For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Patrick_02_1416's avatar
Patrick_02_1416
Icon for Nimbostratus rankNimbostratus
Nov 06, 2015

icontrol for .net - session issues

Hi,

 

we are using icontrol for .net version 11.3 and 11.6. From time to time we get session errors because there is no free session on the loadbalancer. What could be the reason for this? How long is the default session timeout? What's the prefered max session value when automation is in use?

 

Now we are thinking fo changing from icontrol to directly use soap, but from my point of view this souldn't make any difference.

 

thanks

 

BIG-IP Access Policy Manager (APM)
devops
iControl
management
microsoft
security

4 Replies

  • MichaelatF5's avatar
    MichaelatF5
    Icon for Employee rankEmployee
    Nov 06, 2015

    Patrick, There could be a couple different reasons for the errors, have you looked at the httpd and audit logs? You could just be exhausting the management interface. The preferred max session value is generally based on security requirements, versus automation. Personally for your situation, it sounds like a shorter timeout would be best.

    Default session time out for the management interface is 20 minutes. You can view your current settings from the CLI with the following:

    root@ve-lab(Active)(/Common)(tmos) list sys httpd all-properties
sys httpd {
    allow { All }
    auth-name BIG-IP
    auth-pam-dashboard-timeout off
    auth-pam-idle-timeout 1200
    description none
    fastcgi-timeout 300
    hostname-lookup off
    include none
    log-level warn
    max-clients 10
    ssl-certchainfile none
    ssl-certfile /etc/httpd/conf/ssl.crt/server.crt
    ssl-certkeyfile /etc/httpd/conf/ssl.key/server.key
    ssl-ciphersuite ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2
    ssl-include none
}
root@ve-lab(Active)(/Common)(tmos) modify sys httpd auth-pam-idle-timeout 300
root@ve-lab(Active)(/Common)(tmos) save sys config
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Nov 06, 2015
    If you are looking to make a change, make a change to the REST api. The SOAP is legacy and is not the go forward plan.
  • Patrick_02_1416's avatar
    Patrick_02_1416
    Icon for Nimbostratus rankNimbostratus
    Nov 06, 2015
    Thanks for the answer. We already had a look on the rest service and wanted to implement it but there is no ad authentication, only integrated. This is a complete no go.