Forum Discussion

Altocumulus

Sep 12, 2018

Remover APM Session after send response for user

Hi; I have a webservice published with F5 BigIp 13.1.1 and this webservice needs a authentication and SSO. I use de APM to valid the username, password and make de SSO Credential Mapping. This w...

application delivery

BIG-IP Access Policy Manager (APM)

iRules

Gustavo_Jardim_
Sep 12, 2018
I found the solution I needed add the HTTP Header "Connection: Close" during response of F5 to client.

When the F5 close APM session without "Connection: Close" in HTTP Header, the client will use the TCP Connection for another APM session and the F5 will close the TCP Connection when delete the first APM session.

It is the explanation for I have error when I have load, the client open another APM session using a same TCP Connection.

The best iRule that I make for this example is:

when HTTP_RESPONSE_RELEASE { HTTP::header insert "Connection" "Close" ACCESS::session remove }

Thanks all.

Vinne73_96575

Nimbostratus

Sep 12, 2018

I thought of something you could try. In your code, you delete the APM session yourself. Might it be an option to let APM clean up its own sessions? Maybe it knows better what to delete because its the "cleanup" process. I know you have a session limit to monitor, but you set the timeout very short.

Edit: you might have to set this during creation of the APM session, because when I tried this:

when HTTP_RESPONSE { ACCESS::session data set session.inactivity_timeout 30}

it didn't work. It seems you can't update inactivity_timeout after an APM session is complete and allowed.

So either you set it for the global APM Policy, or you could use an event in your APM flow that sets the timeout based on other parameters.

when ACCESS_POLICY_AGENT_EVENT { switch [ACCESS::policy agent_id] { "set_session_inactivity_timeout { if {...} { ACCESS::session data set session.inactivity_timeout ...} } } }

Gustavo_Jardim_
Altocumulus
Sep 12, 2018
Set inactivity timeout may be a solution for this problem, but I need do many test because the minimal time is 1 second and in this time I have 2000 request, so I will have 2000 sessions more in my enviroment. And more, if I set 1 second in inactivity timeout and my webservice delay 5 second for give the result, probably the session will be closed for APM (I don't know how the APM calculates the timeout, if is per resquet in or resquet out).

I will test this solution if I don't have any solution for close session imediatly.
Vinne73
Cirrus
Sep 12, 2018
I understand. In the initial question you said 2000 sessions per minute, so this solution could probably work with that number and a timeout of 15 seconds to allow for slow back-ends to reply. 2000 sessions per second is another thing :)
Vinne73_96575
Nimbostratus
Sep 12, 2018
I understand. In the initial question you said 2000 sessions per minute, so this solution could probably work with that number and a timeout of 15 seconds to allow for slow back-ends to reply. 2000 sessions per second is another thing :)
Gustavo_Jardim_
Altocumulus
Sep 12, 2018
Sorry, I wrote wrong, it's 2000 request per minute. I will test this solution and come back for say the result.