ACE SSL Reverse Proxy for multible URLs

Hi,
I am trying to setup an ACE as a reverse proxy (one-arm mode) for HTTPS connections for multiple URLs to multiple serverfarms. From what i know i have two options:
1. Use different VIP for each URL and do
L4 loadbalancing or use a
combination of IP address and port.
2. Use different VIP for each URL, do
SSL offloading and do L7 URL based
loadbalancing.
So with these options i am bind to use different IPs for each site. Is there a way i can use one VIP and then offload SSL and do URL based loadbalancing? From my knowledge we are restricted by the nature of the SSL. The reason is that the SSL protocol is a separate layer which encapsulates the HTTP protocol. So the problem is that the SSL session is a separate transaction that takes place before the HTTP session even starts so there is no visibility of the HTTP header.
Any comments appreciated
George Georgiou

Geroge,
your understanding is absolutely correct.
We need to know the site in order to decrypt te traffic because the certificate is associated to a domain name.
But without decrypting, we can't see the domain name.
So, the only way to know the domain without decrypting is to allocate a single ip to each domain.
There is no other solution.
Gilles.

Similar Messages

  • ACE 4710, reverse proxy?

    Hello All,
    Please forgive my ignorance but can the ACE appliance behave as a reverse proxy for http and ssl traffic? I would assume it can given how it does SLB but SLB is not a requirement at this time. Thanks for your input.

    Hi Mate,
    The reverse proxy servers can perform many tasks, like:
    Note: this info from Wikipedia: http://en.wikipedia.org/wiki/Reverse_proxy
    Reverse proxies can hide the existence and characteristics of the origin server(s), The ACE will do that.
    Application firewall features can protect against common web-based attacks. Without a reverse proxy, removing malware or initiating takedowns, for example, can become difficult, The ACE has some built-in security features, you can refer to this document for full detail:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/security/guide/securgd.html
    In the case of secure websites, the SSL encryption is sometimes not performed by the web server itself, but is instead offloaded to a reverse proxy that may be equipped with SSL acceleration hardware. The ACE can do this:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/ssl/guide/sslgd.html
    A reverse proxy can distribute the load from incoming requests to several servers, with each server serving its own application area. In the case of reverse proxying in the neighborhood of web servers, the reverse proxy may have to rewrite the URL in each incoming request in order to match the relevant internal location of the requested resource. The ACE can do that perfectly.
    A reverse proxy can reduce load on its origin servers by caching static content, as well as dynamic content. Proxy caches of this sort can often satisfy a considerable amount of website requests, greatly reducing the load on the origin server(s). Another term for this is web accelerator. A reverse proxy can optimize content by compressing it in order to speed up loading times. Please check this link for more detail about ACE Application Acceleration and Optimization:
    http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_2_7/configuration/app_acc_and_opt/guide/appaccoptgd.html
    Best regards,
    Ahmad

  • Reverse Proxy Configuration - Apache as an SSL reverse-proxy

    Hi,
    We have EP 6.0 SP 14 installed with SSL configured.
    We are in need to open the application to internet.
    For the same we have set up a reverse proxy server (Apache as SSL
    Reverse Proxy).
    Our requirement is to open the application to the internet with
    web address https://abc.domain.com.
    The issue is we are able to access the application from internet only when
    https://abc.domain.com/irj/potal is typed.
    (ie.) Mapping is working fine for
    https://abc.domain.com/irj/portal to
    our EP Portal address https://abc2.domain.com:50001/irj/portal
    And not working for mapping https://abc.domain.com to our EP Portal
    address https://abc2.domain.com:50001/irj/portal
    We have been working on to resolve this issue for days together but have been really unsuccessful
    Kindly help us in resolving the same asap.
    Note : The references we used are:
    1. SAP's document:
    "Apache Reverse Proxy Configuration for J2ee 6.20 and 6.40 Web Applications"
    2. Weblogs:
    The Reverse Proxy Series -- Part 1: Introduction
    The Reverse Proxy Series -- Part 3: Apache as a reverse-proxy
    The Reverse Proxy Series -- Part 3.1: Apache as an SSL reverse-proxy
    Regards,
    venkat.

    Thanks much for the feedback. We're using the default settings on the HTTP rule we have set up for the portal on the ISA server. We'll be looking into the details of what the default rule settings are, however we did find a note in the Microsoft Knowledge base detailing with the ISA server screening high bits in URL strings for Outlook Web Access (OWA). This generates a similar error message. Here is the link to the detailed note on the Microsoft web site:
    http://support.microsoft.com/?scid=kb;en-us;837865
    Also,we are going to be applying the SP1 upgrade to the ISA server (released in March) to see if this might be some type of issue that may have been identified and corrected by the service pack. We'll see what happens with that.
    One area where we can recreate the problem at will is when we set up the system landscape configuration. We can navigate to a system configuration object, however when we attempt to right click to edit the object we get the error. There are other circumstances where we get errors but that is one that occurs for sure. Anyone have any idea as to what might be special about that type of transaction??
    Thanks again.
    Rich

  • Setting apache reverse proxy for EP6SP2

    Hi friends,
    I want to set apache reverse proxy for EP6SP2. But after doing the following changes, it is showing the SAP J2EE Engine documentation page.
    The following changes has been dont to httpd.conf:
    NameVirtualHost 1.1.1.1:80
    <VirtualHost 1.1.1.1:80>
      ProxyRequests Off
      ServerName ep6.xyz.com
      ProxyPreserveHost On
      proxyPass        /  http://ep6.xyz.com:50000/
      proxyPassReverse /  http://ep6.xyz.com:50000/
      ErrorLog logs/base.80.error.log
      CustomLog logs/base.80.custom.log common
    </VirtualHost>
    Help needed.
    Regards,
    Nilz

    Hi,
    I have a problem with my proxy:
    ssl.conf.in like
    ProxyPass /irj http://debmsu06.server.###.de:50300/irj
    ProxyPassReverse /irj http://debmsu06.server.###.de:50300/irj
    RewriteRule ^/$ /irj/portal [R]
    If I use URL:
    https://bebuyer.###.de/ goto https://bebuyer.###.de/irj/portal
    but if I use
    https://bebuyer.###.de/irj/
    I get the info:
    https://bebuyer.###.de/irj/HTTPS:/bebuyer.###.de:443/irj/index.html
    What is happened? How I can redirect to /irj/portal?
    Of course I can use
    http://debmsu06.server.###.de:50300/irj/
    Could you please give me some tips?
    Best Thanks!
    Heren Zhou

  • WebServer 6.1 SP3 SSL reverse proxy to Sun One Application Server 7

    I have an application in the appserver7 that requires SSL authentication. I have already installed a self cert in the appserver7, and the authentication works fine when I browse directly to the appserver.
    The appserver7 has both listener for port 80 and 443 enabled.
    I'm currently setting up a webserver (WebServer 6.1 SP3) to act as a reverse proxy to the appserver7. The reverse proxy for the basic jsp pages found in the appserver worked fine.
    When I try to access the login page, in the appserver, in ssl mode, I am unable to do so. I then try changing the obj.conf to the following, from http to https:
    <Object name="passthrough">
    ObjectType fn="force-type" type="magnus-internal/passthrough"
    Service fn="service-passthrough" method="(GET|HEAD|POST)" servers="https://172.2
    8.48.53"
    However, it still doesn't work.
    Do I need to install a self cert in the webserver and enable the ssl listener as well?
    Do I need to install any reverse proxy addon for the appserver? Any
    setup for the obj.conf in the appserver?
    Any ideas how to get this done?
    Thanks.
    Mac.

    The Web Server 6.1 SP3 Reverse Proxy Plugin is supported, but it sounds like you're trying to do something that simply isn't possible.
    If you want the Reverse Proxy Plugin to perform SSL mutual authentication with the Application Server using the client's certificate, that's impossible due to the nature of SSL mutual authentication. If the plugin could impersonate the client, then SSL would be vulnerable to MITM (Man In The Middle Attacks). Fortunately, SSL isn't vulnerable to such attacks because the plugin doesn't know the client's private key.
    If you simply want the Reverse Proxy Plugin to pass information about the client's certificate along to the Application Server, that hapens automatically. There's nothing special to configure. Note that the plugin will not authenticate to the Application Server in this case. Rather, it will simply copy the X.509 certificate into the proprietary Proxy-auth-cert: HTTP request header.
    The application running on the Application Server can inspect the Proxy-auth-cert: header using standard Servlet APIs. Alternatively, you can use Application Server 7's auth-passthrough AuthTrans SAF to cause the contents of the Proxy-auth-cert: header to be copied to the javax.servlet.request.X509Certificate Servlet attribute.

  • Apache as Reverse Proxy for UWC and Webmail

    Hi,
    for several reasons i want to use apache 2 as reverse proxy and ssl accelerator for UWC.
    internet <-> apache/ssl <-> backend port 80
    I configured my apache with mod_proxy and mod_proxy_html.
    Here are the concerning config lines:
    LoadModule headers_module modules/mod_headers.so
    LoadModule proxy_module modules/mod_proxy.so
    LoadModule proxy_connect_module modules/mod_proxy_connect.so
    LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
    LoadModule proxy_http_module modules/mod_proxy_http.so
    LoadFile    /usr/lib/libxml2.so
    LoadModule  proxy_html_module    modules/mod_proxy_html.so
    ProxyPass / http://backend.domain.com/
    ProxyPassReverse / http://backend.domain.com/
    <Location />
            ProxyPassReverse /
            SetOutputFilter proxy-html
            ProxyHTMLURLMap / /
            ProxyHTMLURLMap http://backend.domain.com:80/ http://webplex.domain.com/
            ProxyHTMLExtended On
            RequestHeader unset Accept-Encoding
    </Location>For Webmail this configuration works most of the time. There are some minor problems in ie with the folder view. But the real problem is: I can't get UWC to work. The problem seems to be that mod_proxy_html can't replace all of the occurences of backend.domain.com in the html pages.
    Especially:
    onsubmit="handleSubmit()" action="http://webplex.domain.com/amserver/UI/Login?goto=http://backend.domain.com:80/uwc/&gotoOnFail=http://backend.domain.com:80/uwc/?err=1&module=LDAP" method="POST">in the uwc login page.
    So my question is:
    Is anybody out there who got apache working as reverse proxy for uwc?
    Thanks a lot.
    PS1:Solaris 10 on V20z, JES2005Q4
    PS2: I already configured UWC with the reverse plugin for sun webserver on backend host so that uwc is working through port 80 only. So there should be no problems arise from that.

    Hopefully, you'll hear from somebody. I have zero knowledge or experience with Apache.

  • Issues using IIS 8.5 with ARR 3.0 as Reverse Proxy for Lync 2013

    Dear reader, after searching for a day without finding a solution to my problem I end up here ;-)
    Working Lync 2013 environment (gradually adding functionality) consisting of 2 FE servers, Persistent Chat Server, Web Apps server, Edge Server, Reverse Proxy Server (IIS 8.5/ARR 3.0), SQL Server.
    Set up a fresh Windows 2012 R2 with IIS 8.5, installed ARR 3.0 and followed along this
    TechNet article.
    So far so good, external clients (incl. mobile phone apps) can all connect.
    Now trying to add Web Apps to the reverse proxy, which is slightly different from the others by not forwarding 80/8080 and 443/4443, but just 80 and 443 to internal Web Apps server.
    After creating the server farm/URL rewrite, browsing to the webapps.FQDN/hosting/discovery ends up with a 404 error (instead of XML, which is shown when try from the LAN).
    After moving this rewrite rule to the top, it started working, but now my lyncdiscover.FQDN stops working.
    Ofcourse moving the webapps rule down restores the lyncdiscover.
    Any ideas? (everything setup as described in above mentioned TechNet article, so using wildcards. Tried fiddling around with webext.* and lyncdiscover.* and so, but no luck. (I'm completely new to ARR)
    Thanks,
    Barry

    Can you confirm that for each URL Rewrite Rule, you have an {http_host} record that matches something like webext.* as you referenced above and as seen in step 15 here:
    http://blogs.technet.com/b/nexthop/archive/2013/02/19/using-iis-arr-as-a-reverse-proxy-for-lync-server-2013.aspx
    It might help if you posted a screenshot of your URL rewrite rules.
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
    SWC Unified Communications

  • Is it possible IIS reverse Proxy for WAS ( BSP) ?????

    Hi
    I am able to setup IIS reverse proxy for Portal and other some internal website and it works well from outside the firewall. But for WAS (for BSP application), it repeatly prompt login screen even after gave correct user ID and password when call through proxy. But it work inside firewall.
    So really wonder is it possible to use IIS reverse proxy for WAS?
    Thanks
    Raibin

    Hi Raja
    Thanks for your message. But I already read this same and many other BLOGs. Everything talk about manything. And nothing helped me to find the solution. But friday I found the solution myself and happy to share with you and all others.
    The problem was related to the extra string getting added with in url to replace /bsp/   to   /bsp(xxxxxxxxxxxxx)/ and finally when I put the entry as below in my IISProxy.xml file, everything became OK.
    And I saw so many question related to EP 7.0 for outside access. There is one extra entry we have to put for webdynpro to make EP 7.0 working outside specially for admin screens.
    In the below example 'sapep' is Portal and 'sapecc' is ECC 5.0 server.
    <ISAPI-config version="1.6">
         <filter name="IisProxy filter" />
         <extension name="IisProxy extension" />
         <mapping name="PORTAL">
              <source>
                   <protocol>http</protocol>
                   <prefix>/irj</prefix>
                   <new-prefix>/irj/</new-prefix>
              </source>
              <source>
                   <protocol>http</protocol>
                   <prefix>/logon/</prefix>
              </source>
              <source>
                   <protocol>http</protocol>
                   <prefix>/webdynpro/</prefix>
              </source>
              <target>
                   <protocol>http</protocol>
                   <host>sapep.domain.com</host>
                   <port>50000</port>
              </target>
         </mapping>
         <mapping name="BSP">
              <source>
                   <protocol>http</protocol>
                   <prefix>/sap/</prefix>
              </source>
              <source>
                   <protocol>http</protocol>
            <prefix>/sap(bD1lbiZjPTA5NiZkPW1pbg==)/</prefix>
              </source>
              <target>
                   <protocol>http</protocol>
                   <host>sapecc.domain.com</host>
                   <port>1080</port>
              </target>
         <compress-types>text/html, text/plain</compress-types>
         </mapping>
    </ISAPI-config>
    I hope this will many to solve their problems.
    Thanks
    Raibin

  • Reverse Proxy for OIF on iPlanet

    hi,
    I am trying to implement reverse proxy for OIF r3 Identity Provider on iPlanet.
    I configured the obj.conf of iPlanet accordingly.
    <Object name="passthrough1">
    Service fn="service-passthrough" servers="http://backendIDP.com:80"
    Error reason="Bad Gateway" fn="send-error" uri="C:/Sun/WebServer6.1/docs/badgateway.html"
    </Object>
    <Object Default>
    NameTrans fn="assign-name" from="/fed/" name="passthrough1"
    NameTrans fn="assign-name" from="/fed/*" name="passthrough2"
    </Object>
    when i tried the IDP initiated proxy url in a browser like (http://proxy.com/fed/idp/initiatesso?providerid=XXXXXXXX&returnurl=YYYY)
    immediately its being forwaded to backend Identity Provider for authentication like(http://backendIDP.com/sso/jsp/salogin.jsp?doneURL=/user/loginsso&refID=id-ysJ-7-1PR9k-QI2bg9zZkPdyHPw-)
    I was expecting that it is redirected to Proxy URL like (http://proxy.com/sso/jsp/salogin.jsp?doneURL=/user/loginsso&refID=id-ysJ-7-1PR9k-QI2bg9zZkPdyHPw-)
    At the end it is giving me null pointer exception instead of return URL "YYYYY"
    Does any one know how to fix the error.

    web or weblogic.xml files on your RPS needs to define for each case like if inbound port is 7011 then send it to PIA:7011 and http and the same for 7012 then send it to PIA:7012 and https. in the webprofile configuration for your RPS profile, set both https and http relative URLS. I believe you could start using this info and I am sure you could figure out the rest.

  • SSL /Reverse Proxy

    We have a ISA Server in DMZ which we want to use as reverse proxy for portal.
    does anyone have what configuration should i put in for ISA server.
    We installed sapwebdispatcher on portal server to do load balancing for portal dialog instances.portal is intended for ess/mss.
    On HCM server we also have webdispatcher .
    We are planning to terminate ssl at both webdispatcher(on portal and on hcm) .
    portal is portal.mycompany.com
    hcm is hcm.mycompany.com
    What should be the configuration for my system so that it points to sapwebdispatcher .
    ps. webdynpro is installed on hr as a j2ee addon.
    Regards,

    You probably want to use a real reverse proxy/load balancer. Take a look at the CSS.
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.10/configuration/ssl/guide/overview.html#wp999771

  • Error while creating a deployable proxy for a URL in NWDS

    Hi ,
    There is a requirement for calling a webservice in the .NET platform from JAVA using NWDS. The webservice of the server is pinged using the URL of the webservice. when the URL is passed in the WS navigator of CRD ( that is Development Server) ,  the response is retreived successfully .  The version of NWDS is 7.0.23.
    we are facing problem when we are trying to create a Deployable proxy in NWDS by using the following steps :
    1) Create a Development Component
    2) Select the Deployable Proxy
    3) Create the Client Proxy Defintion of the created DC
    At step 3 , when we giving the url or WSDL link  like "http:// www3.authoring.syngenta/newswebservice.asmx?WSDL" (this is just for example) , it is showing as "Invalid wsdl or wsdl not found " . so  that we are not able to procees further.
    When we are trying to create proxy the for the WSDL link like " http:// www.authoring.syngenta/newswebservice.asmx?WSDL" , we are able to create successfully.
    can anyone suggest why we are able to create the proxy for the URL "http:// www.authoring.syngenta/newswebservice.asmx?WSDL" and not for the other URL.
    Any pointers or suggestions are very helpful.
    Thanks and Regards,
    Sreedevi

    Late response I know, but I have solved a similar problem recently and thought I would share.
    Firstly, the problem is not with the namespace. The "Namespace ..." part is just stating the namespace the "Incorrect Value" has. So this error is complaining about the value "Unknown" - which isn't very helpful.
    It appears the SAP SE80 importer does not like elements like the following because it can't understand <s:element ref="s:schema" />. It appears this is a common thing to be included in .NET generated WSDLs.
     <s:element minOccurs="0" maxOccurs="1" name="GetCursDynamicResult">      <s:complexType>          <s:sequence>               <s:element ref="s:schema" />               <s:any />          </s:sequence>     </s:complexType></s:element> 
    SAP will also not like this example as it does not support mixed content (see: http://www.w3schools.com/schema/schema_complex_mixed.asp)
    <s:element minOccurs="0" maxOccurs="1" name="SaldoXMLResult">
         <s:complexType mixed="true">
              <s:sequence>
                   <s:any />
              </s:sequence>
         </s:complexType>
    </s:element>
    You can "Fix" the problem in both cases by removing the offending text in a local copy of the WSDL file so remove line 4 in the first example and change line 2 in the second to <s:complexType> the proxy can then be generated. No idea if the resulting service will be fully operational though!

  • Reverse Proxy for SharePoint 2013

    Hi,
    I need to setup SharePoint 2013 environment which needs to be accessible from mobile devices e.g. iPAD/Android, for reverse proxy, I am looking at apache or IIS ARR since UAG is going to be deprecated. So far any one setup apache (on
    RHEL 6.x)
    or IIS ARR(on W2K8R2) successfully as reverse proxy for SharePoint 2013 access? Is there any issue? and which SharePoint authentication method should be configured?
    Must is be Form based authentication? As I read some articles it seems ARR supports Windows authentication. Thanks in advance.

    IIS ARR doesn't authenticate users, it is a pass-through (unlike UAG which can do auth or anon). Both IIS AAR and the new Web Proxy Role in Server 2012 R2 do not work with SharePoint 2013 Apps.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Why do we use reverse proxy for Oracle RAC Cluster setup

    Hello All,
                 I got this question lately.. "why do we use reverse proxy for Oracle RAC Cluster setup". I know we use the reverse proxy at Middleware level for multiple security reasons.
    Thanks..

    "why do we use reverse proxy for Oracle RAC Cluster setup".
    I wouldn't. I wouldn't use a proxy of any sort for the Cluster Interconnect for sure.
    Cheers,
    Brian

  • What is the alternative to TMG/ISA For SSL-Bridging-Capable Reverse Proxy For System Center 2012 R2 IBCM?

    When I look up alternatives to TMG many other answers say something like "Don't worry about it. TMG 2010 is under support until 2020."
    Well, we don't have TMG and can't buy it since it is off the market.  Can it still be legitimately purchased through any resellers?
    We need a reverse proxy that specifically supports SSL-Bridging so that device certificate authentication is not broken when the connection passes through the proxy.
    Which reverse proxies that are currently on the market are known to work successfully with System Center Config Manager Internet-Based Client Management and also with other Microsoft products such as Lync 2010 and RD Gateway 2012 R2?
    Do any Cisco ASA or ACE models support the required functionality for machine certificate authentication?
    We have ISA 2006 licenses available, but I would hate to roll that out and then have to replace it in only 2 years rather than using something that can stay in place long term.  Maybe we could use ISA 2006 temporarily as a stopgap if the next version
    released of Windows Server Web Application Proxy would meet the requirements and can be deployed in production before ISA 2006 is completely EOL.
    I hate that Microsoft keeps discontinuing all the related products to this before they have their replacements ready.

    Hi,
    You are correct, all TMG product sales officially ended in December 2012.
    In addition, an ISA Server and a TS Gateway server can be used together to enhance security for remote connections to internal network resources. However, it
    seems that ISA 2006 cannot support that on Windows Server 2012 R2. For more detailed information:
    Configuring the TS Gateway ISA Server Scenario
    Personally, Web application proxy would be an alternate. In addition, for the question related to Cisco product, you can contact Cisco for assistance.
    Best regards,
    Susie

  • ACE behind Reverse Proxy - performance issue

    Hi,
      I've got a config working to accommodate the required use of reverse proxy servers infront of my application servers.  Traffic comes into the Front ACE and I insert a header "SRCIP" with the original client IP address which is preserved through the Rev Proxy servers and is then inspected on the Back ACE to create a sticky to a given application server/SRCIP pairing.  The use of the RP's appears to require using the persistence-rebalance option otherwise the traffic get stuck to the wrong app server.  The app functions perfectly with this config; however, there is a severe performance impact.  Using load-runner, we see response times go from 1.5 seconds to 16 seconds for the same transactions comparing this config to a previous config which used static sticky to bind the RP to the app servers..
    Question:  Is there a better way to do this and remain dynamic, or some way to optimize this approach to reduce the performance impact.
    Relevant Config for both ACE's here:
    !!Front ACE
    parameter-map type http HTTP_REBAL
      persistence-rebalance
      length-exceed continue
    sticky ip-netmask 255.255.255.255 address source ALPHA-SRCIP-sticky
      timeout 60
      replicate sticky
      serverfarm ALPHA
    policy-map type loadbalance first-match vip-R1A-ALPHA
      class class-default
        sticky-serverfarm ALPHA-SRCIP-sticky
        insert-http SRCIP header-value "%is"
    policy-map multi-match PREP-VIP
      class VIP-ALPHA-R1A
        loadbalance vip inservice
        loadbalance policy vip-R1A-ALPHA
        appl-parameter http advanced-options HTTP_REBAL
        ssl-proxy server SSL_ALPHA_R1A
    !!Back ACE
    parameter-map type http HTTP_REBAL
      persistence-rebalance
      length-exceed continue
    sticky http-header SRCIP ALPHA-SRCIP-sticky
      timeout 60
      replicate sticky
      serverfarm coresoms-ALPHAfarm
    class-map type http loadbalance match-all SRCIP-MAP
      2 match http header SRCIP header-value ".*"
    policy-map type loadbalance first-match vip-lb-ALPHA
      class SRCIP-MAP
        sticky-serverfarm ALPHA-SRCIP-sticky
    policy-map multi-match lb-vip
      class VIP-ALPHA
        loadbalance vip inservice
        loadbalance policy vip-lb-ALPHA
        appl-parameter http advanced-options HTTP_REBAL

    Hi Joseph,
    To achieve this you need to do stickiness based on some L7 parameter (either the header you are currently using or some cookie), so, whatever you do you will have to use persistence rebalance.
    I have one possible theory for your issue.
    The ACE has two different ways of treating the L7 connections internally, that we call "proxied" and "unproxied". In essence, the proxied mode means that the traffic will be processed by one of the CPU (normally to inspect/modify the L7 data), while, on the unproxied mode, the ACE sets up a hardware shortcut that allows forwarding traffic without the need to do any processing on it.
    For a L7 connection, the ACE will proxy it at the beginning, and, once all the L7 processing has been done it will unproxy the connection to save resources. Before it goes ahead with the unproxying, it needs to see the ACK for the last L7 data sent. This wait, on a Internet environment can introduce around 100-200ms of delay for each HTTP request, which can end up adding into a very big delay. By default, if the ACE sees that the RTT to the client is more than 200ms, the connection will never be unproxied to avoid these delays, so I think we could fix your issue by tweaking this threshold.
    From what you described, I asssume you don't have many connections (because they all come through a proxy) and that the connections will have a lot of HTTP requests inside. With that in mind, I would suggest setting the threshold to 0 to ensure to keep connections always proxied. To do this, you would nee to configure a parameter map like the one below and add it to your VIP
        parameter-map type connection
          set tcp wan-optimization rtt 0
    Even though this setting may avoid your issue, it also has some drawbacks. The main one is that the ACE20 only supports up to 512K simultaneous L7 connections in proxied state (which includes also the connections towards the servers, so, it would be 250K for client connections), so, if the amount of simultaneous connections reaches that limit, new connections would be dropped. The second issue, although not so impacting, would be that the maximum number of connections per second supported would also go down slightly due to the increased processing needed.
    I hope this helps
    Daniel

Maybe you are looking for