For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Anthony's avatar
Anthony
Icon for Nimbostratus rankNimbostratus
Jan 29, 2015

oneconnect profile use

Hi all,

 

I am looking to make some changes to our oneconnect profile, and testing isn't going quite how I was expecting it too.

 

When I disable a node I am expecting to be able to reconnect while the oneconnect profile is valid, but once the Max Age is reached I would expect the connection to have to refresh so to speak and then see that the node is disabled and not be able to connect. However, this doesn't seem to be happening and I can just keep using it, even after some time.

 

New sessions see (or don't see as it may be) that the node is disabled and cannot connect.

 

Is my assumption on this incorrect? Any help or advice is greatly appreciated.

 

Thanks Anthony

 

3 Replies

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jan 29, 2015

    I don't know specifically with oneconnect but....

     

    If you disable a node existing connections and persistent connections are maintained. i.e. if a node has a persistence entry and a client returns within the timeout then they will still go to the node, even if it is disabled.

     

    With oneconnect as it's keeping open a serverside connection i would imagine this would be the case too.

     

    Force Offline would help with persistent connections but I'm not sure about with oneconnect as, again, existing connections are maintained.

     

    Interesting one, hopefully i've helped and others can confirm/expand on this.

     

    Rgds N

     

  • Anthony's avatar
    Anthony
    Icon for Nimbostratus rankNimbostratus
    Feb 02, 2015

    Hi Nathan, thanks for the reply. I will be taking a look at the persistance settings today. I know I have cookie persistance in place, so maybe I need to look at a more widespread change.

     

    The end goal here is that I want to timeout connections within say 30 minutes, regardless of persistance. If you, or anyone else who pops along has info on how I can acheive that I would be very interested to hear it!

     

    Thanks,

     

    Ant

     

  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Feb 02, 2015

    Hi,

    the current implementation of OneConnect is designed to be used in combination with HTTP traffic and http profile.

    It will respect the tcp idle-timeout settings of assigned tcp-profiles both on client- and serverside (be aware of default "keepalive timer" settings in your tcp-profile).

    As it will "re-cycle" a serverside connection by multiplexing multiple clientside connections into a single serverside connection it might make sense to modify the OneConnect profile mask to 32 bit. Now connections from same client IP will be aggregated/pooled on serverside.

    Table based persistence records will be updated with new incoming connections/requests only. Watch them by using tmsh: 

    watch tmsh show ltm persist persist-records

    Configuration changes apply to new connections only. Especially with OneConnect applied this may have confusing effects. I use to clean up the connection table before running new tests with modified config: 

    tmsh delete sys connection

    Thanks, Stephan