another Sticky issue

[benediktsv]

Hi all

Ok - so we are running a ACE30 - and this is a site we are pushing out.

• running SSL offloading for HTTPS
• redirecting http -> https
• ASP.net framework - that has a 20 minute sliding session time
• ASP.net that need the session to stay on the same server.

Here is something that worries me:

ACE30Number1/WEB# show resource usage

        Resource         Current       Peak        Min        Max       Denied

  sticky                   419428     419428     419428     419428          0

Problem:

• Stickyness is not working. - we are still mapping this out - it's somewhat working.

Question:

• Are we doing it correct ? using a IP timeout ? what should we do ?
• is the timeout of the sticky sliding ? or just a hard timeout ?
• do we have an issue with sticky resource allocation ? (ANM shows global avalable 10, used 10, guaranties 10)

Here is a config exerpt

serverfarm host WWW.XXXX.COM_HTTPS

  predictor leastconns

  probe HTTP-ACTIVITY9999

  rserver LHR-XXXX 4443

    inservice

  rserver LHR-XXXX 4443

    inservice

class-map match-any VIP_XXXX.COM_HTTP

  2 match virtual-address YY.YY.YY.YY tcp eq www

class-map match-any VIP_XXXX.COM_HTTPS

  2 match virtual-address YY.YY.YY.YY tcp eq https

sticky ip-netmask 255.255.255.255 address source STICKY-WWW.XXXX.COM_HTTPS

  serverfarm WWW.XXXX.COM_HTTPS

  timeout 3600

sticky ip-netmask 255.255.255.255 address source FORUMS.XXXX.COM

  serverfarm FORUMS.XXXX.COM

  timeout 3600

class-map type http loadbalance match-any L7_SECURE.XXXX.COM

  2 match http header Host header-value "secure.XXXX.com"

class-map type http loadbalance match-any L7_WWW.XXXX.COM

  2 match http header Host header-value "www.XXXX.com"

policy-map type loadbalance first-match POLICY_XXXX.COM.HTTP

  class L7_WWW.XXXX.COM

    serverfarm WWW.XXXX.COM

  class L7_FORUMS.XXXX.COM

    serverfarm RE_forums.XXXX.com

  class L7_SECURE.XXXX.COM

    serverfarm RE_secure.XXXX.com

  class class-default

    serverfarm WWW.XXXX.COM

policy-map type loadbalance first-match POLICY_XXXX.COM.HTTPS

  class L7_WWW.XXXX.COM

    sticky-serverfarm STICKY-WWW.XXXX.COM_HTTPS

  class L7_FORUMS.XXXX.COM

    sticky-serverfarm FORUMS.XXXX.COM

  class L7_SECURE.XXXX.COM

    serverfarm SECURE.XXXX.COM.HTTPS

  class class-default

    sticky-serverfarm STICKY-WWW.XXXX.COM_HTTPS

policy-map multi-match WEBCLUSTER

class VIP_XXXX.COM_HTTP

    loadbalance vip inservice

    loadbalance policy POLICY_XXXX.COM.HTTP

    loadbalance vip icmp-reply active

  class VIP_XXXX.COM_HTTPS

    loadbalance vip inservice

    loadbalance policy POLICY_XXXX.COM.HTTPS

    loadbalance vip icmp-reply active

    appl-parameter http advanced-options YYTT

    ssl-proxy server XXXX.COM

- Benni

[ajayku2]

Hi, 
See if your symptoms are similar: 
Look at the output of "show sticky databse group Cookie_Sticky"  
If you see lot of entry with a time-to-expire value of zero. Then the command "
timeout activeconns" will help you to reduce the number of entry. 

The way it works is this: after one connection is open and
the sticky entry for that connection is created, the timeout will
immediatly start decreasing. Once it reaches 0, if there are still
active connections for that sticky entry, the entry won't be deleted
unless the "timeout activeconns" option within the sticky group is
enabled. If no active conns are present for that sticky entry, the entry
will be freed. 

For reference : 

http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_2_0/configuration/slb/guide/sticky.pdf

read section

Enabling an IP Address Sticky Timeout to Override Active Connections

regards,

Ajay Kumar

[benediktsv]

Should we use IP based sticky for normal ASPnet web ?

does the IP sticky relate to the HTTP session in any way ?

I'm trying to understand how and what would be the best way to configure this + I'm trying to figure out if I'm depleating the sticky resource and thus the ACE is prematurly deleting the entires / not creating new sticky sessions.

[ajayku2]

Hi, 

Should we use IP based sticky for normal ASPnet web ? 
It depends on the app and the way you have set your network. 
does the IP sticky relate to the HTTP session in any way ?
No, As IP based sticky is based on IP. HTTP does not come into picture. 

------------------------------------------------------------------------
Also FYI: 

Once the database fills up, the following logic is performed to determine which entry
to steal to make room for the new sticky entry:  

- Find an entry with no active-conns that has timed out.
- Find the entry with no active-conns that has not yet timed out.
- Find an entry with active conns.
The final two contribute to the "Total sticky entries reused prior to expiry" count.
Note that a new sticky entry will ALWAYS be created, there are never any denies for new sticky entries.

Hope that helps.

regards,

Ajay Kumar