For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

f5guyskenzi's avatar
f5guyskenzi
Icon for Altostratus rankAltostratus
Jul 05, 2024

Packet based load balancing instead of connection based (default)

Hi everyone,

I have a requirement to load balance iso 8583 echo messages across two servers in a pool. I used a performance Layer 4 virtual server to attempt achieving this because I reckon that is the type of virtual server that could fulfill the requirements of load balancing all the requests across the 2 servers in the pool. However, requests are only being sent to one pool member. I also tried to craft an iRule (see below) to do this, still requests are only sent to one pool member.

when CLIENT_ACCEPTED {
 log local0. "ACCEPTED !!"
 TCP::collect

when CLIENT_DATA {
  log local0. "DATA !!"
  #to get the length of messagein hexadecimal,the length info can be get from the first 2 byte
  binary scan [TCP::payload] H4 len 
  log local0. $len
  #convertlentodecimal
  scan $len %x len 
  log local0. $len
  #totalmessage length is length + 2
  set len [expr { $len + 2} ] 
  if {[TCP::payload length] < $len} {
  TCP::collect [expr {$len - [TCP::payload length]}]
  return
}
  TCP::release $len
  TCP::notify request
  TCP::collect
}
when LB_SELECTED {
  log local0. [LB::server]
}
when SERVER_CONNECTED {
    log local0. "Server Connected !!"
    TCP::collect
}
when SERVER_DATA {
    log local0. "response: [TCP::payload]"
    TCP::release
    TCP::notify response
    TCP::collect
}

 

Has anyone done packet-based load balancing before? Any ideas?

5 Replies

  • It is impossible on an F5 device.

    The F5 device can load balance to only one server.

    If you need to send packets to both servers, you can use a client/server clone pool or a TAP switch.

  • BIG-IP really wants to:

    1- Receive a packet for my MAC

    2- Look at the VLAN and L4 source/dest and match a virtual

    3- Add this flow to the flow table

    4- Try to connect the server-side of the flow or continue the client-handshake, depending on how the proflies are set up

    All of the traffic processing hinges upon what's in the flow table, so there's not really a way to "turn it off". 

    However, you can easily reconnect the server-side to a different server using "LB::reselect":

    https://clouddocs.f5.com/api/irules/LB__reselect.html

    You can also reconnect the flowserver-side to a server using the "node" command if you want to disregard all BIG-IP load balancing logic:

    https://clouddocs.f5.com/api/irules/node.html