Forum Discussion
ChrisA_15714
Mar 16, 2011Nimbostratus
How to turn on Destination Address Affinity persistence
Hi .... I'm brand new to F5. We are running an GTM/LTM 1600 on v10.2. I'm having a problem where a user is going to a site ( ) and he gets there but the authentication fails. It only happens when the traffic is passing through the F5. I opened a ticket with F5 support and the engineer suggests I "turn on Destination Address Affinity persistence on the VIP" to see if that resolves the problem. I have no idea where to look or what to do, or if this change could break something. Any help would be appreciated. Thank you. Chris.
- Alabaster_77524NimbostratusDestination Address Affinity Persistence:
- Chris_MillerAltostratusWhat's behind your VIP? Are you load balancing gateways or proxies or something? Sounds like this is outbound traffic so I'm assuming so? You can configure destination address persistency from the resources tab of your VIP but if the user can't connect at all going through the F5, I doubt that's the issue.
- ChrisA_15714NimbostratusThank you alabaster & Chris. I appreciate your help. I'm afraid you will need to go very slowly with me. Users on our network are initiating a web connection to the destination url. The users can get to the destination site okay but cannot authenticate. The F5 Engineer reviewed the tcpdumps from the F5 device and suggested setting up the destination addr persistence affinity to see if it works. We have two F5 devices: each one sits in front of a different ISP (for ISP redundancy). One unit shows status "Active" and the other one shows status "Standby". By VIP I assume you are referring to Local Traffic > Virtual Servers: Virtual Server List. We have an outbound HTTPS (443) forwarder defined with type "Performance (Layer 4)" and protocol "fastl4_long_idle". We have an outbound HTTP (80) forwarder defined the same way. We also have a generic outbound forwarder that is set up as type "Forwarding (IP)" and protocol "fastl4_long_idle". So I'm guessing I need to set up another forwarder for 8443 traffic, restricting to the destination IP. Am I on the right track? Is this change fairly innocuous?
- Chris_MillerAltostratusGreat overview Chris! That helps a lot.
- Chris_MillerAltostratusGlad to hear that Chris - Our of curiosity - did you have persistence enabled for your HTTPS (443) Forwarder?
- ChrisA_15714NimbostratusYes, there is a virtual server outbound_https_forwarder which has the Default Persistence Profile defined as Custom_Dest_Persist. This profile has a parent of dest_addr (which has destination address affinity set) but also has "Mirror Persistence", "Match across services" and "Match across virtual servers" checked. The prof. svcs. eng. from F5 set all that up, so I'm not sure why he had to create a custom profile and check those options. The virtual server I set up just points to the dest_addr profile that has destination address affinity set without those other boxes checked.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects