topic Re: Using Sticky with SSL in Application Networking

Using Sticky with SSL

p.bailey — Mon, 12 Dec 2005 20:23:53 GMT

I have a 6509 with a CSM module and an SSL module installed. A section of the config is as follows (IP addresses changes for security):

probe HTTP http

request method get

interval 5

failed 10

serverfarm SF7020

nat server

no nat client

predictor leastconns

real 10.1.10.1

inservice

real 10.1.10.2

inservice

real 10.1.10.3

inservice

probe HTTP

serverfarm SSLFARM

nat server

no nat client

predictor leastconns

real 10.1.200.10

inservice

sticky 100 ssl timeout 120

vserver ENC_VS7020

virtual 192.168.1.1 tcp 4420

vlan 10

serverfarm SSLFARM

sticky 120 group 100

replicate csrp connection

persistent rebalance

inservice

vserver DEC_VS7020

virtual 10.1.200.20 tcp 7020

vlan 200

serverfarm SF7020

sticky 120

replicate csrp connection

persistent rebalance

inservice

My question is, do I need the 'stickiness' on the vserver 'DEC_VS7020' for the decrypted traffic returning from the SSL module? Would/could this be causing a problem? We are experiencing uneven loadbalancing across the real servers.

Thanks Phil.

Re: Using Sticky with SSL

Gilles Dufour — Tue, 13 Dec 2005 09:51:45 GMT

it depends on yout server requirements.

For example, if this is a merchant website where people put items in a shopping basket, the basket most probably only exist on one server, so if the user closes the tcp connection and opens a new one, you want to guarantee that he goes back to the same server to retrieve his basket.

We can't tell you if you need stickyness or not.

only people with the knowledge of the application can answer the question.

Regards,

Gilles.

Thanks for rating this answer.

Re: Using Sticky with SSL

p.bailey — Tue, 13 Dec 2005 11:40:28 GMT

Gilles

Thanks again for the quick response.

We do require the connections to be sticky and that's why I have created a SSL sticky group (100) for the intial encrypted connection. I was just wondering whether the stickiness on the vserver for the decrypted traffic coming back from the SSL module is necessary or even if this could be causing our problems.

Am I right in thinking the first sticky group (100) will guarentee SSL connectivity to the first real server it is connected to? Because there is only one SSL module, I'm unsure if the second 'stickiness' is necessary and if it could be interferring with the first one. Your comments/thoughts would be much appreciated.

Thanks

Phil.

Re: Using Sticky with SSL

Gilles Dufour — Tue, 13 Dec 2005 12:09:19 GMT

Phil,

your sticky group 100 is useless.

It will guarantee that the encrypted traffic is always sent to the same ssl module.

Since you have only one, it is useless.

You need a sticky group for the decrypted traffic because there you have multiple real servers.

If the SSL module send the decrypted traffic to the vserver, you need stickyness if you want to guarantee that the same user always goes to the same real.

Regards,

Gilles.

Re: Using Sticky with SSL

p.bailey — Tue, 13 Dec 2005 12:43:58 GMT

Gilles

I will remove the SSL sticky group when I can (later this week) and I'll let you know the outcome.

Regards

Phil.

Re: Using Sticky with SSL

Gilles Dufour — Tue, 13 Dec 2005 13:45:23 GMT

Phil,

again, the ssl sticky group is useless.

Remving should not have any impact.

It means it will not solve your loadbalancing issue.

When using sticky source ip, it is very common to have uneven loadbalancing because of the mega proxy issue [thousands of users behing a single ip address]

Best solution to solve this is to use cookie stickyness.

Regards,

Gilles.

Re: Using Sticky with SSL

p.bailey — Wed, 21 Dec 2005 09:31:09 GMT

Gilles

Cookie stickyness has been discussed and rejected at a higher level with the customer. The client workstations for the load balanced services will not be connecting via proxy servers in this case.

If, as you suggest, the vserver for the decrypted traffic returning from the SSL module has to be sticky, is there a posibility of the SSL module IP address being regarded as the client (with respect to the vserver) and therefore being 'stuck' to the first real server it is passed to?

With so many choices of where to use the sticky command and the limited documentation, it can get very confusing. How do I ensure the client communicates with the same real server now the connection goes through an extra loop with the SSL module.

Regards

Phil.

Re: Using Sticky with SSL

Gilles Dufour — Wed, 21 Dec 2005 09:46:05 GMT

Phil,

the SSL module will not use its ip address to communicate with the server. It always reuses the client ip.

Therefore, you can simply use sitcky source ip on the clear text content rule.

Gilles.

Re: Using Sticky with SSL

p.bailey — Wed, 21 Dec 2005 10:25:40 GMT

Gilles

Thanks for the quick reply.

That's what I thought but it's nice to have it confirmed - at this stage I'll clutch at any straw.

Regards

Phil.