For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Andy_304337's avatar
Andy_304337
Icon for Cirrus rankCirrus
Nov 09, 2018

Source address Affinity

Hey   I have a internal standard vip set up as gslb on gtm across dc A& B. I set source address affinity to 8 hours on both dc ltm. Now I added one pool member to each dc ltm.   So if a new cl...
application delivery
BIG-IP
LTM
Philip_Jonsson's avatar
Philip_Jonsson
Icon for MVP rankMVP
Nov 09, 2018

Hey Andy

 

Just so that I understand correctly, Source Address Persistence is configured on the LTM devices?

 

The persistence table timeout value works using "Idle" timeout. So even though you have a timeout of 8 hours, as long as the same client source IP hits the VS, the timeout value will be reset to 0. Therefore, for the existing connections, they will continue to remain on pool member 1 until they have been idle for 8 hours.

 

Once the persistence record has been deleted due to the timeout, when a new request hits the VS it will load-balance the traffic and choose either member 1 or member 2. In this case, traffic could end up at member 1 again. If you want to make sure that traffic ends up at member 2 you have to either Disable member 1 (active and persistent connections is still allowed) or set it to Forced Offline (only active connections is allowed).

 

The problem with Source Address persistence, if your clients originate from a NAT device, they will come from the same source IP address and the it will be tougher for the timeout to occur.

 

I hope this helps! :)