Re: Cookie stickyness issues - ACE

quesne02 · ‎03-16-2011

Hi,

Another issue where I have been asked to integrate an app and do cookie stickyness for a web app. The config is good from the ACE perspective, but the problem is that the cookie is not present in the packets until a login to the app happens.

This means that the first few packets to get to the login page does not contain any cookie information, but once properly logged in, no problem. Is there an easy way "bypass" the creation of the sticky entries untill the cookie is seen ? or what am I missing to just do the sticky entry only if the cookie is present.

thanks

Surya ARBY · ‎03-16-2011

please post your config.

The best practice for web based applications is to use cookie insertion with the "browser-expire" flag set.

quesne02 · ‎03-17-2011

Here is the config, edited a bit to what is pertinent

probe https SrvCat_HTTPS_7143_Probe
description Service Catalog HTTPS probe on port 7143
port 7143
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
header User-Agent header-value "Mozilla/4.0"
probe https SrvCat_HTTPS_7243_probe
description Service Catalog HTTPS probe on port 7243
port 7243
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
header User-Agent header-value "Mozilla/4.0"
probe https SrvCat_HTTPS_7343_probe
description Service Catalog HTTPS probe on port 7343
port 7343
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
header User-Agent header-value "Mozilla/4.0"
probe https SrvCat_HTTPS_7443_probe
description Service Catalog HTTPS probe on port 7443
port 7443
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
header User-Agent header-value "Mozilla/4.0"
probe http SrvCat_HTTP_7180_Probe
description Service Catalog HTTP probe on port 7180
port 7180
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
probe http SrvCat_HTTP_7280_probe
description Service Catalog HTTP probe on port 7280
port 7280
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
probe http SrvCat_HTTP_7380_probe
description Service Catalog HTTP probe on port 7380
port 7380
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302
probe http SrvCat_HTTP_7480_probe
description Service Catalog HTTP probe on port 7480
port 7480
interval 15
passdetect interval 5
passdetect count 2
expect status 200 302

parameter-map type connection for_switch_mode
set timeout inactivity 300

rserver host was61nstga
ip address 192.168.96.94
inservice
rserver host was61nstgb
ip address 192.168.96.102
inservice

serverfarm host SrvCat_HTTPS_ServerFarm
rserver was61nstga 7143
    probe SrvCat_HTTPS_7143_Probe
    inservice
rserver was61nstga 7243
    probe SrvCat_HTTPS_7243_probe
    inservice
rserver was61nstga 7343
    probe SrvCat_HTTPS_7343_probe
    inservice
rserver was61nstga 7443
    probe SrvCat_HTTPS_7443_probe
    inservice
rserver was61nstgb 7143
    probe SrvCat_HTTPS_7143_Probe
    inservice
rserver was61nstgb 7243
    probe SrvCat_HTTPS_7243_probe
    inservice
rserver was61nstgb 7343
    probe SrvCat_HTTPS_7343_probe
    inservice
rserver was61nstgb 7443
    probe SrvCat_HTTPS_7443_probe
    inservice
serverfarm host SrvCat_HTTP_ServerFarm
rserver was61nstga 7180
    probe SrvCat_HTTP_7180_Probe
    inservice
rserver was61nstga 7280
    probe SrvCat_HTTP_7280_probe
    inservice
rserver was61nstga 7380
    probe SrvCat_HTTP_7380_probe
    inservice
rserver was61nstga 7480
    probe SrvCat_HTTP_7480_probe
    inservice
rserver was61nstgb 7180
    probe SrvCat_HTTP_7180_Probe
    inservice
rserver was61nstgb 7280
    probe SrvCat_HTTP_7280_probe
    inservice
rserver was61nstgb 7380
    probe SrvCat_HTTP_7380_probe
    inservice
rserver was61nstgb 7480
    probe SrvCat_HTTP_7480_probe
    inservice

sticky http-cookie JSESSIONID HTTP_Stickyness
timeout 720
replicate sticky
serverfarm SrvCat_HTTP_ServerFarm
sticky http-cookie JSESSIONID HTTPS_Stickyness
timeout 720
replicate sticky
serverfarm SrvCat_HTTPS_ServerFarm
sticky ip-netmask 255.255.255.255 address source SrvCat-IP-Sticky
timeout 20
replicate sticky
serverfarm SrvCat_HTTP_ServerFarm
sticky ip-netmask 255.255.255.255 address source SrvCat-HTTP-IP-Sticky
timeout 20
replicate sticky
serverfarm SrvCat_HTTP_ServerFarm
sticky ip-netmask 255.255.255.255 address source SrvCat-HTTPS-IP-Sticky
timeout 20
replicate sticky
serverfarm SrvCat_HTTPS_ServerFarm

class-map match-any VIP-SrvCat-HTTPS
3 match virtual-address 165.115.xxx.yyy tcp eq https
class-map match-any VIP-SrvCat-WWW
2 match virtual-address 165.115.xxx.yyy tcp eq www

policy-map type loadbalance http first-match SrvCat-HTTP-LoadBalance-Policy
class class-default
    sticky-serverfarm SrvCat-HTTP-IP-Sticky
policy-map type loadbalance http first-match SrvCat-HTTPS-LoadBalance-Policy
class class-default
    sticky-serverfarm SrvCat-HTTPS-IP-Sticky
policy-map type loadbalance http first-match SrvCat-LoadBalance-Policy
class class-default
    sticky-serverfarm SrvCat-IP-Sticky

policy-map multi-match SLB-SrvCat-Policy
class VIP-SrvCat-HTTPS
    loadbalance vip inservice
    loadbalance policy SrvCat-HTTPS-LoadBalance-Policy
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    connection advanced-options for_switch_mode
class VIP-SrvCat-WWW
    loadbalance vip inservice
    loadbalance policy SrvCat-HTTP-LoadBalance-Policy
    loadbalance vip icmp-reply active
    loadbalance vip advertise active
    connection advanced-options for_switch_mode
class class-default
    connection advanced-options for_switch_mode

interface vlan 859
ip address 172.16.166.85 255.255.255.240
alias 172.16.166.84 255.255.255.240
peer ip address 172.16.166.86 255.255.255.240
access-group input anyone
access-group output anyone
service-policy input remote_management_allow_policy
service-policy input SLB-SrvCat-Policy
no shutdown

Surya ARBY · ‎03-17-2011

but the problem is that the cookie is not present in the packets until a login to the app happens.

It's expected as the cookie you want to track is only created in the application when the user logs in, it's related to the session within the app.

Try this type of persistance :

sticky http-cookie HTTP_ACE_INSERT HTTP_Stickyness
 cookie insert browser-expire
 replicate sticky
 serverfarm SrvCat_HTTP_ServerFarm

policy-map type loadbalance http first-match SrvCat-HTTP-LoadBalance-Policy
  class class-default
    sticky-serverfarm HTTP_Stickyness

For the HTTPS part, no L7 persistence available as you don't perform SSL termination on the ACE, only source ip persistence is accurate.

Surya ARBY · ‎03-18-2011

Any update ?