For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MarioMoneta's avatar
MarioMoneta
Icon for Altostratus rankAltostratus
Jan 28, 2025

I rules for persistency

HI Guys

I have a client who want to do distribution of client session on /20 (4096 ip treated as one for server assignment)
but he realized that in this way the persistency (set at 960 sec = 16 minutes) never expires. Since there is a limit of 35K sessions, the side effects is "session starvation". So he would like to have distribution on /20 BUT having more granular persistency based on client IP. /32 so one record for each ip. Now my concern is the amount of records in the persistency table. could this be a problem ? how many records can an F5 manage until have CPU/Line card issues ? I already verified alternative methods to do persistency like cookies, but this doesn't apply because the communication is encrypted from client device to server with a TLS tunnel so i can't inject anything. this is the script. could it work of could i have  usage issues ? the model is BIG-IP 17.1.1.3 Build 0.0.5 Point Release 3 the script is the following: 

 

thank you for your help

B.R

Mario

when CLIENT_ACCEPTED {

                # Persistence over IP

                persist uie [IP::client_addr]

 

                # Load balacing on subnet /20

                set client_ip [IP::client_addr]

                set subnet_ip [IP::addr $client_ip mask 255.255.240.0]

               

                # Get active pool member list

                set active_members [active_members -list pool <pool_name>]

               

                # If there are active members, pick one based on the hash of the masked IP

                if {[llength $active_members] > 0} {

                                set member [lindex $active_members [expr {[crc32 $subnet_ip] % [llength $active_members]}]]

                                                                

                                pool <pool_name> member $member

                }

}

No RepliesBe the first to reply