Forum Discussion
CirrusHow to increase connection timeout for a specific source ip address or range
We have a CAS server that makes an ldaps connection to our Active directory Ldap server via an F5 VIP. The particular application that is utilizing the CAS server requires the initial ldap connection (per application user) to stay open throughout the user session. The default timeout is closing the ldaps session after 300 seconds. I know I can increase the default, but how can I increase the default for just one or a range of ip address'?
9 Replies
Danny_ArroyoI forgot to mention we are running BigIP 2000 Series on version 11.4.1 in an HA pair.
shaggyNimbostratus
If 11.3+, try creating another virtual server with the same virtual address and port, but specify a source address/range. Apply a custom profile to this VS specifying the longer desired idle timeout.
SOL14800: Order of precedence for virtual server matching (11.3.0 and later)
Manual Chapter: Virtual Servers
- Danny_ArroyoThis is interesting. So the F5 won't allow traffic originating from the specified source address/range in the additional virtual server to go through the original virtual server?
- shaggyCorrect, there is an order of precedence for virtual server matching, so a packet will be processed by the F5 listener that most closely matches the incoming packet based on F5's order of precedence for VS matching. Source addresses came into play in 11.3.
shaggy_121467Cumulonimbus
If 11.3+, try creating another virtual server with the same virtual address and port, but specify a source address/range. Apply a custom profile to this VS specifying the longer desired idle timeout.
SOL14800: Order of precedence for virtual server matching (11.3.0 and later)
Manual Chapter: Virtual Servers
- Danny_ArroyoThis is interesting. So the F5 won't allow traffic originating from the specified source address/range in the additional virtual server to go through the original virtual server?
- shaggy_121467Correct, there is an order of precedence for virtual server matching, so a packet will be processed by the F5 listener that most closely matches the incoming packet based on F5's order of precedence for VS matching. Source addresses came into play in 11.3.
gsharriAltostratus
Looks like this could also be done with an iRule. See IP idle timeout
- Danny_Arroyo
I tried both methods and chose the irule method because it did not require an additional VIP/Profile to be created. However both methods provided the desired result.
Thanks for your help guys.
