OneConnect & Multiple Request in the Same TCP Connection

if you are not offloading ssl and no http profile is not applied, oneconnect will not work as expected. if you want full functionality then you need to do ssl off-load and apply http profile.

 

if you apply oneconnect on the vip which uses ssl services then you may get an issue with that service. In your case big-ip will not be able to track http flow since traffic is encrypted. it will use TCP connection only for tracking.

 

The problem is, your client tries to initiate ssl session with a pool member. In order to use oneconnect big-ip need to maintain ssl session on the back-end side, which it can not due due to ssl bypass

 

OK, what oneconnect does it reuses the tcp session on the server side. Assume next situation. There is no connection to the server side yet. You are pipelining 5 concurrent http requests in one tcp connection. At this stage LB will be made based on HTTP requests, not TCP connection. The 1st request will go to pool 1, 2d to pool 3 etc.

 

Back-end servers replied for all the requests. Big-ip drops the connection on the client side, but keeps connection opened on the server side.

 

Now the 2d butch is arriving. Big-ip will not create new TCP connection, it will reuses existing, opened connection on the server side and will send HTTP request via the existing tcp connection, so reducing the time for establishing new TCP session.

 

Requirements for oneconnect - your back-end servers must support http piplining and keep-alive

 

So, it is going to be in the next way. HTTP pipeline of 5 requests comes in. Big-ip checks for persistence. No persistence check for the opened connection with the next pool member according LB algorithm. If there is opened connection, then re-use it for the 1st http request. Second HTTP request comes in using the same TCP connection on the client side. Now, LB algorithm takes HTTP request into account (not tcp connection). Checks for the next pool member according LB. If there is an opened tcp connection, reuse it, no connection - open a new one.

 

This is true until you apply persistence profile. In case of persistence all the requests from the same client will go to the same pool member.

 

Oneconnect marge http request from different client on the same tcp connection on the server side. In the packet capture in one tcp flow you can see multiple http requests and replies designed for several clients. This is why your servers need support HTTP pipeline to merge http requests into one tcp connection and http keep-alive to keep the server side connection opened.