For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Richard_Schmit_'s avatar
Richard_Schmit_
Icon for Nimbostratus rankNimbostratus
Apr 22, 2013

Load Balance Cisco ISE servers

Trying to load Balance several Cisco ISE servers. For persistence, Cisco recommends using Calling-Station-ID and Framed-IP-address...Session-ID is recommended if load balancer is capable of it. I h...
application delivery
dev
devops
iRules
_pre_'s avatar
_pre_
Icon for Nimbostratus rankNimbostratus
Jun 26, 2014

Few things we learn with our ISE installation :

 

  • Disable datagram LB : see : http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3605.html

     

  • Use one single VS listening on all ports. Having 2 separate VS with UIE persist across services/vs/pool does not persist 100% of the time.

     

  • F5 drop UDP packets. If you see failure code "12953 - Received EAP packet from the middle of conversation ..." most likely this is caused by F5 dropping packet. We see this issue happen with 6000+ users. Testing environment with 1000 users does not inherit this issue. 11.5 is the worst offender while 11.3 is somewhat better. We have up to 25% failure rates with 11.5 and only 5% with 11.3