For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Lloyd_Bare's avatar
Lloyd_Bare
Icon for Nimbostratus rankNimbostratus
Nov 02, 2016

Persistence Question

We have just migrated from Cisco's ACE to F5's LTM platform.

 

We have a VIP that is primarily hit by two different Source IP's. I need persistence and ideally want to spread the load. On ACE we used a hash of the source address; and one of the source IP's was always sent to Pool Member A (assuming its up) and the other IP always was sent Pool Member B.

 

On F5 LTM we have tried source address affinity; and tried swapping between CARP and Default hashing algorithms; but all traffic goes to the same Pool Member. Anyone know a way to tweak these so that the hash may result differently between the two sources?

 

application delivery
LTM

7 Replies

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Nov 02, 2016

    If your goal is to spread the load for HTTP traffic, I would recommend using "Cookie Insert" persistence with "Least Connections (Member)" as the load balancing algorithm within the pool.

     

  • Greg_Labelle's avatar
    Greg_Labelle
    Icon for Nimbostratus rankNimbostratus
    Nov 02, 2016

    Try this irule as part of a Universal persistence profile. I use it when I have a similar situation to make the persistence based on both the source address and source port of the request.

    when CLIENT_ACCEPTED { 
    set client_ip_port "[IP::client_addr]:[TCP::client_port]"
    persist uie $client_ip_port
}
when SERVER_CONNECTED {
    persist add uie $client_ip_port 3600
}
  • keshav_163381's avatar
    keshav_163381
    Icon for Nimbostratus rankNimbostratus
    Nov 03, 2016

    You can create a custom persistence profile and change the mask settings under the custom settings and configured a 255.255.255.255 which will solve your problem :)

     

    • Lloyd_Bare's avatar
      Lloyd_Bare
      Icon for Nimbostratus rankNimbostratus
      Nov 03, 2016

      That is how I have it configured currently. This is working for the TCP80 VIP with the same source IP's connecting, but not working on the TCP7003 VIP. Very strange.

       

    • Lloyd_Bare's avatar
      Lloyd_Bare
      Icon for Nimbostratus rankNimbostratus
      Nov 04, 2016

      I'm still having issues using the methods shared by the group here. In ACE I was able to use load balancing predictor of "hash of source address"; which isn't necessarily a persistence method; but accomplishes that natively. I've not been able to find a way to do this on the F5 because the initial request is going to use the Pool Load Balancing algorithm that is set (Predictive (Node)); and then make a persistence record based on source address for example. I'm still getting all the requests hitting the same server. Maybe I need to change to round robin?