Loadbalancing a 2-stage proxy environment - persistence problems

Hello fellow F5-experts,

My situation:

I try to loadbalance Web-Proxy traffic. In genenal it seems to work, but we've run into some problems relating to websites with weird session handling. I sketched up the environment in the following Image

A clients uses VS-A as it's HTTP proxy. This VS loadbalances to two of our own proxies in Pool A. Those are not transparent, so outgoing traffic toward their upstream proxy (VS-B) will have the Pool A node's IP as source address. The Proxies use the HTTP: Connect method.

VS-B on the other hand, has a Pool B attached with a lot (as in really a lot) other proxy servers, that are not under our control (but are trustworthy, and have to be used. No way around it).

VS-A:

• Type Standard
• HTTP-Profile: http-transparent (to be able to use LB method Fastest (node))
• Source Address Translation: none
• Default Persistence Profile: source_addr

Pool A:

• LB Method: Fastest (node)

VS-A:

• Type Standard
• HTTP-Profile: http-transparent (to be able to use LB method Fastest (node))
• Source Address Translation: SNAT
• Default Persistence Profile: none

Pool B:

• LB Method: Fastest (node)

Problem:

On some websites, people complain about loosing their sessions. I tracked it down to the VS-B, which can not persist connections to a website to the same node in Pool B. Since the VS-B does not see the original client IP, but only the 2 proxy IP's I have no idea how to establish a propper persistence. For a very important website, i wrote an iRule that "hard-binds" to a single Node in Pool B, based on the HTTP:URI.

My question:

Is my config any viable? Or what should I change? I read a lot of article here, but I never had the feeling, that those met my situation with the "2-stage" proxy environment. I was thinking about adding a http header with the original client IP by an iRule in VS-A so I have something to make a persistence decision in VS-B, but I'm not sure how to do that. I also often read about applying the OneConnect profile combined with proxy loadbalancing, but I don't think I really understood the reason and/or benefit, nor do I know where to apply it in this environment.

I hope I made it some kind of clear what I try to accomplish and where the problems are, since English is not my mother language and I'm a but rusted using it.

Any help or hint is very much appreciated.

Thanks in advance,

ichnafi

EDIT:(28th Feb)

I just found out, that the desired website can be acquired from the HTTP::host header even by Vs-B. So would it be possible to establish a persinstence for the combination client IP and HTTP::host header?

EDIT2: Possible Solution found (1st Mar)

I currently endet up with an iRule creating a universal persistence based on the http::host header. the iRule is then bound to a universal Persistense-Profile. The iRule looks lilke this:

when HTTP_REQUEST { 
    persist uie [HTTP::host]
}

I'm thinking of maybe creating a custom header that contains a combination of client_ip and http:host value to get an even more definite persistence, but not quite sure about that. What do you guys think?