table and HA

Hi Piotr,

I'm using the table command for a Pre-Auth / Single-Sign-On functionality (aka. storing cookie values and credential sets into tables) on a three node 8950'er active/active cluster with session mirroring enabled. It works like a charm where a (controlled or unexpected) failover hasn't cause my clients to reathenticate yet. So personally I would rate this functionality as very very reliable...

"StateMirror.MirrorSessions" controls this behavior and yes it's enabled by default and imediatly starts to replicate your session information once you've created the cluster group with valid session mirroring configuration. No need to enable VS specific settings...

Since v11.4 you are able to use Active/Active traffic groups where each traffic group has its own replication channel and also its very own "session table" container, where the data of this traffic group can be stored.

Each of your traffic groups has always only one "active" member where data can be insert and all other traffic group member are just replicas.

Trying to update table data on standby units would cause your system to "no-op" those commands (no-operation = do nothing), but I didn't try that before nor do I even know a way to call the

[table]

Furthermore an iRule triggered by VS1 in TG1 cant access data generated by VS2 in TG2. Each TG has now its own table.

For further reading on this topic: https://devcentral.f5.com/articles/big-ip-114-behavior-change-global-data-now-partitioned-by-traffic-group

Regarding your question on SOL13478: I duno, I don't use TCP-Mirroring for HTTP. Its simply not worth... 😉

Cheers, Kai

Hi Kai,

Thanks a lot. I am not sure if I understand this correctly:

"StateMirror.MirrorSessions" controls this behavior and yes it's enabled by default and imediatly starts to replicate your session information once you've created the cluster group with valid session mirroring configuration. No need to enable VS specific settings...

So what exactly enabling or disabling connection mirroring for VS or SNAT is doing? If I understand correctly what you stated above whole session table is mirrored right away - no matter if connection mirroring is enabled on any object - is that correct? Or by session information you means only keys stored in sub/table by iRules?

Based on article you pointed me to (appreciate - it explains exactly what I was not sure about) I have to assume that table data can't be accessed cross TG 😞 but it was in the pre 11.4 versions

I was looking for fast and reliable way to exchange table data between separate devices/VE. My idea was to create HA config (but not exactly to achieve HA) to spread load between two (or more devices) keeping ability to reference same sub/table keys. Sure mod operations on subtables could be performed only in one TG but other TGs could read keys from this sub/tables. That way decisions could be made on given device (standby for TG) based on info stored by another one (active for TG).

Sure can be done via some sideband or VS directed requests but that seems to be much more complicated and not as fast and reliable.

Well, in relation to SOL13478 I am not talking about tcp session data but table keys. And actually I am not sure what failback means in "Note: Only FastL4 and SNAT connections are re-mirrored after failback" - so device A active - sub/table data copied to deice b, then device A fails so device B is active and using/updating table data, then device a back online - assume that now sub/table data is copied to device A - or I am wrong?. Then I am doing manual failover to device A - I assume that no sub/table data should be lost? So in what situation and what data is lost during "failback"?

Piotr

Hi Piotr,

the "session table" replication is controlled by just "StateMirror.MirrorSessions" settings and is completely independent of the "network connection" replication of your individual virtual servers / SNATs.

"network connection" mirroring for VS or SNAT can be turned on or off depending on your needs. Once enabled it would replicate some sort of "stateful connection tables" between the devices to allow a silent failover of already established connections. Without "network connection" mirroring, a reestablishment of the connections would be required to continue.

Regarding: I was looking for fast and reliable way to exchange table data between separate devices/VE.

At least im not aware of a fast and reliable way to do this. The things I'm aware of are slow and/or unreliable (aka. using sidebands in combination with webservice calls (slow but reliable) or even data exports/imports (fast but unreliable for write access due to a duplication of information which may causes race condition to ocour)

You should see the performance of table queries like this...

• TMM1 reads data which is held on TMM1 (its very fast without pausing the TCL execution)
• TMM2 reads data which is held on TMM2 (its very fast without pausing the TCL execution)
• TMM1 reads data which is held on TMM2 (its alredy somewhat slow and pauses the TCL execution on TMM1 while waiting for TMM2 to respond)
• TMM1 on device UNIT1 reads data over a sideband from device UNIT2, using TMM2 of UNIT2 as entrypoint to finally access data on TMM1 of UNIT2. (its slow like hell, since you need to call accros the network and maybe jump between TMMs on the destination UNIT at the same time)

Regarding: SOL13478

This article is referencing to "network connection" mirroring (TCP, UDP, SNAT) and not to "session table" mirroring (persistence records, table information). I haven't seen any problems so far with

[table]

Cheers, Kai

I assume that inter traffic group table access was somehow possible before 11.4 and now it's not. I can see benefits of session table space partitioning per TG but kind of read only access (lookup) could be implemented - as it seems to be fastest way to exchange data between iRules in different TGs - but well, we have what we have and have to figure out some way to use it :-)

Great explanation about difference between network connection and session table and how mirroring works for both! Thanks for help (again :-)

Piotr

Hi, . Not sure what exactly I should check in this article. I found statement about same hardware as well as some email confirmation I received from F5 support that this statement is valid for session data.

Sure it was some time ago, as well as doc I am referencing is for 11.5.3 so maybe this limitation is no more there.

Here is link Managing Connection Mirroring and statement is:

Important: Connection mirroring only functions between devices that reside on identical hardware platforms.

Piotr