thanks for your response. I tried to disable the CMP following the guide you supplied before, but still I found that only one node was accessed amount the time (several requests)..
  • But and additional request came in yesterday: for the request that does not match said pattern, sould be routed into pool member load balancing way. So I change the pool loading balancing method to "round robin", and change the iRule into:

     

    why do you think it is not working? if result is not round robin, can you try to disable cmp?

     

    sol14358: Overview of Clustered Multiprocessing (11.3.0 and later)

     

    https://support.f5.com/kb/en-us/solutions/public/14000/300/sol14358.html

     

    • easyfan_179507's avatar
      easyfan_179507
      Icon for Nimbostratus rankNimbostratus
      hi, nitass, Thanks for your response. I tried to disable the CMP following the guide you supplied before, but still I found that only one node was accessed amount the time (several requests)..
  • Can you show us the contents of the virtual server configuration. This will help us check what is configured.

     

    tmsh list /ltm virtual

     

    • easyfan_179507's avatar
      easyfan_179507
      Icon for Nimbostratus rankNimbostratus
      Hi Kevin, following is the configuration of the VS we talked about: ---------------------------------------- Status Availability : available State : enabled Reason : The virtual server is available CMP : disabled CMP Mode : single-cpu Destination : 9.112.251.45:9080 Traffic ClientSide Ephemeral General Bits In 121.8M 0 - Bits Out 87.6M 0 - Packets In 17.2K 0 - Packets Out 14.9K 0 - Current Connections 0 0 - Maximum Connections 18 0 - Total Connections 499 0 - Min Conn Duration/msec - - 4.0K Max Conn Duration/msec - - 6.0K Mean Conn Duration/msec - - 4.0K Total Requests - - 499 SYN Cookies Status not-activated Hardware SYN Cookie Instances 0 Software SYN Cookie Instances 0 Current SYN Cache 0 SYN Cache Overflow 0 Total Software 0 Total Software Accepted 0 Total Software Rejected 0 Total Hardware 0 Total Hardware Accepted 0 CPU Usage Ratio (%) Last 5 Seconds 0 Last 1 Minute 0 Last 5 Minutes 0 ------------------------- Can you give me any clue? Thanks a lot!