Forum Discussion

Shayne_Rinne_84's avatar
Shayne_Rinne_84
Icon for Nimbostratus rankNimbostratus
Jul 03, 2008

VIP to VIP communication

We have a performance issue when using the F5 in the following communication flow:

 

 

Client -> F5 VIP -> Apache Reverse Proxy -> Proxy to a F5 VIP on the same F5.

 

 

We do not see a performance issue with this communication flow:

 

 

Client -> F5 VIP - Apache Reverse Proxy -> Proxy directly to the physical server which bypasses the F5 VIP.

 

 

 

The difference is fairly large (upwords of 20 seconds for a page load), has anyone see this before? We are wondering if the OneConnect option will help solve our problem, but we have never used this profile.

 

 

Help?

 

 

config
design
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 04, 2008
    Hi Shayne,

     

     

    I've been working on a similar implementation recently and it's working fine. There shouldn't be anything that would cause LTM to stall a connection for 20 seconds. The main thing that might change when you route the Apache to app flow through a VIP is LTM could be configured to translate the source IP to its own address. If there is SNAT on the LTM to app connection, it's possible that some type of validation is being done on the app. I'd try running a tcpdump on LTM and the applciation (using tcpdump for *nix or Wireshark for Windows) and see what's happening. If you're using Wireshark, you can add a column for time delta. It should be pretty clear where the latency is occurring. If you get stuck, you can compare the trace with a successful test bypassing LTM for the Apache to app connection.

     

     

    Aaron
  • Nicholas_Irving's avatar
    Nicholas_Irving
    Icon for Nimbostratus rankNimbostratus
    Jul 23, 2008
    I have seen something similair, but it is random. The config we have is as follows.

     

     

    Client -> F5 VIP -> Apache Reverse Proxy -> Proxy to a F5 VIP on another F5.

     

     

    Not sure what it is though.

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 24, 2008
    If you're able to capture a binary formatted tcpdump of the issue, F5 Support should be able to help diagnose the issue.

     

     

    Aaron
  • MaheshV_65076's avatar
    MaheshV_65076
    Icon for Nimbostratus rankNimbostratus
    Oct 19, 2008

     

    I have an identical configuration in my environment:

     

    Internet Client -> F5 VIP -> Apache Reverse Proxy -> Proxy to a F5 VIP on the same F5 --> Physical application tier servers.

     

    We have this configuration for http and https.

     

     

    But this configuration leads to non-stickiness session issue. The 2nd F5 VIP to physical servers flips even though we have cookie persistence lookup across all VIPs.

     

    This flip occurs particularly when the client switches from http to https.

     

     

    Any clues?