Hello All, Appreciate your help on the requirement ,, Two sites with HTTP, HTTPS, and alt-HTTP proxying-services (StateFul flow) might have asymmetric traffic-flow which will break the established sessions. I think of building two iRules (Internal & External) which will do the following: Internal iRule: set some flag on the sessions initiated by the proxy-server; i.e tag "Local-Site". External iRule: Check the manipulated-flag, if the tag is matching "Remote-Site", forward the traffic to a specific gateway_pool. If the above logic and iRule works, I would like to know: which flag can be used to fulfill the requirement, and whether changing this flag would cause any issue from the application layer perspective. any expected performance-degradation by applying this simple iRule on +60Gbps traffic-volume. (LTM v11) Thanks & BR, Aziz

Does this help? Sounds like nPath (aka direct server return) http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_implementations_guide_10_1/sol_npath.html

Thanks for your response ,, I don't think it would work, as per my quick reading and understanding, the nPath solution is to bypass servers responses from getting back to the BIG-IP. I have Internet-Proxies behind my LTMs in both sites to serve the customers transparently, and each proxy will use the same customer IP to reach Internet. I was thinking if there is any method we can manipulate on http headers for example (of course not applicable for HTTPS) as most of the services configured on the LTMs are HTTP or alt-HTTP; i.e 80, 8000, 8008, 8080, etc. If we can manipulate http header by someway to stamp the packet with a specific value "Site-ID", and make sure this stamp/mark will not be overridden by any web server in the Internet, I believe this will do the job. Thanks & BR, Aziz

OK I just saw "asymmetric traffic-flow" without reading much further. I don't really understand what you are trying to do, however in general an HTTP request header insertion is a good way to signal to downstream VIPs or HTTP devices.

Hi, two ideas come to my mind: 1) is it feasible to use cookies for session persistence, as you just use http? 2) basically you can create and insert a custom http header with an iRule. You could insert the client IP or a random number with "HTTP::header insert " and write it into the header with: [HTTP::header cheers, wizz

Thank you all for your inputs ,, really valuable ,, So, couple of things I would like to confirm: - Would "HTTP::header insertion" method be applicable for HTTP and alt-HTTP services; i.e 80, 8080, 8000, etc. - Whether this HTTP insertion would be overridden by any web server ? or it will be there for the whole session. - Provide an iRule example; one to insert a random number, and the other to match that random number. - Is there any other idea that would be applicable for HTTPS ? personally I don't think so. Thanks & BR, Aziz

HTTP/HTTPS Asymmetric-Routing iRule

26 Replies

IheartF5_45022
Nacreous
Apr 16, 2014
Does this help? Sounds like nPath (aka direct server return) http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_implementations_guide_10_1/sol_npath.html
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  Thanks for your response ,, I don't think it would work, as per my quick reading and understanding, the nPath solution is to bypass servers responses from getting back to the BIG-IP. I have Internet-Proxies behind my LTMs in both sites to serve the customers transparently, and each proxy will use the same customer IP to reach Internet. I was thinking if there is any method we can manipulate on http headers for example (of course not applicable for HTTPS) as most of the services configured on the LTMs are HTTP or alt-HTTP; i.e 80, 8000, 8008, 8080, etc. If we can manipulate http header by someway to stamp the packet with a specific value "Site-ID", and make sure this stamp/mark will not be overridden by any web server in the Internet, I believe this will do the job. Thanks & BR, Aziz
IheartF5_45022
Nacreous
Apr 16, 2014
OK I just saw "asymmetric traffic-flow" without reading much further.

I don't really understand what you are trying to do, however in general an HTTP request header insertion is a good way to signal to downstream VIPs or HTTP devices.
Manuel_60430
Nimbostratus
Apr 16, 2014
Hi,

two ideas come to my mind:

1) is it feasible to use cookies for session persistence, as you just use http?

2) basically you can create and insert a custom http header with an iRule. You could insert the client IP or a random number with "HTTP::header insert " and write it into the header with: [HTTP::header

cheers, wizz
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  Thank you all for your inputs ,, really valuable ,, So, couple of things I would like to confirm: - Would "HTTP::header insertion" method be applicable for HTTP and alt-HTTP services; i.e 80, 8080, 8000, etc. - Whether this HTTP insertion would be overridden by any web server ? or it will be there for the whole session. - Provide an iRule example; one to insert a random number, and the other to match that random number. - Is there any other idea that would be applicable for HTTPS ? personally I don't think so. Thanks & BR, Aziz
Manuel_60430
Nimbostratus
Apr 16, 2014
Alright, let's go through your points:

1) you can insert http headers as long as the protocol is http, no matter if you use the standard tcp port 80 or anything else

2) if you use a custom http header field the web server should not modify it at all. maybe if you use something like the X-Forwarded-For header field it could be used and adapted by web servers for different reasons

3) Unfortunately I'm not the greatest programmer, but I can think about this. Maybe someone from the community could do his magic? :-)

4) do you perform SSL offloading on the BigIP? Otherwise it will be tricky. Depending on how much https traffic you are facing, you could balance all https traffic through one path (but I'm not sure if you can apply automatic failover in this case) or you could use session cookies. Of course if the client or browser do not support cookies this will not work either. Maybe for https session cookie with fallback to source IP can be applicable.

cheers, wizz
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  Thanks Wizz for the information ,, We're not doing SSL offloading, hence, I think it's not possible. If I cover HTTP traffic by this iRule it would be great. Hopefully someone will help us on this. BR, Aziz
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  mmm ,, this won't work as the connection establishment or TCP-only control packets won't be applicable for this HTTP::header insertion. However, there is another way I'm thinking of, which would solve the issue. Is the iRule capable of tracking the active connection through LTM; i.e if the connection is active, then proceed with normal bahvior; if not (which means it reached the wrong LTM), then take X action. Thanks & BR, Aziz
- Manuel_60430
  Nimbostratus
  Apr 16, 2014
  sorry I don't really get the point with "TCP-only control packets". Do you perform only tcp load balancing? Basically you can refer to tcp statements, as well as to http in iRules - everything is possible :-) I'm just not sure, if this will solve your problem, but anyway you can have a look at this documentation: https://clouddocs.f5.com/api/irules/TCP.html best regards
nitass_89166
Noctilucent
Apr 16, 2014
just wondering what http/https asymmetric routing means.

is it something like one user sending requests to both sites (e.g. request1/response1 goes to site1 but request2/response2 goes to site2)?
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  Hello, No, it's asymmetric in the Egress-Flow (From the end-user to Internet) and Ingress-Flow (From the Internet to end-user). The Egress traffic (upload) is going to one site, and the Ingress traffic (download) is going to a different site. This is correct under some failure scenario in the network. Note that; this is all transparent to the end user. Both sites have Proxies behind the LTM; so from the networking part I can get the traffic back to the right site by an idea but I'm not sure if I can achieve it through an iRule. I need the LTM to check the Ingress-Traffic if it comes from specific source-ports and this traffic is not showing in the connection-table, then it will forward the traffic to another pool. Thnx, Aziz
nitass
Employee
Apr 16, 2014
just wondering what http/https asymmetric routing means.

is it something like one user sending requests to both sites (e.g. request1/response1 goes to site1 but request2/response2 goes to site2)?
- Gbps_31870
  Nimbostratus
  Apr 16, 2014
  Hello, No, it's asymmetric in the Egress-Flow (From the end-user to Internet) and Ingress-Flow (From the Internet to end-user). The Egress traffic (upload) is going to one site, and the Ingress traffic (download) is going to a different site. This is correct under some failure scenario in the network. Note that; this is all transparent to the end user. Both sites have Proxies behind the LTM; so from the networking part I can get the traffic back to the right site by an idea but I'm not sure if I can achieve it through an iRule. I need the LTM to check the Ingress-Traffic if it comes from specific source-ports and this traffic is not showing in the connection-table, then it will forward the traffic to another pool. Thnx, Aziz
nitass
Employee
Apr 17, 2014
No, it's asymmetric in the Egress-Flow (From the end-user to Internet) and Ingress-Flow (From the Internet to end-user). The Egress traffic (upload) is going to one site, and the Ingress traffic (download) is going to a different site.

i assume it is like syn is going to one site but syn/ack is going to another.

there are loose initiation and loose close in fastl4 profile.

The FastL4 profile determines how the system handles the connection table entries. Enabling the Loose Initiation option allows the system to initialize a connection when it receives any TCP packet, rather than requiring a SYN packet for connection initiation. The Loose Close option allows the system to remove a connection when the system receives the first FIN packet from either the client or the server.

sol7595: Overview of IP forwarding virtual servers
http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html
anyway, i am thinking how we can differentiate between the first correct-site request and the wrong-site request? after receiving the wrong-site request, bigip will add it into connection table as well. that means in connection table, it will contain both correct-site and wrong-site connections.
- Gbps_31870
  Nimbostratus
  Apr 17, 2014
  That's exactly what I'm looking for ,, initially i thought it's something straight forward using iRule but it's not. It's getting complicated as the new VS i have created (AR_VS:0.0.0.0:0) with both loose initiation/close enabled seems to cover some established sessions through the LTM; i.e with no asymmetric routing. For the point you raised that wrong connection will be moved to conn-table, i think it could be overcome if they persist with GW_Pool we are forwarding to ( still I'm not sure). But why this new VS covers some established connections and how can we eliminate this. LTM VSs as following: 0.0.0.0:80 ( external) 0.0.0.0:443 (external) 0.0.0.0:8080 (external) 0.0.0.0:0 (internal - forwarding) Note that most of the sessions covered by the new VS are part of the forwarding_VS on internal vlan. Thnx for help, Aziz
- Gbps_31870
  Nimbostratus
  Apr 17, 2014
  Would the fact that forwarding VS doesn't build/maintain any connection in conn-table the reason behind these hits on the iRule? If yes, I would replace it with Performance (L4) VS. Aziz
nitass_89166
Noctilucent
Apr 17, 2014
No, it's asymmetric in the Egress-Flow (From the end-user to Internet) and Ingress-Flow (From the Internet to end-user). The Egress traffic (upload) is going to one site, and the Ingress traffic (download) is going to a different site.

i assume it is like syn is going to one site but syn/ack is going to another.

there are loose initiation and loose close in fastl4 profile.

The FastL4 profile determines how the system handles the connection table entries. Enabling the Loose Initiation option allows the system to initialize a connection when it receives any TCP packet, rather than requiring a SYN packet for connection initiation. The Loose Close option allows the system to remove a connection when the system receives the first FIN packet from either the client or the server.

sol7595: Overview of IP forwarding virtual servers
http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html
anyway, i am thinking how we can differentiate between the first correct-site request and the wrong-site request? after receiving the wrong-site request, bigip will add it into connection table as well. that means in connection table, it will contain both correct-site and wrong-site connections.
- Gbps_31870
  Nimbostratus
  Apr 17, 2014
  That's exactly what I'm looking for ,, initially i thought it's something straight forward using iRule but it's not. It's getting complicated as the new VS i have created (AR_VS:0.0.0.0:0) with both loose initiation/close enabled seems to cover some established sessions through the LTM; i.e with no asymmetric routing. For the point you raised that wrong connection will be moved to conn-table, i think it could be overcome if they persist with GW_Pool we are forwarding to ( still I'm not sure). But why this new VS covers some established connections and how can we eliminate this. LTM VSs as following: 0.0.0.0:80 ( external) 0.0.0.0:443 (external) 0.0.0.0:8080 (external) 0.0.0.0:0 (internal - forwarding) Note that most of the sessions covered by the new VS are part of the forwarding_VS on internal vlan. Thnx for help, Aziz
- Gbps_31870
  Nimbostratus
  Apr 17, 2014
  Would the fact that forwarding VS doesn't build/maintain any connection in conn-table the reason behind these hits on the iRule? If yes, I would replace it with Performance (L4) VS. Aziz
nitass
Employee
Apr 18, 2014
But why this new VS covers some established connections and how can we eliminate this.

i understand it creates entry in connection table unless we set immediately idle timeout. in that case, we need 2 virtual servers; one handles request and the other one handles reply.
Gbps_31870
Nimbostratus
Apr 18, 2014
What if we apply two iRules; one in the forwarding_VS (internal) and other on the new Perf_VS with FastL4 profile (External). I didn't get your point in your last post; but mostly the traffic subject to Asyemmetric routing is the reply traffic (Internet to LTM).

iRule1 (internal)

when CLIENT_ACCEPTED { set Bypass 1 log local0. “EST_CON IP: [IP::client_addr] TCP: [TCP::client_port]” }

iRule2 (external)

when CLIENT_ACCEPTED { if {$Bypass == 1} { return } elseif { switch -glob [TCP::local_port] { "80" - "443" - "8080" {pool AR-GW log local0. “AR_CON IP: [IP::client_addr] TCP: [TCP::client_port]” } } } else { drop log local0. “DR_CON IP: [IP::client_addr] TCP: [TCP::client_port]” }

}

Thnx, Aziz