For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

edgevil_26102's avatar
edgevil_26102
Icon for Nimbostratus rankNimbostratus
Jul 21, 2010

idle timeout setting is not work

I encountered two problems in F5 LTM application. Anyone can help to have a look?

 

1, We log on web system by F5 VIP, idle time is more than 10 minutes, then log off. Have to re-input username and password.

 

2, When we operate web application, the first operation is always “slow”, e.g. the first log on system, first time need 15s. exit system, then second time log on, need only 4s When switch pages in web application, has similar problem. The first switching time need 5s, the second or later switching time need 2-3s. Exit web application several hours, then operate web application, this problem is happen again. The first operation is “slow”, later operations is “quick”.

 

====F5 LTM System Infomation=======================

 

Eng Platform: C102 / F5-BIG-LTM-1600-4G-R

 

Product: BIG-IP LTM Version: 9.4.8

 

Pairing Configuration: HA Pair

 

--------F5 configuration ---------------------------

 

I set a pool in F5 LTM, two web servers (Win2008+IIS7) are members.

 

set one VS Use "standard" type,

 

set 7200s idle timeout in TCP protocol,

 

Protocol profile(client) and (server) both use TCP protocol.

 

HTTP profile use default "HTTP" profile.

 

enabled "address translation" and "port translation"

 

"SNAT pool" choose "auto map"

 

VS use "source_add" as default persistence profile

 

set timeout to 7200s in "source_add" profile.
management
monitoring

4 Replies

  • Chris_Miller's avatar
    Chris_Miller
    Icon for Altostratus rankAltostratus
    Jul 21, 2010
    For number 1, if you've logged out of the application, why wouldn't you expect to have to log back in?

     

    For number 2, is your first request an HTTP GET for a login page? Does the login page load slowly, or is it after you've clicked log-in?

     

     

    I'd recommend getting a tcpdump and if you have something like httpwatch or httpfox, hit the Virtual Server with it, and then hit the server directly with it and compare your results.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 21, 2010
    Good points, Chris. Do you see the same issues if you bypass LTM and connect directly to one of the servers? If so, I expect tcpdumps on LTM and HTTP traces will show the issue fairly quickly. What application architecture (web server OS, app language, etc) is used?

     

     

    Aaron
  • edgevil_26102's avatar
    edgevil_26102
    Icon for Nimbostratus rankNimbostratus
    Jul 29, 2010
    Tks, Chris,

     

    Q1, There is a misunderstanding. Not user initiative log off. Instead of, user's connection to web application was cut. Means when idle time is more than 10 minutes. Although web application screen is still in previous screen, however, when user try to click any menu or button in web application, the system will exit, back to waiting-login screen.

     

    New finding, I setup one Virtual Server, map to two webs (Win2003+IIS6). And same setting with previous one. The connection is not cut event idle time is more than 2 hours. Seems it related with IIS setting. However, I did not confirm what is difference between IIS6 and IIS7.

     

     

    Q2, Yes. First requst HTTP Get, loading page is slow, log-in is slow too. Almost any first request is slow. The second same request, it becomes quick.

     

    Same with Q1, I tested IIS6 environment. Seems no "slow" first-operation problem. Oh, bad IIS7, what should I adjust?