Ace stickyness

need help to understand what sticky entries are expected to be seen under show sticky database and for all it options.
we are not sure what cookie values are used by the servers. if i understood right
if servers dont send any cookie , then ACE will use the configured static cookie value and send the cookie to client on behalf of the server. if ace receives the cookie value from server then it forwards the info to the client. in this situation what configuration is required to maintain stickyness
below is my config..
sticky http-cookie sfarm1-sticky sticky-cookie-insert-8005
cookie insert
replicate sticky
serverfarm sfarm1-apache
policy-map type loadbalance first-match sfarm1-apache-8000_pol
class class-default
sticky-serverfarm sticky-cookie-insert-8005
policy-map multi-match VIPS
class sfarm1-apache-8000-cl
loadbalance vip inservice
loadbalance policy sfarm1-apache-8000_pol
loadbalance vip icmp-reply active
Thanks

ACE supports parsing HTTP headers up to 64K bytes.
By default ACE Module can parse 4096 bytes (4K).
By default for ACE appliance can parse 2048 bytes.
You can change it to a higher number, for example to instruct ACE to parse 8192 bytes
parameter-map type http My_HTTP_PARAMS
set header-maxparse-length 8192
policy-map multi-match My-VIPS
class Syed
loadbalance vip inservice
loadbalance policy syed-policy
loadbalance vip icmp-reply active
appl-parameter http advanced-options My_HTTP_PARAMS
Increasing it to a very high number will have performance impacts.
More details at
ACE Module:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/slb/guide/classlb.html#wp1350453')">http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/slb/guide/classlb.html#wp1350453
ACE Appliance:
http://preview.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1062867')">http://preview.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1062867
Syed Iftekhar Ahmed

Similar Messages

  • ACE Stickyness via SSL

    Hello,
    i've wanted to configure Stickyness via SSL Session ID.
    I coul'd not find anything in the docs how to do this.
    Is this feature not supported by the ACE?
    Sven

    I read somewhere it will be supported with the next major release or Gilles mentioned something like that.
    AFAIK it is not supported right now.
    Ergo -> geht nicht :)
    Roble

  • ACE Stickyness problem

    I am trying to configure stickyness on an ACE appliance. I can't seem to get it to work. I have tried a http cookie and a IP Netmask and can't get it to work. When I do a show stat sticky or a show sticky database I get nothing. Attached is the config of my ace.

    you need to assign sticky resources to your context before you can start using it.
    Use the following command to see if you have allocated sticky resources
    switch/Admin# show np 1 me-stats "-slb -v" | i Stick
    Num Active Sticky Entry: 1 0
    Num Active Reverse Sticky Entry: 0 0
    Free Sticky Entry Count: 944765 0
    switch/Admin#
    Gilles.

  • ACE : Stickyness problem with http cookies

    Hi,
    I am facing a serious problem with stickyness in a e-commerce configuration.
    Here is the setup :
    An ACE load balance user requests on two Apache servers
    cookie-insert is used to stick a user on one Apache server
    The home page is accessed via http on port 80
    On the Home page, there is a link to allowing the user to login
    The login process uses SSL
    During the login, backend SSL is required between the ACE and the selected Apache server
    The login is a POST request to the Apache server
    After a successful login, the home page is reloaded on port 80 and the name of the user should appear on the top of the page
    The ACE configuration :
    Two sticky groups are configured : one for HTTP acess and another for HTTPS access
    Two server farms are defined, both using the same real servers, but with different ports (80 and 441)
         sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTP
           cookie insert browser-expire
           timeout 240
           replicate sticky
           serverfarm ECOM_FARM_TEST_HTTP
              sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTPS
           cookie insert browser-expire
           timeout 240
           replicate sticky
           serverfarm ECOM_FARM_TEST_HTTPS
         serverfarm host ECOM_FARM_TEST_HTTP
           description *** e-Commerce Test Server Farm ***
           probe ECOM_PROBE_TEST
           rserver HQCHECOM01 80
            inservice
           rserver HQCHECOM02 80
            inservice
             serverfarm host ECOM_FARM_TEST_HTTPS
          description *** e-Commerce Test Server Farm ***
          probe ECOM_PROBE_TEST
          rserver HQCHECOM01 443
           inservice
          rserver HQCHECOM02 443
           inservice
    The problem :
    Let analyse the sequence of events and the value of the http cookie for each of them :
    When the the home page is originally loaded, the ACE selects SERVER-1
    The ACE inserts the cookie "A" in the server responses
    The user is sticked to SERVER-1
    Then, the user tries to login and an SSL session is established with the ACE
    The user sends a POST request containing the cookie "A"
    A backend SSL session is established with SERVER-1
    The POST request is forwarded to SERVER-1
    SERVER-1 responds with a 200 OK and the ACE generates another cookie "B" as it belongs to the sticky group ECOM_STICKY_TEST_HTTPS
    The client browser reloads the page on port 80 and provides the cookie "B" (the last received) !!
    The ACE sees the cookie "B" but does not find it in its database for the sticky group ECOM_STICKY_TEST_HTTP
    The ACE perform another load balancing decision and selects SERVER-2 ! (instead of SERVER-1)
    The page is reloaded, but the name of the user does not appear on it
    The question :
    As it is not possible to have only one sticky group in this configuration what would be the solution to make sure that the same server is selected for http and https ?
    Thank you for any hints,
    Yves

    Hi Gilles,
    I followed your recommendation to configure static cookie entries in each sticky group, but I still experience the problem of sessions getting re-load balanced to the second server when returning from HTTPS to HTTP :
    It seems that the ACE ignores the static entries !
    To make my question clear, I repeat hereafter the setup and the encountered problem :
    Here is the setup :
    An ACE load balance user requests on two Apache servers
    cookie-insert is used to stick a user on one Apache server
    The home page is accessed via http on port 80
    On the Home page, there is a link to allowing the user to login
    The login process uses SSL
    During the login, backend SSL is required between the ACE and the selected Apache server
    The login is a POST request to the Apache server
    After a successful login, the home page is reloaded on port 80 and the name of the user should appear on the top of the page
    The ACE configuration :
    Two sticky groups are configured : one for HTTP acess and another for HTTPS access
    Two server farms are defined, both using the same real servers, but with different ports (80 and 443)
    In the ECOM_STICKY_TEST_HTTP stick group the two following cookies are automatically generated :
    R105816849   for the server HQCHECOM01
    R105852786   for the server HQCHECOM02
    In the ECOM_STICKY_TEST_HTTPS stick group the two following cookies are automatically generated :
    R355972695   for the server HQCHECOM01
    R357158616   for the server HQCHECOM02
    I statically configured in the each sticky group the cookies used by the other sticky group, to allow stickiness when the browser switches from HTTP to HTTPS and vice versa :
    sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTP
      cookie insert browser-expire
      timeout 240
      replicate sticky
      serverfarm ECOM_FARM_TEST_HTTP backup WEB_REDIRECT_001
      56 static cookie-value "R355972695" rserver HQCHECOM01
      64 static cookie-value "R357158616" rserver HQCHECOM02
    sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTPS
      cookie insert browser-expire
      timeout 240
      replicate sticky
      serverfarm ECOM_FARM_TEST_HTTPS backup WEB_REDIRECT_001
      72 static cookie-value "R105816849" rserver HQCHECOM01
      80 static cookie-value "R105852786" rserver HQCHECOM02
    serverfarm host ECOM_FARM_TEST_HTTP
      description *** e-Commerce Test Server Farm ***
      probe ECOM_PROBE_TEST
      rserver HQCHECOM01 80
       inservice
      rserver HQCHECOM02 80
       inservice
    serverfarm host ECOM_FARM_TEST_HTTPS
      description *** e-Commerce Test Server Farm ***
      probe ECOM_PROBE_TEST
      rserver HQCHECOM01 443
       inservice
      rserver HQCHECOM02 443
       inservice
    The problem :
    Let analyse the sequence of events and the value of the http cookie for each of them :
    When the the home page is originally loaded, the ACE selects SERVER-1
    The ACE inserts the cookie "A" in the server responses
    The user is sticked to SERVER-1
    Then, the user tries to login and an SSL session is established with the ACE
    The user sends a POST request containing the cookie "A"
    A backend SSL session is established with SERVER-1
    The POST request is forwarded to SERVER-1
    SERVER-1 responds with a 200 OK and the ACE generates another cookie "B" as it belongs to the sticky group ECOM_STICKY_TEST_HTTPS
    The client browser reloads the page on port 80 and provides the cookie "B" (the last received)
    The ACE sees the cookie "B" and should use the static cookie entry to select the SERVER-1
    But instead, the ACE perform another load balancing decision and selects SERVER-2 !
    The page is reloaded, but the name of the user does not appear on it
    LiveHTTP Trace on Firefox :
    GET /ecom/medias/sys_master/8800775602206/Home-page-main-banners-video.jpg HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: image/png,image/*;q=0.8,*/*;q=0.5
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105816849;
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105816849; path=/
    Date: Mon, 18 Oct 2010 15:31:37 GMT
    Server: Apache/2.2.13 (Red Hat)
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: image/jpeg
    Here we switch on HTTPS :
    https://ecom.test.toto.com/uk/en/j_spring_security_check
    POST /uk/en/j_spring_security_check HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105816849; JSESSIONID=089DCF987DC03CAE0F516298EB886DAB.node1;
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 75
    spring-security-redirect=&j_username=yves144%40yahoo.com&j_password=junon01
    Here we see cookie for the same server but for the HTTPS sticky group :
    HTTP/1.1 302 Moved Temporarily
    Set-Cookie: STICKED-TO=R355972695; path=/
    Set-Cookie: _hybris.tenantID_=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; HttpOnly
    Date: Mon, 18 Oct 2010 15:31:39 GMT
    Server: Apache/2.2.13 (Red Hat)
    Location: http://ecom.test.toto.com/uk/en/home
    Content-Length: 0
    Connection: close
    Content-Type: text/plain; charset=UTF-8
    Here we switch back to HTTP :
    http://ecom.test.toto.com/uk/en/home
    GET /uk/en/home HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R355972695; JSESSIONID=089DCF987DC03CAE0F516298EB886DAB.node1;
    Here we see that the second server has been wrongly selected !
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105852786; path=/
    Set-Cookie: _hybris.tenantID_=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; HttpOnly
    Set-Cookie: JSESSIONID=5A0F6EB8FBF63D5D0590FECEC62A302E.node2; Path=/; HttpOnly
    Date: Mon, 18 Oct 2010 15:31:40 GMT
    Server: Apache/2.2.13 (Red Hat)
    Pragma: no-cache
    Expires: Thu, 01 Jan 1970 00:00:00 GMT
    Cache-Control: no-cache, no-store
    Content-Language: en-GB
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html;charset=UTF-8
    http://ecom.test.toto.com/ecom/medias/sys_master/8796174057502/uk.gif
    GET /ecom/medias/sys_master/8796174057502/uk.gif HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: image/png,image/*;q=0.8,*/*;q=0.5
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105852786; JSESSIONID=5A0F6EB8FBF63D5D0590FECEC62A302E.node2;
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105852786; path=/
    Date: Mon, 18 Oct 2010 15:31:40 GMT
    Server: Apache/2.2.13 (Red Hat)
    Content-Length: 382
    Connection: close
    Content-Type: image/gif
    Hypothesis :
    It seems that the static entries are not considered by the ACE...

  • ACE : Stickyness with static cookies problem

    Hi Gilles
    I restart a conversatoion as a question to clarify the situation :
    I followed your recommendation to configure static cookie entries in each sticky group, but I still experience the problem of sessions getting re-load balanced to the second server when returning from HTTPS to HTTP :
    It seems that the ACE ignores the static entries !
    To make my question clear, I repeat hereafter the setup and the encountered problem :
    Here is the setup :
    An ACE load balance user requests on two Apache servers
    cookie-insert is used to stick a user on one Apache server
    The home page is accessed via http on port 80
    On the Home page, there is a link to allowing the user to login
    The login process uses SSL
    During the login, backend SSL is required between the ACE and the selected Apache server
    The login is a POST request to the Apache server
    After a successful login, the home page is reloaded on port 80 and the name of the user should appear on the top of the page
    The ACE configuration :
    Two sticky groups are configured : one for HTTP acess and another for HTTPS access
    Two server farms are defined, both using the same real servers, but with different ports (80 and 443)
    In the ECOM_STICKY_TEST_HTTP stick group the two following cookies are automatically generated :
    R105816849   for the server HQCHECOM01
    R105852786   for the server HQCHECOM02
    In the ECOM_STICKY_TEST_HTTPS stick group the two following cookies are automatically generated :
    R355972695   for the server HQCHECOM01
    R357158616   for the server HQCHECOM02
    I statically configured in the each sticky group the cookies used by the other sticky group, to allow stickiness when the browser switches from HTTP to HTTPS and vice versa :
    sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTP
      cookie insert browser-expire
      timeout 240
      replicate sticky
      serverfarm ECOM_FARM_TEST_HTTP backup WEB_REDIRECT_001
      56 static cookie-value "R355972695" rserver HQCHECOM01
      64 static cookie-value "R357158616" rserver HQCHECOM02
    sticky http-cookie STICKED-TO ECOM_STICKY_TEST_HTTPS
      cookie insert browser-expire
      timeout 240
      replicate sticky
      serverfarm ECOM_FARM_TEST_HTTPS backup WEB_REDIRECT_001
      72 static cookie-value "R105816849" rserver HQCHECOM01
      80 static cookie-value "R105852786" rserver HQCHECOM02
    serverfarm host ECOM_FARM_TEST_HTTP
      description *** e-Commerce Test Server Farm ***
      probe ECOM_PROBE_TEST
      rserver HQCHECOM01 80
       inservice
      rserver HQCHECOM02 80
       inservice
    serverfarm host ECOM_FARM_TEST_HTTPS
      description *** e-Commerce Test Server Farm ***
      probe ECOM_PROBE_TEST
      rserver HQCHECOM01 443
       inservice
      rserver HQCHECOM02 443
       inservice
    The problem :
    Let analyse the sequence of events and the value of the http cookie for each of them :
    When the the home page is originally loaded, the ACE selects SERVER-1
    The ACE inserts the cookie "A" in the server responses
    The user is sticked to SERVER-1
    Then, the user tries to login and an SSL session is established with the ACE
    The user sends a POST request containing the cookie "A"
    A backend SSL session is established with SERVER-1
    The POST request is forwarded to SERVER-1
    SERVER-1 responds with a 200 OK and the ACE generates another cookie "B" as it belongs to the sticky group ECOM_STICKY_TEST_HTTPS
    The client browser reloads the page on port 80 and provides the cookie "B" (the last received)
    The ACE sees the cookie "B" and should use the static cookie entry to select the SERVER-1
    But instead, the ACE perform another load balancing decision and selects SERVER-2 !
    The page is reloaded, but the name of the user does not appear on it
    LiveHTTP Trace on Firefox :
    GET /ecom/medias/sys_master/8800775602206/Home-page-main-banners-video.jpg HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: image/png,image/*;q=0.8,*/*;q=0.5
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105816849;
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105816849; path=/
    Date: Mon, 18 Oct 2010 15:31:37 GMT
    Server: Apache/2.2.13 (Red Hat)
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: image/jpeg
    Here we switch on HTTPS :
    https://ecom.test.toto.com/uk/en/j_spring_security_check
    POST /uk/en/j_spring_security_check HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105816849; JSESSIONID=089DCF987DC03CAE0F516298EB886DAB.node1;
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 75
    spring-security-redirect=&j_username=yves144%40yahoo.com&j_password=junon01
    Here we see cookie for the same server but for the HTTPS sticky group :
    HTTP/1.1 302 Moved Temporarily
    Set-Cookie: STICKED-TO=R355972695; path=/
    Set-Cookie: _hybris.tenantID_=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; HttpOnly
    Date: Mon, 18 Oct 2010 15:31:39 GMT
    Server: Apache/2.2.13 (Red Hat)
    Location: http://ecom.test.toto.com/uk/en/home
    Content-Length: 0
    Connection: close
    Content-Type: text/plain; charset=UTF-8
    Here we switch back to HTTP :
    http://ecom.test.toto.com/uk/en/home
    GET /uk/en/home HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R355972695; JSESSIONID=089DCF987DC03CAE0F516298EB886DAB.node1;
    Here we see that the second server has been wrongly selected !
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105852786; path=/
    Set-Cookie: _hybris.tenantID_=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; HttpOnly
    Set-Cookie: JSESSIONID=5A0F6EB8FBF63D5D0590FECEC62A302E.node2; Path=/; HttpOnly
    Date: Mon, 18 Oct 2010 15:31:40 GMT
    Server: Apache/2.2.13 (Red Hat)
    Pragma: no-cache
    Expires: Thu, 01 Jan 1970 00:00:00 GMT
    Cache-Control: no-cache, no-store
    Content-Language: en-GB
    Connection: close
    Transfer-Encoding: chunked
    Content-Type: text/html;charset=UTF-8
    http://ecom.test.toto.com/ecom/medias/sys_master/8796174057502/uk.gif
    GET /ecom/medias/sys_master/8796174057502/uk.gif HTTP/1.1
    Host: ecom.test.toto.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 (CK-IBM) Firefox/3.5.8
    Accept: image/png,image/*;q=0.8,*/*;q=0.5
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 300
    Connection: keep-alive
    Referer: http://ecom.test.toto.com/uk/en/home
    Cookie: STICKED-TO=R105852786; JSESSIONID=5A0F6EB8FBF63D5D0590FECEC62A302E.node2;
    HTTP/1.1 200 OK
    Set-Cookie: STICKED-TO=R105852786; path=/
    Date: Mon, 18 Oct 2010 15:31:40 GMT
    Server: Apache/2.2.13 (Red Hat)
    Content-Length: 382
    Connection: close
    Content-Type: image/gif
    Hypothesis :
    It seems that the static entries are not considered by the ACE...

    Yves,
    you have to specify the destination port
    56 static cookie-value "R355972695" rserver HQCHECOM01 80
    64 static cookie-value "R357158616" rserver HQCHECOM02 80
    serverfarm host  ECOM_FARM_TEST_HTTP
      description *** e-Commerce Test Server Farm ***
       probe ECOM_PROBE_TEST
      rserver HQCHECOM01 80
       inservice
       rserver HQCHECOM02 80
       inservice
    Gilles.

  • ACE: Stickyness, Cookie in URL

    Hello,
    I have a problem with cookies in the URL if the browser does not support Cookies in the http header.
    I'm setting the cookie in the url static , so the URL looks like:
    http://testfarm/sticky.cgi?serverid=1.1.1.1
    And configure the sticky group:
    sticky http-cookie serverid sticky-farm cookie secondary serverid
    replicate sticky
    serverfarm sticky-farmm 8 static cookie-value "1.1.1.1" rserver server1
    16 static cookie-value "1.1.1.2" rserver server2
    What's wrong with my configuration?
    If the client accepts cookies in the Cookie header anything works but not if the client rejects the cookie.

    Hi Gilles,
    no, i did not specify a port in the serverfarm or in the realserver.
    The configuration looks like this:
    sticky http-cookie serverid ST-sticky-farm
    cookie secondary serverid
    replicate sticky
    serverfarm sticky-farm
    8 static cookie-value "1.1.1.1" rserver server1
    16 static cookie-value "1.1.1.2" rserver server2
    policy-map type loadbalance first-match L7-10-1-1-1
    class class-default
    sticky-serverfarm sticky-farm
    policy-map multi-match L4_SLB_POL_external
    description L4 Policy fuer SLB ohne NAT
    class V-10-1-1-1
    loadbalance vip inservice
    loadbalance policy L7-10-1-1-1
    loadbalance vip icmp-reply active
    appl-parameter http advanced-options HTTP-rebalance
    class-map match-any V-10-1-1-1
    2 match virtual-address 10.1.1.1 tcp eq www
    serverfarm host sticky-farm
    probe tcp80-i30
    rserver server1
    inservice
    rserver server2
    inservice
    rserver host server1
    ip address 1.1.1.1
    inservice
    rserver host server2
    ip address 1.1.1.2
    inservice
    Sven

  • ACE cookie-insert stickyness

    Hi, I am trying to understand the ACE`s cookie-insert method of stickiness. So the ACE will always insert a cookie into the http-header when sending a response to the client/browser. Based on that if it recieves the same cookie-id in the subsequent requests it knows to which end-server to send it as it does an internal hash based on the cookie-value.
    My question is, what happens if the server also sends a cookie? Does ACE dis-regards that cookie and inserts a new one on it`s own? How do the cookie-insertion from the server (which is done by default by the web-servers) co-exist with the cookie insertion by the ACE?
    thnx

    Hi,
    As long as they don't both use the Same Cookie name they won't influence each other.
    If you don't assign a cookie-name ACE will create a unique one per rserver.
    Or you can configure one e.g.
    rserver WebServer1 80
        cookie-string "ACEWS1Cookie"
    More details can be found here:
    http://www.cisco.com/en/US/customer/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_1_0/configuration/slb/guide/sticky.html

  • ACE load-balancing-Cookie problem

    In our other load-balancing environments the load-balancer-cookie contains the encrypted (real) servername or ip-address.
    We think it's the same on the cisco, for that reason it's in theory not possible, that there are two 'green'-cookies with different values in the same request.
    There are only two possibilities how this could happen:
    a) The healthmonitor (http_probe) fails, the loadbalancer 'thinks' that the realserver is down and redistributes the traffic.
    But in that case we would expect, that the old cookie will be overwritten by the new one and not simply added to the http-header.
    b) The predictor in the serverfarm chooses a new realserver within the same request.
    If that is really the cause of that problem this would be bug in the cisco ace.
    What we found out, is that the loadbalancer performs a 'Set-Cookie'-Operation an every request even if the client submits the cookie correctly.
    For example:
    GET /ips-opdata/scripts/jquery.js HTTP/1.1
    Host: www.xxxxx.com
    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15
    Accept: */*
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip,deflate
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    Keep-Alive: 115
    Connection: keep-alive
    Referer: http://www.xxxxx.com/
    Cookie: green=R339366665; JSESSIONID=28D91FC6FD62A3921354BB36826294C4
    HTTP/1.1 200 OK
    Set-Cookie: green=R339366665; path=/; expires=Tue, 29-Mar-2011 06:33:00 GMT
    Server: Apache-Coyote/1.1
    X-Powered-By: Servlet 2.4; JBoss-4.2.2.GA (build: SVNTag=JBoss_4_2_2_GA date=200710221139)/Tomcat-5.5
    ETag: W/"72181-1298537508000"
    Last-Modified: Thu, 24 Feb 2011 08:51:48 GMT
    Content-Type: text/javascript
    Content-Length: 72181
    Date: Mon, 28 Mar 2011 06:15:19 GMT
    As you can see the cookies: green=R339366665 is transmitted from the client, but the loadbalancer does a Set-Cookie Operation of the same cookie once again. This is an unexpected behaviour.
    We hope that this helps you to figure out the reason of the problem.

    The cookie is sent by the ACE on each response to refresh the timeout value on the client. The value of the cookie doesn't change. This is the expected behaviour and shouldn't break anything in the application / browser.
    For browser-based applications, don't forget to add the "browser-expire" parameter to your cookie-based stickyness config.

  • ACE SSL Sticky class-map generic vs class default differences.

    There was a thread recently titled "ACE 3.0(0) SW / LB with SSL Session-ID" where Giles Dufour outlined a configuration for an ACE performing sticky based on SSL Session ID.
    Can anyone explain the benefits and differences of using a specific class-map generic such as this:
    class-map type generic match-any SSL-v3-32
      2 match layer4-payload regex "\x16\x03\x00..\x01.*"
      3 match layer4-payload regex "\x16\x03\x01..\x01.*"
    Versus just matching class default?
    So if I have a configuration such as this:
    policy-map type loadbalance generic first-match SSL-v3-Sticky
    class SSL-v3-32
       sticky-serverfarm ssl-v3
    vs
    policy-map type loadbalance generic first-match SSL-v3-Sticky
    class class-default
       sticky-serverfarm ssl-v3
    What's the benefit or drawback?

    The SSL session id is only available in version 3.0.1 and 3.1.1
    So you can match this particular version and then attempt to do stickyness.
    You are guaranteed to find what you're looking for.
    If you match a class-default it means you apply stickyness to any version of ssl packet.
    So there is a risk to misinterpret the content of the packet and stick on something else than the session id.
    Gilles.

  • Ace - connection reset (Error 101)

    Hi, I have a problem with a Cisco ACE, after approximately an hour being in production, for all new connections
    it gives the message: connection reset. The message on any web browser is: connection reset (Error 101)
    It blocks any backend server (Apache).I get same error also when I try to connect direcly to the backend address.
    This error saturates the connections on the servers (in the log of the DB I found error connection reset)
    Without ACE all work fine, it's not a load traffic issue.
    It seems like once opened a connection the ace does not close it anymore!
    But the graphical snmp servers do not report the increase in connections, what is mistake ?
    The balancer manages two physical servers and is configured in stickyness mode
    Please find attached the configuration
    logging enable
    logging timestamp
    logging trap 4
    logging buffered 3
    logging host 172.16.0.2 udp/514 format emblem
    access-list ANY line 8 extended permit icmp any any
    access-list ANY line 16 extended permit ip any any
    probe http HTTP_PROBE1
      request method get url /index.php
      expect status 200 206
      expect status 300 307
      expect status 400 417
    probe tcp PROBE_TCP
      interval 30
    rserver host 03a.it
      ip address 172.16.0.1
      conn-limit max 50000 min 40000
      inservice
    rserver host 03b.it
      ip address 172.16.0.2
      conn-limit max 50000 min 40000
      inservice
    serverfarm host FARM_WEB
      predictor leastconns
    probe HTTP_PROBE1
      rserver 03a.it
        inservice
      rserver 03b.it
        inservice
    parameter-map type http HTTP_PARAMETER_MAP
      persistence-rebalance
    sticky http-cookie session StickyGroup1
      timeout 3600
      serverfarm FARM_WEB
    class-map type management match-all ICMP-ALLOW_CLASS
      2 match protocol icmp source-address x.x.x.x
    class-map match-all L4-WEB-IP
      2 match virtual-address x.x.x.x tcp eq www
    class-map type management match-all REMOTE_ACCESS
      2 match protocol ssh any
    policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
      class REMOTE_ACCESS
        permit
    policy-map type loadbalance http first-match WEB_L7_POLICY
      class class-default
        sticky-serverfarm StickyGroup1
        insert-http x-forward header-value "%is"
    policy-map multi-match WEB-to-vIPs
      class L4-WEB-IP
        loadbalance vip inservice
        loadbalance policy WEB_L7_POLICY
        loadbalance vip icmp-reply active
        nat dynamic 1 vlan 2541
        appl-parameter http advanced-options HTTP_PARAMETER_MAP
    interface vlan 125
      ip address
      access-group input ANY
      service-policy input REMOTE_MGMT_ALLOW_POLICY
      service-policy input WEB-to-vIPs
      no shutdown
    interface vlan 254
      ip address
      access-group input ANY
      nat-pool
      service-policy input REMOTE_MGMT_ALLOW_POLICY
      no shutdown
    At the moment this happens, the simultaneous connections (command: show conn) on the server are around 350
    the CPU load is 2%
    sticky database has approximately 24000 records.
    Log level is set to 4. But no error report.
    Do you need more info to resolve the problem?
    Thank you
    Best Regards
    N.

    Hello Nicolas,
    I wonder if you can include these values:
    parameter-map type http HTTP_PARAMETER_MAP
      case-insensitive
      persistence-rebalance
      set header-maxparse-length 65535
      set content-maxparse-length 65535
      length-exceed continue
      parsing non-strict
    I also noticed a lot of errors which might be caused also due to these denied under the #show resource usage all which may indicate you are reaching the license limits, but you should discuss it with your Cisco SE, please see below:
                                                   Allocation
            Resource         Current       Peak        Min        Max       Denied
    Context: vrack254
      conc-connections              4       1267      60000      60000          0
      mgmt-connections              2         28        748        748          0
      proxy-connections             0       1255       7864       7864          0
      xlates                        0          0       7864       7864          0
      bandwidth                   572    3824781    3740624  127490624    1416859
        throughput                 96    3712886    3740624    3740624    1416859
        mgmt-traffic rate         476     111895          0  123750000          0
      connection rate               1       1729       4500       4500          0
      ssl-connections rate          0          0        224        224          0
      mac-miss rate                 0         15         16         16          4
      inspect-conn rate             0          0       1800       1800          0
      http-comp rate                0          0    5898240    5898240          0
      to-cp-ipcp rate               0         11         36         36          0
      acl-memory                 8216      10568     744800     744800          0
      sticky                    22978      22978      31456      31456          0
      regexp                       19         23       7864       7864          0
      syslog buffer             30720      30720      30720      30720          0
      syslog rate                   0          6        750        750          0
    Can you upload the specific error which you are getting also?
    Jorge

  • ACE 4710 - Internet Explorer cannot display the webpage randomly

    We have a ACE 4710 with a basic config, (see below).
    When clicking on a tab from a window within Interent explorer we occasionally get an issue with it returning: "Internet Explorer cannot display the webpage" The details show "Access is denied" accessing a particular line of a javascript file.
    We have put one web server out of service in the farm to make sure that this isn't a result of stickyness not quite working.
    We have tested extensively by going directly to the web server directly without the load balancer and cannot reproduce the problem but we can produce the issue within a few minutes when going to the load balanced address.
    Thanks in advance for any advice.
    HOST-1/Admin# show run
    Generating configuration....
    logging enable
    logging fastpath
    logging standby
    logging timestamp
    logging trap 6
    logging history 6
    resource-class SLB_ResourceClass_T_R
      limit-resource all minimum 10.00 maximum unlimited
    resource-class sticky
      limit-resource all minimum 10.00 maximum unlimited
    boot system image:c4710ace-t1k9-mz.A5_1_2.bin
    peer hostname HOST-2
    hostname HOST-1
    interface gigabitEthernet 1/1
      switchport access vlan 1000
      no shutdown
    interface gigabitEthernet 1/2
      shutdown
    interface gigabitEthernet 1/3
      description LB003
      switchport access vlan 1
      shutdown
    interface gigabitEthernet 1/4
      description LB004
      switchport access vlan 2
      shutdown
    interface port-channel 1
      port-channel load-balance src-dst-port
      no shutdown
    clock timezone standard GMT
    switch-mode
    context Admin
      description SUTLB01
      member SLB_ResourceClass_T_R
    access-list ALL line 8 extended permit ip any any
    access-list ALL line 16 extended permit icmp any any
    access-list everyone line 8 extended permit ip any any
    access-list everyone line 16 extended permit icmp any any
    probe tcp probe_tcp_80
      port 80
    rserver host Server_S_W301
      description Server_S_W301
      ip address x.x.32.152
      inservice
    rserver host Server_S_W302
      description Server_S_W302
      ip address x.x.32.154
      inservice
    serverfarm host sfarm_T_R
      description sfarm_T_R
      predictor leastconns
      probe probe_tcp_80
      rserver Server_S_W301 80
      rserver Server_S_W302 80
        inservice
    sticky http-cookie Cookie1 T_R_sticky_cookie
      cookie insert browser-expire
      timeout 3600
      serverfarm sfarm_T_R
    class-map match-any T_R_L4Class
      2 match virtual-address x.x.33.150 tcp eq www
    class-map type management match-any remote_access
      2 match protocol xml-https any
      3 match protocol icmp any
      4 match protocol telnet any
      5 match protocol ssh any
      6 match protocol http any
      7 match protocol https any
      8 match protocol snmp any
    policy-map type management first-match remote_mgmt_allow_policy
      class remote_access
        permit
    policy-map type loadbalance first-match T_R_L7policy
      class class-default
        sticky-serverfarm T_R_sticky_cookie
    policy-map multi-match T_R_L4Policy
      class T_R_L4Class
        loadbalance vip inservice
        loadbalance policy T_R_L7policy
        loadbalance vip icmp-reply active
        nat dynamic 2 vlan 1000
    interface vlan 1000
      ip address x.x.33.148 255.255.254.0
      access-group input ALL
      nat-pool 2 x.x.33.151 x.x.33.151 netmask 255.255.254.0 pat
      service-policy input remote_mgmt_allow_policy
      service-policy input T_R_L4Policy
      no shutdown
    ip route 0.0.0.0 0.0.0.0 x.x.32.1
    ssh key rsa 1024 force

    +------------------------------------------+
    +-------------- HTTP statistics -----------+
    +------------------------------------------+
    LB parse result msgs sent : 421347     , TCP data msgs sent       : 2099597
    Inspect parse result msgs : 0          , SSL data msgs sent       : 0
                          sent
    TCP fin msgs sent         : 6169       , TCP rst msgs sent:       : 769
    Bounced fin msgs sent     : 5          , Bounced rst msgs sent:   : 1
    SSL fin msgs sent         : 0          , SSL rst msgs sent:       : 0
    Drain msgs sent           : 337811     , Particles read           : 5040829
    Reuse msgs sent           : 0          , HTTP requests            : 342499
    Reproxied requests        : 183422     , Headers removed          : 37475
    Headers inserted          : 342124     , HTTP redirects           : 0
    HTTP chunks               : 224859     , Pipelined requests       : 71466
    HTTP unproxy conns        : 267246     , Pipeline flushes         : 0
    Whitespace appends        : 0          , Second pass parsing      : 0
    Response entries recycled : 71302      , Analysis errors          : 0
    Header insert errors      : 22         , Max parselen errors      : 215
    Static parse errors       : 99         , Resource errors          : 0
    Invalid path errors       : 0          , Bad HTTP version errors  : 0
    Headers rewritten         : 0          , Header rewrite errors    : 0
    SSL headers inserted      : 0          , SSL header insert errors : 0
    SSL spoof headers deleted : 0         , Unproxy msgs sent         : 267246
    HTTP passthrough stat     : 0
    NOTE - We did turn on caching at one point to try and resolve the issue but it has since been turned off

  • ACE 4710 - can I dynamically sticky all traffic to 1 server based on URL?

    Hello all, I'm new to the ACE 4710 and need to know some details about stickyness.
    As background, we are a small company with a SaaS product and a pair of webservers.
    I have set up the loadbalancing default L7 Load-balancing rule to sticky based on a Cookie based Stickey Group.
    That seems to be working and session traffic is sticking to a server during the user's session.
    Based on a request from our outsourced developer they would like the Loadbalancer to not only sticky the users sessions, but also sticky a url to a server.
    I would like this to happen dynamically as each of our clients will have their own url based on our standard domain like clientname.fixeddomain.com and I don't want to have to come back to the loadbalancer every time we add a client.
    As I said, I'm new to these devices but understand the concepts, and am in the position of having to make it work little to no tranining on this hardware and no budget at this point to pay someone else for configuration and setup.
    I just need to know at this point if I can stick all requests for a specific URL to a server to avoid caching issue while those sessions are active and have new connections to other client urls balanced among the webservers.
    Hopefully this request makes sense.
    Thanks,
    Mark Steeves.

    Daniel,
    Thanks for the reply, but I cannot reach the URL you included.  It gives me a 403.
    Therfore without reading the article, I wanted to ask if the proper setup would be:
    1. Default L7 load-balancing action: Primary action: Sticky: Stickey Group using
    Type = HTTP Header: Header name = Host
    2. Server Farm: Predictor: Least Connections or Round Robin to distribute the load between the 2 web servers.
    Using this setting in testing, it looks like all the traffic keeps going to 1 server only.  Granted there is not much traffic t the servers, but I have 2 different url being tested. url1.ourdomain.com & url2.ourdomain.com
    If you have another link for the above document, please let me know.
    Thanks,
    Mark Steeves.

  • ACE 4710 VIP not pingable even with "always" selected.

    Hello, I have a somewhat complicated setup in order to allow one particular VIP to answer for the same serverfarm on two different ports (this was a previous question here.) Here is the scrubbed config below. The setup works, but the issue is that the VIP does not reply to pings. We use both the servers and the vip for monitoring internally. It is still operational on the ports it is balancing, but no setting for ping seems to work (Active, Primary, or Always.) What am I doing wrong here? The other sites I use stickys with respond for their VIPs. I'm assuming this one does not due to the more complicated policy map.
    probe http HTML-Site-Up_200
      description This probe is to verify HTTP operation via site-up.html check
      port 80
      interval 5
      faildetect 2
      passdetect interval 10
      request method get url /site-up.html
      expect status 200 200
      open 2
    probe icmp ICMP-Ping
      interval 5
      faildetect 2
      passdetect interval 10
    probe tcp RAW-TCP-81
      port 81
      interval 10
      faildetect 2
      passdetect interval 20
      connection term forced
      open 1
    rserver host psc-us-EQUIPprd1
      description EQUIP Prod, server 1
      ip address 10.1.1.84
      inservice
    rserver host psc-us-EQUIPprd2
      description EQUIP Prod, server 2
      ip address 10.1.1.85
      inservice
    serverfarm host EQUIPPROD
      description EQUIP Prod Server Pool
      predictor leastconns
      probe HTML-Site-Up_200
      probe ICMP-Ping
      probe RAW-TCP-81
      rserver psc-us-EQUIPprd1
        probe ICMP-Ping
        probe HTML-Site-Up_200
        probe RAW-TCP-81
        inservice
      rserver psc-us-EQUIPprd2
        probe ICMP-Ping
        probe HTML-Site-Up_200
        probe RAW-TCP-81
        inservice
    serverfarm host EQUIPPROD-CUSTOMER-81
      description EQUIP Customer Site Server Pool, port 81
      predictor leastconns
      probe RAW-TCP-81
      rserver psc-us-EQUIPprd1 81
        probe RAW-TCP-81
        inservice
      rserver psc-us-EQUIPprd2 81
        probe RAW-TCP-81
        inservice
    sticky ip-netmask 255.255.255.255 address source Sticky_EQUIPPROD
      timeout 180
      replicate sticky
      serverfarm EQUIPPROD
    class-map type http loadbalance match-all EQUIP_81_Redirect
      2 match http header Host header-value ".*equiponline.com"
    class-map type http loadbalance match-all EQUIP_81_Redirect_Full
      2 match http header Host header-value ".*www.equiponline.com"
    class-map match-all VIP-EQUIPPROD
      2 match virtual-address 10.1.1.97 any
    policy-map type loadbalance first-match VIP-EQUIPPROD-l7slb
      class EQUIP_81_Redirect
        serverfarm EQUIPPROD-CUSTOMER-81
      class EQUIP_81_Redirect_Full
        serverfarm EQUIPPROD-CUSTOMER-81
      class class-default
        sticky-serverfarm Sticky_EQUIPPROD
    policy-map multi-match global
      class VIP-EQUIPPROD
        loadbalance vip inservice
        loadbalance policy VIP-EQUIPPROD-l7slb
        loadbalance vip icmp-reply
        nat dynamic 13 vlan 1000
    interface vlan 1000
      nat-pool 13 10.1.1.97 10.1.1.97 netmask 255.255.255.0 pat

    Output from that class from the show service-policy command. And no, it doesn't appear to be pingable from the ACE.
        class: VIP-EQUIPPROD
          nat:
            nat dynamic 13 vlan 1000
            curr conns       : 361       , hit count        : 116690    
            dropped conns    : 5         
            client pkt count : 4815293   , client byte count: 739114009           
            server pkt count : 7281612   , server byte count: 8753101386          
            conn-rate-limit      : 0         , drop-count : 0         
            bandwidth-rate-limit : 0         , drop-count : 0         
         VIP Address:    Protocol:  Port:
         10.1.1.97    any
          loadbalance:
            L7 loadbalance policy: VIP-EQUIPPROD-l7slb
            Regex dnld status    : SUCCESSFUL
            VIP ICMP Reply       : ENABLED
            VIP State: INSERVICE
            VIP DWS state: DWS_DISABLED
            Persistence Rebalance: ENABLED
            curr conns       : 392       , hit count        : 134300    
            dropped conns    : 431       
            client pkt count : 4869950   , client byte count: 741545220           
            server pkt count : 7281612   , server byte count: 8753101386          
            conn-rate-limit      : 0         , drop-count : 0         
            bandwidth-rate-limit : 0         , drop-count : 0         
            L7 Loadbalance policy : VIP-EQUIPPROD-l7slb
              class/match : EQUIP_81_Redirect
                LB action :
                   primary serverfarm: EQUIPPROD-CUSTOMER-81
                        state: UP
                    backup serverfarm : -
                hit count        : 12602     
                dropped conns    : 0         
                compression      : off
              class/match : EQUIP_81_Redirect_Full
                LB action :
                   primary serverfarm: EQUIPPROD-CUSTOMER-81
                        state: UP
                    backup serverfarm : -
                hit count        : 0         
                dropped conns    : 0         
                compression      : off
              class/match : class-default
                LB action: :
                   sticky group: Sticky_EQUIPPROD
                      primary serverfarm: EQUIPPROD
                        state:UP
                      backup serverfarm : -
                hit count        : 107831    
                dropped conns    : 5         
                compression      : off
          compression:
            bytes_in  : 0                          bytes_out : 0                   
            Compression ratio : 0.00%
                    Gzip: 0               Deflate: 0         
          compression errors:
            User-Agent  : 0               Accept-Encoding    : 0         
            Content size: 0               Content type       : 0         
            Not HTTP 1.1: 0               HTTP response error: 0         
            Others      : 0         
    pscaceinside01/Prod# ping 10.1.1.97
     Pinging 10.51.221.97 with timeout = 2, count = 5, size = 100 ....
    No response received from 10.1.1.97 within last 2 sec
    No response received from 10.1.1.97 within last 2 sec
    No response received from 10.1.1.97 within last 2 sec
    No response received from 10.1.1.97 within last 2 sec
    No response received from 10.1.1.97 within last 2 sec
    5 packet sent, 0 responses received, 100% packet loss
    For what it's worth, none of my VIP's are pingable from the ACE. I think that has to do with me being in one-arm configuration, and using the NAT addresses per VIP. But all other VIPs are pingable from other sources on the subnet. With the exception of this VIP.

  • ACE 4710 balance among URL

    I have ACE 4710 and I need configuration:
    I have real web-server with  folders : /1/index.html, /2/index.html, /3/index.html
    I need to  balance virtual service:
    If I try to connect URL: http://server/index.html,  then ACE balance among
    http://real_server/1/index.html,
    http://real_server/2/index.html,
    http://real_server/3/index.htm
    How can I  configure ACE ?

    ACE, can't modify the url.
    But it can send redirect.
    So you could build 3 redirect rservers, and have ACE loadbalance between them.
    rserver redirect HTTP-REDIRECT1
      webhost-redirection http://real_server/1/index.html
      inservice
    rserver redirect HTTP-REDIRECT2
       webhost-redirection http://real_server/2/index.html
       inservice
    rserver redirect HTTP-REDIRECT3
       webhost-redirection http://real_server/3/index.html
       inservice
    serverfarm redirect SF_REDIRECT
      rserver HTTP-REDIRECT1
        inservice
      rserver HTTP-REDIRECT2
        inservice
      rserver HTTP-REDIRECT3
        inservice
    But even if it works, this does not sound good.
    It seems like a design done by an application server person who does not know how network loadbalancers work.
    It seems like all you need is stickyness, which you are trying to achieve by redirecting to /1 or /2 or /3.
    But this can be done differently with cookies or by just doing stickyness on source ip address.
    Gilles.

  • Loadbalancing HTTPS with stickyness

    Hi all,
    We 'd like to do HTTPS loadbalancing with stickyness ( cookie stickyness).
    Is it possible ? how to configure It.
    I've tryed to configure as following but it seems that the client does not receive the cookie.
    sticky http-cookie INAMI-OWA-PRD INAMI-OWA-STICKY
      cookie insert browser-expire
      timeout 60
      replicate sticky
      serverfarm ISA-PRD-EXCHANGE-OWA-SF
    serverfarm host ISA-PRD-EXCHANGE-OWA-SF
      description Serverfarm used for Exchange OWA (portal.inami.be) in production
      probe ICMP-PROBE-ALL
      probe ISA-PRD-HTTPS-EXCHANGE-OWA-PROBE
      rserver ISA-DMZ-PRD-1
        inservice
      rserver ISA-DMZ-PRD-2
        inservice
      rserver ISA-DMZ-PRD-3
        inservice
    class-map match-any ISA-VIP-PRD-EXCHANGE-OWA
      2 match virtual-address xxx.xxx.xxx.xxx tcp eq https
    policy-map type loadbalance first-match SLB-PRD-EXCHANGE-OWA
      class class-default
        sticky-serverfarm INAMI-OWA-STICKY
    policy-map multi-match ISA-PRD-LOADBALANCING
    class ISA-VIP-PRD-EXCHANGE-OWA
        loadbalance vip inservice
        loadbalance policy SLB-PRD-EXCHANGE-OWA
        loadbalance vip icmp-reply
        nat dynamic 117 vlan 117
    Could someone help us on implementing the sticky on https traffic?
    Thanks a lot.
    Frédéric

    Hello Frédéric,
    If you are load-balaning SSL, then you can not perform sticky via a Cookie (insert / learning). The reason for this is that the SSL data is encrypted and the ACE will not be able to insert a Cookie or learn a Cookie with encrypted data. If you are performing SSL termination or End-to-End SSL (termination and initiation) then you would be able to perform sticky via Cookie (insert / learning).  When load-balancing SSL, your sticky options are either sticky via SSL Session ID or via SRC IP.
    The one major issue with SSL Session ID sticky is that some older I.E. browsers may re-negotiate SSL Session ID every two minutes which may cause the SSL user to get load-balanced to a different Rserver.  This is also explained in via the following knowledge base article http://support.microsoft.com/kb/265369
    Here are a couple of examples covering both SSL Session id sticky as well as SRC IP sticky:
    SSL Session ID Example:
    parameter-map type generic SSLID_PARAMMAP
      set max-parse-length 70
    serverfarm host ISA-PRD-EXCHANGE-OWA-SF
      description Serverfarm used for Exchange OWA (portal.inami.be) in production
      probe ICMP-PROBE-ALL
      probe ISA-PRD-HTTPS-EXCHANGE-OWA-PROBE
      rserver ISA-DMZ-PRD-1
        inservice
      rserver ISA-DMZ-PRD-2
        inservice
      rserver ISA-DMZ-PRD-3
        inservice
    sticky layer4-payload SSL-STICKY
      timeout 30
      serverfarm ISA-PRD-EXCHANGE-OWA-SF
      response sticky
      layer4-payload offset 43 length 32 begin-pattern "\x20"
    policy-map type generic first-match SLB-PRD-EXCHANGE-OWA
      class class-default
        sticky-serverfarm SSL-STICKY
    policy-map multi-match ISA-PRD-LOADBALANCING
      class ISA-VIP-PRD-EXCHANGE-OWA
        loadbalance vip inservice
        loadbalance policy SLB-PRD-EXCHANGE-OWA
        loadbalance vip icmp-reply
        appl-parameter generic advanced-options SSLID-PARAMMAP
        nat dynamic 117 vlan 117
    SRC IP Example::
    serverfarm host ISA-PRD-EXCHANGE-OWA-SF
      description Serverfarm used for Exchange OWA (portal.inami.be) in production
      probe ICMP-PROBE-ALL
      probe ISA-PRD-HTTPS-EXCHANGE-OWA-PROBE
      rserver ISA-DMZ-PRD-1
        inservice
      rserver ISA-DMZ-PRD-2
        inservice
      rserver ISA-DMZ-PRD-3
        inservice
    sticky ip-netmask 255.255.255.255 address source SRCIP-STICKY
      timeout 30
      serverfarm ISA-PRD-EXCHANGE-OWA-SF
    policy-map type generic first-match SLB-PRD-EXCHANGE-OWA
      class class-default
        sticky-serverfarm SRCIP-STICKY
    policy-map multi-match ISA-PRD-LOADBALANCING
      class ISA-VIP-PRD-EXCHANGE-OWA
        loadbalance vip inservice
        loadbalance policy SLB-PRD-EXCHANGE-OWA
        loadbalance vip icmp-reply
        nat dynamic 117 vlan 117
    I hope this information helps.
    Thank you,
    Antonios

Maybe you are looking for