For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

aadolf25_114152's avatar
aadolf25_114152
Icon for Nimbostratus rankNimbostratus
Aug 29, 2015

LTM Mutliplexing

I don't know if this is possible, but I need to make one TCP connection to each node, but allow many other tcp connections to be terminated on the LTM.

Our application connects to a payment processor and they only allow one connection per IP/port. So, I created a node for this IP and port, added it to a pool and created a virtual server. All is fine with one connection, but as soon as I try to make another connection it fails and on the processor side they see another attempt and recycle the connection, which causes an outage. So, I am unable to restart the apps since only one app at a time can access the processor. I hope this makes sense. TY

EXAMPLE of requirement:

Application Server 1 TCP connection --> VS 192.168.1.5 port 8555 

                                                               ---> processor 172.16.1.5 port 8555

Application Server 2 TCP connection --> VS 192.168.1.5 port 8555

application delivery
availability
design
LTM

2 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Aug 30, 2015

    You may be in luck... Or not... Too many unknowns to be sure...

     

    The feature you're after is one-connect... But in order for it to multiplex correctly, I think it'll have to be HTTP traffic (Otherwise PTM won't know hoe to multiplex the request/response traffic to serialise it).

     

    If it is HTTP, then configure the cone-connect with a mask of 0.0.0.0 (Means any client IP will match an existing server side connection and re-use it) and set the max connections of the node to 1 (So you don't get a second connection created).

     

    Now.. I'm not 100% sure what will happen if the server-side connection is busy... (Sorry, not tried that scenario).

     

    However even if those assumptions fail, as long as YOU can code in an iRule to differentiate between the request/response, then you could accept the request in the iRule, and process it yourself. Possibly with a sideband connection.

     

    H

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Sep 07, 2015

    i see this in the one connect SOL

     

    •The OneConnect profile may be used with any TCP protocol, but only when applied to virtual servers that process simple request/response protocols where transaction boundaries are explicitly obvious, such as those in which each request and each response is contained within a single packet.

     

    have you just tried configuring it?

     

    http://support.f5.com/kb/en-us/solutions/public/7000/200/sol7208.html