topic another Sticky issue in Application Networking

another Sticky issue

benediktsv — Wed, 30 Jan 2013 10:52:39 GMT

Hi all

Ok - so we are running a ACE30 - and this is a site we are pushing out.

running SSL offloading for HTTPS
redirecting http -> https
ASP.net framework - that has a 20 minute sliding session time
ASP.net that need the session to stay on the same server.

Here is something that worries me:

ACE30Number1/WEB# show resource usage

Resource Current Peak Min Max Denied

sticky 419428 419428 419428 419428 0

Problem:

Stickyness is not working. - we are still mapping this out - it's somewhat working.

Question:

Are we doing it correct ? using a IP timeout ? what should we do ?
is the timeout of the sticky sliding ? or just a hard timeout ?
do we have an issue with sticky resource allocation ? (ANM shows global avalable 10, used 10, guaranties 10)

Here is a config exerpt

serverfarm host WWW.XXXX.COM_HTTPS

predictor leastconns

probe HTTP-ACTIVITY9999

rserver LHR-XXXX 4443

inservice

rserver LHR-XXXX 4443

inservice

class-map match-any VIP_XXXX.COM_HTTP

2 match virtual-address YY.YY.YY.YY tcp eq www

class-map match-any VIP_XXXX.COM_HTTPS

2 match virtual-address YY.YY.YY.YY tcp eq https

sticky ip-netmask 255.255.255.255 address source STICKY-WWW.XXXX.COM_HTTPS

serverfarm WWW.XXXX.COM_HTTPS

timeout 3600

sticky ip-netmask 255.255.255.255 address source FORUMS.XXXX.COM

serverfarm FORUMS.XXXX.COM

timeout 3600

class-map type http loadbalance match-any L7_SECURE.XXXX.COM

2 match http header Host header-value "secure.XXXX.com"

class-map type http loadbalance match-any L7_WWW.XXXX.COM

2 match http header Host header-value "www.XXXX.com"

policy-map type loadbalance first-match POLICY_XXXX.COM.HTTP

class L7_WWW.XXXX.COM

serverfarm WWW.XXXX.COM

class L7_FORUMS.XXXX.COM

serverfarm RE_forums.XXXX.com

class L7_SECURE.XXXX.COM

serverfarm RE_secure.XXXX.com

class class-default

serverfarm WWW.XXXX.COM

policy-map type loadbalance first-match POLICY_XXXX.COM.HTTPS

class L7_WWW.XXXX.COM

sticky-serverfarm STICKY-WWW.XXXX.COM_HTTPS

class L7_FORUMS.XXXX.COM

sticky-serverfarm FORUMS.XXXX.COM

class L7_SECURE.XXXX.COM

serverfarm SECURE.XXXX.COM.HTTPS

class class-default

sticky-serverfarm STICKY-WWW.XXXX.COM_HTTPS

policy-map multi-match WEBCLUSTER

class VIP_XXXX.COM_HTTP

loadbalance vip inservice

loadbalance policy POLICY_XXXX.COM.HTTP

loadbalance vip icmp-reply active

class VIP_XXXX.COM_HTTPS

loadbalance vip inservice

loadbalance policy POLICY_XXXX.COM.HTTPS

loadbalance vip icmp-reply active

appl-parameter http advanced-options YYTT

ssl-proxy server XXXX.COM

- Benni

another Sticky issue

ajayku2 — Thu, 31 Jan 2013 11:29:41 GMT

Hi,

See if your symptoms are similar:

Look at the output of "show sticky databse group Cookie_Sticky"

If you see lot of entry with a time-to-expire value of zero. Then the command "

timeout activeconns" will help you to reduce the number of entry.

The way it works is this: after one connection is open and the sticky entry for that connection is created, the timeout will immediatly start decreasing. Once it reaches 0, if there are still active connections for that sticky entry, the entry won't be deleted unless the "timeout activeconns" option within the sticky group is enabled. If no active conns are present for that sticky entry, the entry will be freed.

For reference :

http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_2_0/configuration/slb/guide/sticky.pdf

read section

Enabling an IP Address Sticky Timeout to Override Active Connections

regards,

Ajay Kumar

another Sticky issue

benediktsv — Thu, 31 Jan 2013 12:47:41 GMT

Should we use IP based sticky for normal ASPnet web ?

does the IP sticky relate to the HTTP session in any way ?

I'm trying to understand how and what would be the best way to configure this + I'm trying to figure out if I'm depleating the sticky resource and thus the ACE is prematurly deleting the entires / not creating new sticky sessions.

another Sticky issue

ajayku2 — Thu, 31 Jan 2013 14:48:23 GMT

Hi,

Should we use IP based sticky for normal ASPnet web ?

It depends on the app and the way you have set your network.

does the IP sticky relate to the HTTP session in any way ?

No, As IP based sticky is based on IP. HTTP does not come into picture.

------------------------------------------------------------------------
Also FYI:

Once the database fills up, the following logic is performed to determine which entry to steal to make room for the new sticky entry:
- Find an entry with no active-conns that has timed out. - Find the entry with no active-conns that has not yet timed out. - Find an entry with active conns. The final two contribute to the "Total sticky entries reused prior to expiry" count. Note that a new sticky entry will ALWAYS be created, there are never any denies for new sticky entries.

Hope that helps.

regards,

Ajay Kumar