For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jwitko's avatar
jwitko
Icon for Nimbostratus rankNimbostratus
Jul 03, 2013

src and dst host persistence through TCP/UDP protocol change

I currently have a setup where we are routing SIP through F5 BIG-IP LTM v10.2.4. Our code sends all SIP over UDP until it hits its MTU of 1400, for reasons I won't go into we can not raise this limit. Once it reaches greater than 1400 it converts those packets to TCP. We have no issue with packet conversion or data loss of any kind. The issue is that this initiates a round-robin selection for the new connection. Since it has switched protocols the LTM treats it as a new connection and this causes issues where we will have SIP invites and other packets on one server handling a call and then when a packet comes in larger than the MTU of 1400 it often ends up on a a separate server.

 

 

I have been trying to research the new TCP out of band feature on v11.1.0 and above but I have found little in the ways of documentation on it. Does anyone have any ideas or avenues for research they could share? Is this the type of thing an out-of-bound connection could assist with? The goal is to maintain persistence with src & dst host throughout the conversation as you would see if the protocol was not converted.

 

 

 

Best Regards,

 

 

Jason

 

 

 

2 Replies

  • Is there a unique identifier in the UDP datagrams that is also present in the TCP packets that we could use to maintain persistence 'manually' using an iRule?

     

  • Does it go to a new VS or Pool?

     

    In your persistence profiles you can set the following that might help:

     

    Match Across Services Match Across Virtual Servers Match Across Pools