For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

CraigM_17826's avatar
CraigM_17826
Icon for Altocumulus rankAltocumulus
Jul 13, 2010

Odd behaviour when pooling to a Tomcat server

Hi all,     we are experiencing an odd issue when traffic which contains specific text is directed to a Tomcat server pool. The URI detection works fine and the tomcat app itself is shown in a i...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jul 13, 2010
Hi Craig,

 

 

This OneConnect wiki page has some good background on the feature:

 

http://devcentral.f5.com/wiki/default.aspx/AdvDesignConfig/oneconnect.html

 

 

I'd guess the issue is with multiple HTTP requests on the same clientside connection which should be sent to separate pools. Without OneConnect, LTM only makes a load balancing decision once per clientside TCP connection. With OneConnect enabled, LTM will evaluate each HTTP request instead. If the second request was going to the wrong pool/pool member, the server might not have a valid session for the request and consequently send a 404.

 

 

If you're not using source address translation on the VS, I'd suggest creating a custom OneConnect profile with a 255.255.255.255 source mask and adding that to the VS. This ensures that serverside connections are only reused for the same client IP address. As a result, server logs will accurately reflect the true client IP address. If you are using SNAT on the VS, then it's most efficient to use the default OneConnect profile with a /0 source mask (any serverside connection can be reused for any client IP).

 

 

Aaron