Forum Discussion
User sessions getting timed out
We are having some issues with some applications that were recently migrated to ASM. The developers have been complaining the sessions are getting timed out. Our ASM only has light LTM and is not a fully balanced LTM and we don't load balance on ASM. Our virtual server points to SNAT pool of LTMs and then LTM further has a SNAT to the NAMs(Novell Access Manager) and then the app.
See how sessions get different NAM IPs
DEBUG - 2018-04-25 08:50:54 --> SESSION: sessionid 1.1.1.1 vs 10.10.10.10 ip not matching, but we will not destroy it.
DEBUG - 2018-04-25 08:51:11 --> SESSION: sessionid 11.1.1.1 vs 10.10.10.10 ip not matching, but we will not destroy it.
DEBUG - 2018-04-25 08:51:14 --> SESSION: sessionid 1.1.1.1 vs 10.10.10.10 ip not matching, but we will not destroy it.
DEBUG - 2018-04-25 08:51:15 --> SESSION: sessionid 1.1.1.1 vs 20.20.20.20 ip not matching, but we will not destroy it.
DEBUG - 2018-04-25 08:51:17 --> SESSION: sessionid 1.1.1.1 vs 20.20.20.20 ip not matching, but we will not destroy it.
The following irule fixed the issue but curious to know how to know which applications will need this and which wont and are there any other known issues with using this irule. Thanks in advance for all your help on this !
when HTTP_REQUEST { if { ![info exists static::array_size] or ![array exists static::snat_ips] } { unset -nocomplain static::snat_ips
set snatpool_name "/Common/my_snat_pool"
set members_cmd "members -list $snatpool_name"
set count 0
foreach snat_ip [eval $members_cmd] {
set static::snat_ips($count) [lindex $snat_ip 0]
incr count
}
set static::array_size [array size static::snat_ips]
}
snat $static::snat_ips([expr {[crc32 [IP::client_addr]] % $static::array_size}])
}
i assume you can't ask the person who wrote that iRule?
it seems like some persistence of the SNAT choice based on the client IP. so probably an application which requires all request to come from the same SNAT source for a specific application session need this.
i don't think it hurts to use it, so is there a reason why you want to not use it?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com