Disconnections when running through the CSS

[mj11]

Hi

I am having trouble with an application running through a CSS . There are application disconnections when running through the CSS.If I access the application server directly then I don't have any problems.The issue seems to be around TCP timeouts. The server involved is Windows 2008R2 and is running as and Exchange 2010 Client Access Server.

These are the services on the CSS that are affected:

Name: CAS01_SSL Index:

Type: Local State: Alive

Rule ( 10.10.97.116 ANY ANY )

Session Redundancy: Enabled

Redundancy Global Index: 280

Redirect Domain:

Redirect String:

Keepalive: (TCP-443 5 3 5 )

Keepalive Encryption: Disabled

Last Clearing of Stats Counters: 06/22/2012 18:25:00

Mtu: 1500 State Transitions: 180

Total Local Connections: 2755075 Total Backup Connections: 0

Current Local Connections: 318 Current Backup Connections: 0

Total Connections: 2755075 Max Connections: 65534

Total Reused Conns: 0 Weight Reporting: None

Weight: 1 Load: 36

　

　

Name: CAS02_SSL Index:

Type: Local State: Alive

Rule ( 10.10.97.117 ANY ANY )

Session Redundancy: Enabled

Redundancy Global Index: 281

Redirect Domain:

Redirect String:

Keepalive: (TCP-443 5 3 5 )

Keepalive Encryption: Disabled

Last Clearing of Stats Counters: 06/22/2012 18:05:12

Mtu: 1500 State Transitions: 142

Total Local Connections: 2357054 Total Backup Connections: 0

Current Local Connections: 34 Current Backup Connections: 0

Total Connections: 2357054 Max Connections: 65534

Total Reused Conns: 0 Weight Reporting: None

Weight: 1 Load: 24

Sh ver of the device:

CSS01# sh ver

Version: sg0820402 (08.20.4.02)

Flash (Locked): 07.50.1.03

Flash (Operational): 08.20.4.02

Type: PRIMARY

Licensed Cmd Set(s): Standard Feature Set

Regards MJ

[mwinnett]

Looks like the CSS is termnating ssl to the client and then (I guess)  running clear text between the CSS backend and the server. This means  two distinct TCP connections either side of the CSS. If the  client-server connection that bypasses the CSS uses TCP keepalives then  no data packets are sent between client and server but a zero length  packet with a sequence number one less than the current value that  elicits a response with the correct value. This keepalive (having no  data) will not be passed through the CSS but will be handled locally.  Assuming that the CSS is timing out the connection, you can configure "flow-timeout-multiplier 0"

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.20/command/reference/CmdGrpC.html#wp1139589

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.20/command/reference/CmdOwCnt.html#wp1140473

If this doesn't help, you will need to trace both sides to try and determine which side is tearing down the connection.

Matthew