Thanks Gilles, What do you mean by "you'll lose stickyness with this command"? ...SSL stickiness will no longer work if I configure the "ssl-l4-fallback disable" command? The option to use the SSL module with cookie stickyness was my initial configuration, however, performance of HTTPS traffic actually degraded (web page load times were slower) when I tried to use the SSL module to off-load the SSL traffic from the web servers. So we're stuck with using SSL sticky for now. ... View more

Hi Gilles, My thought is that Jon's initial error was maybe caused by the fact that he had no default policy configured... (maybe the SAP application forced "GET" requests to other URL's not accounted for in Jon's maps)... Could Jon's original *fix* using the "no persistance rebalance" be explained by the fact that this command forces the CSM to ignore all subsequent HTTP GET commands for an already "sticked" connection? Thanks, Daniel ... View more

Salut Gilles, You mention that "the CSM starts counting when the connection is open [not when it's closed]"... but that conflicts with what I read in the online command reference: "...If you specify a nonzero value, the last real server that was used for a connection from a client is remembered for the sticky-time value after the end of the client's latest connection." I need to configure sticky based on source IP and want it to timeout 2 hours after the end of the connections (not 2 hours after the start). Will I achieve this with the following? sticky 1 netmask /32 address source timeout 120 Thanks in advance! Daniel ... View more

SSL keepalive will have to do then! Thanks Gilles. ... View more

Hi Gilles, Can you confirm that encrypted (HTTPS) keepalives are not suppoorted if I don't have the SSL module? This is for a CSS11503 running 7.50.1.03. The service in this case is strictly for HTTPS traffic only. Thanks, Dan ... View more

Hi Alex, (I'm a CSS guy too!) Have you investigated the actual SSL session ID's being used for that particular client when this error occurs? We had a problem with very similar symptoms and had to use a Sniffer in order to find the root cause. Our servers (I think they were IPlanet too, running on Linux) were not handling the SSL session-id "re-use" option properly. They were instead providing a bran new SSL session-id each time the client would send a SSL "re-negotiation handshake" (I'm not sure about terminology here!). In our case, we saw this happenning every 90 seconds, causing the clients to bounce from server to server because the CSS would not find a match in its SSL-sticky table and load-balancing would therefore take effect and cause the client to end up on a different server (similar to what you are reporting). Unfortunately, in our case (also) we were unable to resolve this server issue and we resorted to src-sticky. Good luck! Dan ... View more

I see you have configured "advanced-balance ssl"... Have you investigated the SSL session ID's being used for that particular client during all that time (month)? Your servers could be "re-using" the same SSL session ID for this client over and over indefinitely (a month)? I have seen the opposite situation where the server was not handling the SSL session-id "re-use" option properly. Our servers were instead providing a bran new SSL session-id for the clients every 90 seconds, causing the clients to bounce from server to server because the CSS would not find a match in its SSL-sticky table and load-balancing would therefore take effect and cause the client to end up on a different server. ... View more

We have run into this issue also. For a few months there were no problems and then boom! DNS responses started dropping at the CSS. The problem would temporarily go away if we either recycled the DNS service on the back-end server or if we manually cleared the FCB on the CSS (i.e.: first determine the flow id number in HEX using the "flow-agent show active_fcbs tuple ..." debug-mode command and then issue the debug-mode command: flow-agent action kill_fcb 0x########). The recycling of the DNS service on the web server causes a new random UDP source port to be used by the server for future DNS queries, which forces the CSS to create a bran new (working) FCB. I have a few questions about this issue: Why does the CSS not have this flow state disabled by default for DNS? Why did this start failing on us only now? Could this be because the server is now sending generating a lot more DNS traffic than it originally was in the past, which causes the UDP53 flow to remain active for too long and preventing the "flow garbage collection" process from kicking in? If so is there a known threshold for UDP flows to explain the break-down point (i.e.: a maximum number of packets or bytes for a given UDP flow or a maximum time that a a given UDP flow can be sustained? Thanks in advance, Daniel ... View more

I will. Thanks. I appreciate your feedback. Daniel Cayer (EDS Canada) ... View more

the result of setting syssoft to debug was over 380 lines logged, almost all saying: NOV 1 08:48:47 1/1 131148 SYSSOFT-7: Communications-QUEUE FULL-Ipv4SlaveArpTx: Message (IMM:Base Class-BMAN_TID, Identifier-0) from 1/1 (this CSS) failed to reach destination 'Ipv4SlaveArpTx' on 1/1 (this CSS) The 1/1 interface is my ISC (Sync) port to the standby CSS. looking closer at the log file, I also see a few service transition messages as follows: NOV 1 08:49:01 1/1 131150 NETMAN-2: Enterprise:Service Transition:test -> down There is nothing else in the log file. I have put the logging level back to level-6 (info). I will next proceed to compare the configs of both CSS to ensure I don't have an error in my redundant-index settings (ASR) and I will try to paste the output of the "script play showtech" in the Cisco Output Interpreter to see if it can provide any insight into this problem. I will also consider upgrading WebNS. Thanks, Daniel Cayer (EDS Canada) ... View more

I've had the same problem and found it was due to a known software bug with having the interface locked at 100-Full. Setting it to AUTO was a work-around. Good luck, Daniel ... View more