For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rajendra_129865's avatar
Rajendra_129865
Icon for Nimbostratus rankNimbostratus
Jun 19, 2014

Need assitance in applying URI based customized persistence profile through iRule

We are looking to apply jsessionid based persistence profile for specific URI. However we have created jsessionid persistence profile through iRUle. But unable to apply this for a specific URI reques...
application delivery
devops
iRules
nitass_89166's avatar
nitass_89166
Icon for Noctilucent rankNoctilucent
Jun 22, 2014

This worked for only login and application login and logout session. But traffic related to any process done after logging to the application, used to load balance among the pool members and application breaks.

do all the uri after logging in start with /abc?

is it possible the request after logging in matches more than one condition in the irules?

have you tried tcpdump/ssldump to see what is going on exactly? you have private key to decrypt traffic, haven't you?

e.g.

 tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x or host y.y.y.y or host z.z.z.z -v

x.x.x.x is virtual server ip
y.y.y.y is pool member ip
z.z.z.z is another pool member ip

by the way, i think the rule1 should look like this.

when HTTP_REQUEST { 
  switch -glob [HTTP::uri] { 
    "/abc*" { 
      if { [HTTP::cookie exists "JSESSIONID"] } {
        persist uie [HTTP::cookie "JSESSIONID"] 300
      }
      pool pool_abcservers 
    }
  }
}
when HTTP_RESPONSE {
  if { [HTTP::cookie exists "JSESSIONID"] }  {
    persist add uie [HTTP::cookie "JSESSIONID"]
  }
}
Rajendra_129865's avatar
Rajendra_129865
Icon for Nimbostratus rankNimbostratus
Jun 24, 2014
Yes as of now I have applied this iRule only. Verified the tcpdump logs and found that although jsessionid is same and connection gets load balanced instead of persisting to same server. Below is an output from LB and captured for specific Jsession ID - 14E5399BEC47CD1BED0237CD845EE225. From the output observed that although the jsessionid is same and is getting load balanced between pool members 10.247.98.34:8002 and 10.247.98.34:8003. ************************************************** universal - X.X.X.X:443 - 10.247.98.34:8002 --------------------------------------------------- TMM 0 Mode universal Key 14E5399BEC47CD1BED0237CD845EE225 Age (sec.) 146 Virtual Name vs_X.X.X.X_https Virtual Addr X.X.X.X:443 Node Addr 10.247.98.34:8002 Pool Name pool_abcservers Client Addr 10.243.119.81 universal - X.X.X.X:443 - 10.247.98.34:8003 -------------------------------------------------------------------------------------------------------------------------------- TMM 1 Mode universal Key 14E5399BEC47CD1BED0237CD845EE225,CRQ99077=576911114.17183.0000,path=/,secure=secure,Secure=Secure,Path=/abc, Age (sec.) 143 Virtual Name vs_X.X.X.X_https Virtual Addr X.X.X.X:443 Node Addr 10.247.98.34:8003 Pool Name pool_abcservers Client Addr 10.243.119.81 universal - X.X.X.X:443 - 10.247.98.34:8002 -------------------------------------------------------------------------------------------------------------------------------- TMM 0 Mode universal Key 14E5399BEC47CD1BED0237CD845EE225,CRQ99077=576911114.17183.0000,secure=secure,path=/,Secure=Secure,Path=/abc, Age (sec.) 145 Virtual Name vs_X.X.X.X_https Virtual Addr X.X.X.X:443 Node Addr 10.247.98.34:8002 Pool Name pool_abcservers Client Addr 10.243.119.81 **************************************************