Rewrite for another Virtual Server (Cookies and Sessions)

Hi,

 

 

Can you clarify what your overall goal is, what you've configured and what issue(s) you're seeing. If you could attach a simple logic diagram it might help.

 

 

Specifically, when you say you're using the proxypass iRule to rewrite a directory on another virtual server, what do you mean? Is the overall problem that persistence fails? Is BigIpServervs2 a cookie insert persistence cookie?

 

 

Thanks,

 

Aaron

The goal is to have the BigIpServervs2 cookie to be the same when the user make there request to vs1 (www.site.com). If the user navigates to www.site1.com/core, the request is re-written as www.site2.com/core; at this point they get a BigIpServervs2 cookie. During this session when the user attempts to login or make a purchase, a request is made for vs2 (www.site2.com), the user receives another BigIpServervs2 cookie at this point. If the contents of the BigIpServervs2 cookie is the same we're all good. If not, we have problems with logins and purchases. The BigIPServervs2 is a cookie insert (vanilla default cookie on BigIp 6400). I'll post a diagram as well.

Aren't the two BigIpServervs2 cookies being set because both VIPs reference the same pool and use the same cookie insert persistence profile? If so, the cookie should be valid regardless. If they are separate pools, you could create a custom cookie insert persistence profile and name the cookie something different for one of the VIPs.

 

 

If I've missed something in your scenario, let me know.

 

 

Thanks,

 

Aaron

I'm attaching a logical diagram for the session.

Thanks. The diagram clears some things up.

 

 

One thing to keep in mind is that a client who requests something from www.site1.com will not send any cookies set by the www.site2.com domain (or vice versa).

 

 

Are the servers in pool1 and pool2 related to each other in any way (same IP addresses, but different ports, etc)? I'm guessing not, but figured I'd ask. If not, how do requests from a client which go to both pools need to be persisted in order for the applications to maintain sessions.

 

 

Also, what persistence method(s) are you using on the two VIPs?

 

 

And when you note that requests for www.site1.com/appa are sent to pool2 is that done via the ProxyPassV10 iRule? Or are you sending them to the www.site2.com virtual server from an iRule?

 

 

Aaron

Gotcha on the "one thing". Pool1 and Pool2 are not related different ips, different servers. For the application to maintain the session the BigIpServervs2 cookie must have the same content (I'm told by the developer, I'm still getting information)? The client is receiving two BigIpservervs2 cookies; one from the request to vs2 and one from the rewrite to pool2. The re-write is done via the ProxyPass iRule. The old one not v10.

Are the BigIpServervs1 and BigIpServervs2 cookies from cookie insert persistence profiles? If it is cookie insert persistence you're using, it's a bit tricky trying to depend on it for persisting clients who have made a request to VS2, created a session on that app and then made a request to VS1's /apa_core URI and been sent to pool2. LTM wouldn't have any idea that the client needs to be persisted to the same pool2 member as the client won't send the persistence cookie from VS2 to VS1.

 

 

I think the simplest fix would be to redirect clients who request /apa_core on VS1 to VS2. I'm not sure this is possible from a client experience perspective, but it would make for a quick fix. If that's not an option, I think you'd need to create a session table entry mapping the client to a specific pool2 member. The problem with this is that the only common part of a client request to VS1 and VS2 I can see is the client IP address.

 

 

Aaron

We're using the default "cookie" for persistence for all of our virtual servers. I think we might have to look into the quick fix you mentioned. However, we have use a rewrite instead of a redirect. With a redirect we'll have to introduce another Jboss server to support the vs1 domain.

 

 

Thank you I appreciate your assistance!

Are we able to use the proxypass irule to rewrite to VS2? i.e. indicate /apa_core www.site2.com/apa pool2 as the datagroup string. Or do we need to write another irule to conduct this rewrite?

I'm researching here, and it looks like a Destination address affinity persistence or Source address affinity persistence profile will resolve our problem. This way when the rewrite happens to vs2 the user is sent to the same pool member? The vs2 virtual servers contains Jboss pool members, I'm hoping the use of sticky sessions would not screw up any dynamic requests.