Forum Discussion

robert_blair_75's avatar
robert_blair_75
Icon for Nimbostratus rankNimbostratus
Jun 12, 2009

Outbound https virtual server

Hello,

 

 

I am running F5-Link Controllers 9.4.6, I am trying to configure an outbound virtual server with https persistence. I have some external sites that I access via https and cannot load balance between the external links once a connection is established.

 

 

So far I have created 2 Virtual servers:

 

 

VS: outbound_gateway, service: 0 (for all outbound non-https traffic)

 

Pool: outbound_pool, members: 10.10.10.10:0, 10.10.10.20:0

 

 

VS: outbound_gateway_https, service: 443 (for all outbound https traffic)

 

Pool: outbound_pool, members: 10.10.10.10:0, 10.10.10.20:0

 

 

The network Route is set to: outbound_pool

 

 

I am not sure how to setup the persistence for the outbound_gateway_https virtual server. I was thinking of adding a persistence profile based on:

 

- Destination address affinity

 

- Match Across Services

 

- Match Across Pools

 

 

Any advise would be great….Thanks …

 

config
design
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jun 15, 2009
    Why do you want to break out the HTTPS traffic? I'd think you could use a single port 0 virtual server pointing to a pool of gateways. You could use destination address persistence without the "match across..." functionality enabled.

     

     

    Aaron
  • robert_blair_75's avatar
    robert_blair_75
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2009
    My thoughts were to setup persistence only where needed. If I setup persistence for all outbound traffic this would not truly load balance the links for outbound traffic. Also wouldn't I run into a problem of running out of entries in the persistence table?

     

     

    Thanks …

     

  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Jun 15, 2009
    Hi,

     

     

    Your initial thought is what I have usually done with LC for HTTPS (destination address affinity). But you shouldn't need the "match across" options in the profile. Those are useful for making sure a client goes to the same server on 443 as they did on 80, for example, but for LC going outbound with wildcard addresses that shouldn't be necessary.

     

     

    Denny