Forum Discussion

Christopher_Hyl's avatar
Christopher_Hyl
Icon for Nimbostratus rankNimbostratus
May 05, 2011

True-IP persistence or source-IP if it doesn't exsist.

This is a basic derivative of the irule in the last post .

 

It's a long story of why we're doing this, but we're using a CDN that passes us the "true-client-ip" HTTP header. We want source persistence to our pool with this variable, but sometimes we get traffic that will not be from the CDN. We want source-ip based persistence to our back-end pool in these cases.

 

 

Will this do the trick? Is there a more efficient/better way?

 

 

when HTTP_REQUEST {

 

if {[HTTP::header exists "True-Client-IP"]}{

 

set tcip_header [HTTP::header "True-Client-IP"]

 

} else { set tcip_header [IP::remote_addr] }

 

if {[active_members Onlinebrands_http_real_server]}{

 

if {[scan [lindex [active_members –list app_http_pool] [expr {[md5 $tcip_header] % [active_members app_http_pool]}]] {%s %s} ip port] == 2}{

 

pool app_http_pool member $ip $port

 

return

 

}

 

}

 

}

 

application delivery
dev
devops
iRules

16 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    May 05, 2011
    Hi Christopher,

     

     

    That iRule does a hash on the cleint IP to select a pool member. You could do that. Another option would be to let LTM make the load balancing decision using the algorithm specified on the pool and then use persist uie to ensure clients get back to the same pool member. You'd basically replace the scan and pool command with persist uie $tcip_header 3600:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/persist

     

     

    Either method should work, but I'd guess the default load balancing method and UIE persistence will be a bit more efficient in terms of CPU utilization.

     

     

    Aaron
  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 05, 2011
    Hi Aaron,

     

    Many thanks for your insight.

     

     

    So like this?

     

     

     

    when HTTP_REQUEST {

     

    if {[HTTP::header exists "True-Client-IP"]}{

     

    set tcip_header [HTTP::header "True-Client-IP"]

     

    } else { set tcip_header [IP::remote_addr] }

     

    if {[active_members Onlinebrands_http_real_server]}{

     

    persist uie $tcip_header 3600

     

    return

     

    }

     

    }

     

    }
  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 05, 2011
    Actually, this one would be better as it grabs the pool that's assigned to the VIP and I can now be used across multiple VIPs with a single irule. This should help users like me who use CDNs like akamai or limelight. 

    
when HTTP_REQUEST {
     set default_pool [LB::server pool]
     if {[HTTP::header exists "True-Client-IP"]}{
          set tcip_header [HTTP::header "True-Client-IP"]
     } else { set tcip_header [IP::remote_addr] }
     if {[active_members $default_pool]}{
          persist uie $tcip_header 43200
          return
     }
}
  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    May 05, 2011
    Just keep in mind that LB::server will only return info about the default pool, or after an LB decision. It looks like it should be fine where you're using it, but it gets some people into trouble thinking they can use it to tell information about the server that's going to be chosen, which isn't how it works.

     

     

    Colin
  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 05, 2011
    Colin,

     

     

    We don't care which one it goes to for our needs (so long as it's active it's fine), but thanks for the warning.
  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    May 05, 2011
    Cool, it didn't look like it mattered in your scenario but I figured as a word of warning for others reading it wouldn't hurt. ;)

     

     

    Colin
  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 06, 2011
    Hmmm, it doesn't look like it's working on our test website. It's not even falling back to source persistence. Am I supposed to be checking if a persistence profile already exists before assigning one in the variable? Am I clobbering already existing persistence assignments? Should I be doing what they're doing here:

     

    http://devcentral.f5.com/Forums/tabid/53/aft/61948/Default.aspx

     

     

    Which has this block of code:

     

     

    when HTTP_REQUEST { 

 Check if there is an existing UIE persistence record 
if {[persist lookup uie "[IP::client_addr]_apps"] ne ""}{ 

 Use the existing UIE persistence record regardless of which URI was requested 
persist uie "[IP::client_addr]_apps"] 36000 

} else { 

 Check requested path 
switch -glob [HTTP::path] { 
"/apps/aml/*" { 
 Persist client for 10 hours using client IP _ apps 
persist uie "[IP::client_addr]_apps" 36000 
} 
default { 
 Persist client for 1 hour 
persist source_addr 3600 
} 
} 
} 
}

     

     

     

    I'm speculating I need that first line of code?

     

  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 06, 2011
    Or maybe I need to enable Universal persistence? I assumed that the irule was enough... (sorry, I'm new to irules!).

     

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    May 06, 2011
    You don't need a UIE persistence profile if you're setting the timeout in the persist command in the rule and don't need to use the match across or mirror options of the UIE profile.

     

     

    Can you add logging to the iRule you're testing and reply with the output?

     

     

    Aaron
  • Christopher_Hyl's avatar
    Christopher_Hyl
    Icon for Nimbostratus rankNimbostratus
    May 06, 2011
    I've attached the irule to the persistence profile and the persistence profile to the VIP, but it's still not working. It seems to be passing them almost round-robin.

    Here is the log entry I added:

    log local0. "HTTP setting persist to: $tcip_header CDN-IP: [IP::remote_addr]"

    Here is the Log output for our office's ip (office IP has been changed to 1.2.3.4) the external ips are our CDN's egress (they bounce around a lot!): 

     May  6 12:24:21 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:21 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:21 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:23 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:24 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:24 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:24 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:24 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:26 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:26 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:26 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:26 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:26 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:28 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:29 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:29 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:29 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:29 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:31 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:31 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:31 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:31 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:31 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:33 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:34 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.179
May  6 12:24:34 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:34 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:34 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:36 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181
May  6 12:24:36 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.182
May  6 12:24:36 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:36 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:36 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.180
May  6 12:24:38 tmm tmm[1715]: Rule persistenceiRule : HTTP setting persist to: 1.2.3.4 CDN-IP: 208.111.181.181