CSM L7 LOAD BALANCING

I need to load-balance trafic with a persistence based on http header "X-Nokia-MSISDN".
Knowing that I'm using the version 4.1(6), the command "http header sticky" is not available (version 4.2 and more).
I've seen that the following command is available "persistent rebalance" with version 4.1(6) but I'm not sure about what is its action.
According to the definition given in the guide (
"The CSM allows HTTP connections to be switched based on (...) fields contained in the HTTP header."
MY QUESTION :
How can you define that persistence should occurs on the "X-Nokia-MSISDN"
http header ?
Thanks for your help
Francois

the persistent rebalance command tells the CSM to look at every HTTP request to select the best server. So, if you have a persistent connection ( 1 tcp connection for many http requests ), the CSM will look at each request.
Otherwise, it only looks at the first request and assumes all the other requests stick to the same server. Which is normally true, except if you have a proxy connecting to your vserver.
You still need 4.2.x to allow sticky on header info.
Gilles.

Similar Messages

  • Using CSM to load-balance two sites

    Hi there,
    I currently use CSS11500's at two of my sites and I'm able to use source-groups to achieve site load-balancing behind a single VIP.  So basically I have a VIP that has servers in both the local site and remote site.   Is something like this possible with the CSM? I suppose there's the nat server or nat client commands, but I'd like to be able to maintain original client IP address if possible, or at least maintain the original client IP for connections that stay local to the site.
    Thanks,
    Brandon

    Hello Brandon-
    It is not directly possible to pick and choose what servers are natted on the CSM like the CSS and ACE can do.
    In the CSM, you configure nat under the serverfarm specifically.
    Ex.
    serverfarm Client_Nat_Example
    nat server
    nat client REMOTENAT
    real 10.10.10.1
      inservice
    natpool REMOTENAT 172.16.35.5 172.16.35.5 netmask 255.255.255.0
    If you were to devide up the traffic prior to hitting a serverfarm (maybe use a policy that matches specific subnets for your clients), then you could nat to only certain servers.
    Ex.
    access-list 2 permit 5.5.0.0 0.0.255.255
    serverfarm Client-Nat-Example
    nat server
    nat client REMOTENAT
    real 10.10.10.1
      inservice
    serverfarm No_Nat
    nat server
    no nat client
    real 20.20.20.1
      inservice
    natpool REMOTENAT 172.16.35.5 172.16.35.5 netmask 255.255.255.0
    policy client_remote
    serverfarm Client_Nat_Example
    client-group 2
    vserver HTTP
      virtual  172.16.35.7 tcp www
      slb-policy client_remote
      serverfarm No_Nat
      persistent rebalance
      inservice
    With this config, the CSM checks global access list 2, anything that matches a source of 5.5.x.x subnet would go to the serverfarm with the remote servers. Anything that does not match 5.5.x.x would use the default serverfarm under the vip (No_Nat serverfarm).  This is not optimal, but there is no parity between CSM and CSS when it comes to per-server NAT.

  • CSM not load-balancing properly

    Folks,
    I'm seeing that CSM is not loadbalancing properly to all the servers in the serverfarm.
    I simulated a failover of one of the servers TS05 and brought it back. After coming online, CSM sent no traffic to that server, as shown below:
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 4
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 4
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 1
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 3
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 3
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 1
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 4
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 3
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 1
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 2
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 3
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | i OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS03-RADIO, weight = 8, OPERATIONAL, conns = 1
    TS04-RADIO, weight = 8, OPERATIONAL, conns = 2
    TS05-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 4
    My config is attached with this post:
    Can there be anything wrong with my VARIABLES?
    C7606-1#show mod csm 1 variable | i SLOW
    REAL_SLOW_START_ENABLE 1
    C7606-1#

    Folks - I upgraded the code to 4.2(6) and thought that bug CSCei26434 was solved, but still see the same error where CSM is not balancing properly.
    No Traffic Running:
    ===================
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    Started Traffic
    ===============
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 60
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 101
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 188
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    The newly ALIVE server passed the probe test:
    =============================================
    C7606-1#show mod csm 1 probe detail | inc 102
    192.168.122.102:1813 RADIUS RADIUS (default) OPERABLE
    192.168.122.102:9202 WSP_SCL WSP_SCL (default) OPERABLE
    192.168.122.102:9201 WSP_CO WSP_CO (default) OPERABLE
    192.168.122.102:9200 WSP_CL WSP_CL (default) OPERABLE
    192.168.122.102:8080 WHTTP WHTTP (default) OPERABLE
    192.168.122.102:8080 TP_8080 TP_8080 (default) OPERABLE
    192.168.122.102:7080 PUSH_WWW PUSH_WWW (default) OPERABLE
    Still no connections:
    =====================
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 583
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    C76061#
    Brought another server on-line:
    ================================
    C7606-1#
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: TCP health probe re-activated server 192.168.122.106:8080 in serverfarm 'WHTTP'
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: TCP health probe re-activated server 192.168.122.106:8080 in serverfarm 'TP_8080'
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: TCP health probe re-activated server 192.168.122.106:7080 in serverfarm 'PUSH_WWW'
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: UDP health probe re-activated server 192.168.122.106:9200 in serverfarm 'WSP_CL'
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: UDP health probe re-activated server 192.168.122.106:1813 in serverfarm 'RADIUS'
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: UDP health probe re-activated server 192.168.122.106:9201 in serverfarm 'WSP_CO'
    C7606-1#
    C7606-1#
    1w4d: %CSM_SLB-6-RSERVERSTATE: Module 1 server state changed: SLB-NETMGT: UDP health probe re-activated server 192.168.122.106:9202 in serverfarm '
    No connections to the NEW Server even
    ======================================
    C7606-1#show mod csm 1 serverfarms name WHTTP detail | inc OPER
    TS01-RADIO, weight = 8, OPERATIONAL, conns = 2988
    TS02-RADIO, weight = 8, OPERATIONAL, conns = 0
    TS06-RADIO, weight = 8, OPERATIONAL, conns = 0

  • Load Balancing with a CSM & SSL Module

    I'm trying to understand the best way to balance traffic to two servers when decrypting and re-encrypting with the CSM and an SSL module. I take the SSL traffic hitting the first CSM VIP and forward to the SSL module for decryption. Send the decrypted traffic back to another VIP on the CSM. Send the traffic to the client proxy VIP on the SSL which encrypts the traffic and forwards to the CSM VIP. That final VIP passes the traffic to the serverfarm containing the actual servers. How do I make sure the traffic is balanced between the final VIP and my servers. It seems that sticking on SSL session ID is the only way to go at that point which made decryption pointless. I feel like I'm missing something basic here.
    Thanks..

    Hi David,
    Here find some full config example for your perusal for CSM and SSL Services Module Initial Configuration Example
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a0080216c16.shtml
    2nd config example to Configuring CSM to Load Balance SSL to a Farm of SCAs for One-Armed Proxy Mode
    http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00801aca55.shtml
    Sachin garg

  • IPSec (transport mode) load balancing via CSM

    Suppouse that there is two servers providing service for remote aplications. Those aplications using IPSEC in transport mode. I would like to put at front CSM to load-balance beetwen both of them (persist via SRC IP is ok for me).
    Have you any expirience with transort mode? IMHO it is not possible becouse of ip header changes? (I have no exact informatin that resign from AH transforms are possible)
    What when changing to tunnel mode. Have you ever seen that configuraion working?

    I think you can for the transport mode. I have not had any luck with the Tunnel mode.

  • How to config CSM load balance of http combined https

    In this case,when I config CSM for load balance http and https service separately was ok.2 VIPs , 2 Serverfarms, One for http , and one for https .But I found that the https would referred to http information on IIS , because when the client first to access http is ok,and then login by https ,the information is not right.So,how to config CSM in this case,any reply will be very be appreciated.

    There are 2 different ways.
    You could combine the 2 vserver into a single one by not specifying the tcp port.
    Another solution would be to use the same sticky group for both vservers.
    For example, you could use sticky srcip.
    ie:
    sticky 10 netmask /32 address source
    vserver http
    sticky 60 group 10
    inservice
    vserver https
    sticky 60 group 10
    inservice
    Regards,
    Gilles.
    Thanks for rating this answer.

  • Load balance on CSM with both Firewalsl and Cache engines

    Hi,
    I'm come from VDC#3 ( Vietnam) , we have 2 CSM , 3 firewall , and 8 CE 7325. We configed dual CSMs load balance for 3 FW, and now we want to use one CSM to load balance for CEs. Can you hint me best topylogy network?
    Thanks

    your topology is correct.
    The problem is your config.
    If you need access to the CE ip addresses, you need to configure a vserver to allow this traffic.
    Something like
    serverfarm FORWARD
    no nat server
    no nat client
    predictor forward
    vserver access2ce
    vip x.x.x.0/24 any
    serverfarm FORWARD
    ins
    Replace x.x.x.0/24 with the subnet used by the CE.
    Regards,
    Gilles.
    Thanks for rating this answer.

  • SOAP Load Balancing

    Is anyone using CSMs to load balance traffic based on SOAP envelope values to maintain session affinity?
    Is it possible to feed the inspected value into a cookie/element that can be used in a sticky group? (I'm guessing insert header could help?)

    Is is possible to load balance traffic based on SOAP using CSM's. But there is one thing which has to be taken care of.. Turn PMTUD off, in that case packets will get fragmented at upstream router and get sent to the client.

  • Load Balance but No Failover

    I have an application that does not fail over nicely to another server. I would like to configure my CSM to load balance normally on new connections and keep the sticky so an individual workstation always accesses the same server.
    It is my understanding that should Server A fail, eventually all connections will be redirected to Server B. i would like to prevent this from happening. The client would rather see loss of connectivity than have a workstation's connection fail over to the operating Server B.
    Any chance?
    Thanks
    LP

    The only way would be to prevent the server from going down. So, by not configuring probes, as long as the server is able to answer arp request, the traffic should be forwarded it to it and if the service is down, the client will get a failure.
    If you also want to cover the server is completely down, you could configure static arp entries on the CSM for those servers or put a routing device between the CSM and the server.
    However, I have to question such a config.
    Why would you want half the users to go the failed server ?
    Are you afraid that one server only would go down with the load ? if so you could use maxconn to protect it.
    Are you afraid that when a server goes down all connections get stuck to the remaining server due to the sticky entry ?
    If so, you could use a source hash algorithm instead of a sticky group.
    All I want to say is that there might be a better solution to your problem than having users stuck to a dead server.
    Regards,
    Gilles.
    Thanks for rating this answer.

  • RPC Load Balancing on CSM and SSL

    We are load-balancing SSL successfully but the Exchange people want to use RPC to access
    mailboxes using CSM.
    We need to allow ports 6005 through 59530 used by the Client Access Servers. Any suggestions?

    Thanks. I tried that, but according to our exchange administrators, the solution didn't work. Here is my configuration:
    serverfarm EXCH-CAS
    nat server
    no nat client
    real x.x.248.100
      inservice
    real x.x.248.101
      inservice
    probe EXCH-CAS
    serverfarm EXCH-CAS-SSL
    nat server
    no nat client
    real x.x.254.60
      inservice
    real x.x.254.61
      inservice
    probe SSL-FARM
    ! vserver EXCH-CAS
      virtual x.x.254.154 tcp www
      vlan 460
      serverfarm EXCH-CAS
      sticky 1440 group 152
      replicate csrp sticky
      replicate csrp connection
      persistent rebalance
      inservice
    vserver EXCH-CAS-S
      virtual x.x.214.139 tcp https
      vlan 400
      serverfarm EXCH-CAS-SSL
      sticky 5 group 252
      replicate csrp sticky
      replicate csrp connection
      persistent rebalance
      inservice
    vserver EXCH-CAS-TEST-S
      virtual x.x.214.139 tcp 0
      vlan 400
      serverfarm EXCH-CAS
      sticky 5 group 252
      replicate csrp sticky
      replicate csrp connection
      persistent rebalance
      inservice
    Thanks,
    Mohamad

  • CSM load balancing

    I have an interesting problem. I have a VIP with a two server, serverfarm. Originally the VIP and serverfarm were doing load balancing in the switch IOS and the vip was configured with a 27 bit subnet mask. I moved the configuration to our csm mod and removed the subnet mask. The original sticky was set to 120 and I reset the sticky to 30 as part of the move. Now the load balancing is extremely off kilter (200 connections to 7). Any ideas what could be amiss?

    Real servers are physical devices assigned to a server farm. Real servers provide the services that are load balanced. When the server receives a client request, it pulls matching information from a disk and sends it to the CSM for forwarding to the client.
    You configure the real server in the real server configuration mode by specifying the server IP address and port when you assign it to a server farm. You enter the real server configuration mode from the serverfarm mode where you are adding the real server.
    This URl should help me:
    http://www.cisco.com/en/US/products/hw/switches/ps708/products_installation_and_configuration_guide09186a00801760d0.html#xtocid439743

  • Server Load Balance in one network using CSM Cat6509

    I have 2 Web Servers with real IP address 10.1.12.61 and 10.1.12.62 (subnet mask 255.255.255.0). The virtual IP address configured on CSM is 10.1.12.100
    I also have 2 Application Servers with real IP address 10.1.12.81 and 10.1.12.82 (subnet mask 255.255.255.0). The virtual IP address is 10.1.12.120.
    Users will access Web server using the virtual IP address (10.1.12.100) so that the traffic will be load balanced.
    But there is also requirement that those Web Servers access Application Servers using IP address 10.1.12.120 so that the traffic will be load balanced as well.
    Is this requirement feasible?
    Can CSM load balance between servers in one network address?

    Budiman,
    I am building the same situatiuon here. But the most simple part seems not to be working. I have two webservers in the same subnet as my VIP.
    The clients can be everywhere in every subnet.
    This is what happens:
    btpebgw70#sh mod contentSwitchingModule 9 conns
    prot vlan source destination state
    In TCP 401 192.6.53.42:1901 151.183.58.196:80 ESTAB
    Out TCP 401 151.183.58.196:80 192.6.53.42:1901 ESTAB
    ok this is good but:
    btpebgw70#sh mod contentSwitchingModule 9 reals detail
    151.183.58.201, ORBIS, state = OPERATIONAL
    conns = 0, maxconns = 4294967295, minconns = 0
    weight = 8, weight(admin) = 8, metric = 0, remainder = 0
    total conns established = 58, total conn failures = 58
    the failures have the same value as the established. Can you send me your config part of the csm because I am getting tired of this. Please email to [email protected]
    Thanks in advance!

  • Load Balancing FTP Server thru CSM using a single Client IP

    Hello,
    We have a need to load balance 3 FTP servers. These servers are reached only from a single client IP which is a database server. The FTP method that is being used is currently passive. Our configuration is currently unidirectional, ie, the FTP client (the one database server) sends to the VIP and the FTP Servers then talk directly back to the FTP client and the traffic does not go back through the CSM. The problem is that because FTP negotiates another port to talk on, we have to use sticky so that the connection is sent back to the original FTP server that sent the FTP data port to talk on. But, since we only have a single client IP that is ever used we are not load balancing appropriately across the FTP servers.
    Traffic flow goes something like this, tcp port followed after colon as an example
    1. FTP Client ----> VIP:21
    2. CSM ---------> FTP Server:21
    3. FTP Server --------> FTP Client(FTP server says come talk to me on port 1700)
    4. FTP Client ---------> VIP:1700
    5. CSM ---------> FTP Server:1700
    6. FTP Server:1700 ---------> FTP Client
    repeat steps 4 thru 6
    Here's our hardware and software:
    WS-X6066-SLB-APC running 4.2(2)
    Config is as follows
    module ContentSwitchingModule 9
    ft group 101 vlan 9
    priority 10
    vlan 216 client
    ip address 10.209.16.31 255.255.252.0
    gateway 10.209.16.1
    vlan 20 server
    ip address 10.209.0.31 255.255.252.0
    alias 10.209.0.11 255.255.252.0
    probe ICMP1 icmp
    interval 3
    failed 3
    receive 3
    serverfarm FHEPRT
    no nat server
    no nat client
    real 10.209.0.72
    inservice
    real 10.209.0.73
    inservice
    real 10.209.0.71
    inservice
    probe ICMP1
    sticky 106 netmask 255.255.255.255 address source timeout 3
    policy FHEPRT_POL1
    sticky-group 106
    serverfarm FHEPRT
    vserver FHEPRT1
    virtual 10.209.16.71 any
    vlan 216
    unidirectional
    serverfarm FHEPRT
    replicate csrp connection
    no persistent rebalance
    slb-policy FHEPRT_POL1
    inservice

    You are missing "service ftp" config in the Vip definition. Try the following
    vserver FHEPRT1
    virtual 10.209.16.71 tcp ftp service ftp
    Syed Iftekhar Ahmed

  • Cisco CSM: Duplication of udp packets possible instead of load balancing?

    Hi all,
    Does anybody know if it's possible to use the csm (WS-X6066-SLB-APC, OS 4.3.1) to duplicate udp packets to several real servers instead of balancing them.
    In our special case we want to test duplicating snmp traps to several network management systems whereas on the snmp clients only one target address (the vserver address) is configured.
    Many thanks in advance,
    Thorsten

    Hi Thorsten,
    I'm afraid this is not possible. With the CSM you can only load-balance.
    Regards
    Daniel

  • Portal Landscape - With 2 CSM (load balance) related question

    Hi,
      We are currently having a portal landscape (Dev, QA -2 app servers, PRD - 4 app servers). The load balancing happens on Production Portal using CSM (load balancer) and it does SSL offloading for security encryption and it lands onto one of the application servers. When we try to login to portal it authenticates using the LDAP (OID). And we have some links which takes to backend R/3, BW etc (we use SAP load balance using SMLG logon group)
    Now due to another special project the following is what we are planning:
    1. Adding couple of more application servers for production portal or having seperate second portal landscape itself
    2. Adding couple of more application servers for R/3 production server (load balance can be done with special logon group for that)
    Questions are:
    1. When we land into current production portal page and click a iview link for the special project it should go only to those special portal app servers (planning to do through another CSM) and from their to backend R/3. In this scenario how the authentication (or sso ticket) happens when it goes from CSM to another CSM, will it ask for login again or any issue will happen with SSO ticket ?
    2. If we decide to go for second portal landscape and in the same scenario when login to current prod portal page and click a iview link for the special project it should go to that another production portal,in that case what will happen to the login authentication happened through the first portal and SSO ticket ?
    3. Suppose if we go to the second production portal directly through a website and if the user tries to login using the same id to first portal how portal will deal in terms of security (SSO) and also how backend R/3 will behave when same id comes as part of SSO.
    Or if anyone thinks of any other issue apart from SSO or encryption related things which i need to be aware of, kindly let me know.
    Thanks,
    Murali.

    I am not sure what CSM is, but I would expect it only does ssl offloading and a sort of "reverse proxy" against the cluster.
    >1. When we land into current production portal page and click a iview link for the special project it should go only to those special portal app servers (planning to do through another CSM) and from their to backend R/3. In this >scenario how the authentication (or sso ticket) happens when it goes from CSM to another CSM, will it ask for login again or any issue will happen with SSO ticket ?
    This depends on the host name you use for the two CSM clusters. If they have the same subdomain, there should be no problem as the SAP Logon Ticket (MYSAPSSO2) cookie is issued to the sub domain of the portal.
    If they do not have the same subdomain, the second CSM cluster will receive the request without the MYSAPSSO2 cookie, and will therefore trigger reauthentication.
    >2. If we decide to go for second portal landscape and in the same scenario when login to current prod portal page and click a iview link for the special project it should go to that another production portal,in that case what will >happen to the login authentication happened through the first portal and SSO ticket ?
    It will fail, as the MYSAPSSO2 cookie from the first portal is not recognized in the second. However, you can easily setup so that the second portal trusts the first and does a logon based on its credentials
    >3. Suppose if we go to the second production portal directly through a website and if the user tries to login using the same id to first portal how portal will deal in terms of security (SSO) and also how backend R/3 will behave >when same id comes as part of SSO.
    I assume both portal will be setup against the same LDAP/UME source. Therefore it will allow the logon. The backend systems should trust both the first and second portal (STRUSTSSO2 transaction)
    I think your architecture choice comes down to if the new project has special considerations with regards to versioning of portal. If it does, it would be sensible to separate it into a separate portal (and you can always integrate them with the first portal through portal federation if you have a relatively new version).
    Regards
    Dagfinn

Maybe you are looking for