Forum Discussion

ankuragiwal_102's avatar
ankuragiwal_102
Icon for Nimbostratus rankNimbostratus
May 09, 2011

SNAT port collision to Windows Server

We are using FastL4 profile and we are seeing SNAT port collisions to external servers running Windows TCP/IP.

 

 

F5 reuses port as soon as it becomes available while Windows TCP/IP keeps closed port in TIME_WAIT state and ignores packets. This leads to intermittent errors in connection initiation.

 

 

Error Scenario: Server1 creates an outbound connection to an external server using source port P, transfers data and then closes connection. Server 2 creates another outbound connection to same external server using same source port P. F5 reuses port P as it became available, however external server’s Windows TCP/IP stack ignores packets as port P is in TIME_WAIT state (all 4 tuples are same in this case: source IP, source port, destination IP, destination port).

 

 

We are using default SNAT configuration which is “preserve”. Is there a workaround to this problem for FastL4 profile?

 

config
design
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    May 09, 2011
    Do you have a OneConnect profile enabled on the virtual server? If so, you could remove it to prevent LTM from re-using the serverside connections for different clients. If you're not using OneConnect, LTM shouldn't be reusing serverside connections for different clients.

     

     

    If you're not using OneConnect, it might be the same client who is trying to re-use the same source port too quickly. Do you need to preserve the source port? If not, can you try setting source port to change. Or you could look into modifying the Windows TCP/IP stack to tune the time wait period.

     

     

    Aaron
  • ankuragiwal_102's avatar
    ankuragiwal_102
    Icon for Nimbostratus rankNimbostratus
    May 10, 2011
    We are not using OneConnect profile. I have confirmed that for two differnet clients, F5 is using same source port (this issue happens when as soon as first client closes connection, second client opens connection with same port). Modifying Windows TCP/IP stack is not an option. I will try changing SNAT configuration to "change".

     

     

    There is also TIME/WAIT Recycle setting. This belongs to TCP profile. Will this setting apply while using FastL4 profile?

     

     

     

    TIME/WAIT Recycle

     

     

    The system will recycle or reuse the connection when a SYN packet is received in a TIME/WAIT state. This option allows the system to better optimize system resources by reusing a connection in a TIME/WAIT state when a SYN packet is received, instead of creating a new connection.

     

     

    Note: If disabled, the system will establish a new connection instead of reusing a connection that is in a TIME/WAIT state.