Forum Discussion

Jozef_Hamar's avatar
Jozef_Hamar
Icon for Altostratus rankAltostratus
Mar 27, 2019

Can I prevent VS to send RST in case there are no active members in associated pool?

Hi guys,

 

recently we hit an interesting scenario during a migration: we had a VS for an application with hundreds of clients with no pool member being active, yet. LTM started to send TCP Resets to clients trying to reach the VS. The bad thing was that the clients were stubbornly trying again and again right after they received RST, resulting in tens of SYN-RST pairs per client per second. This multiplied quickly and took down another device along the path.

 

The question is, can I change the behavior of the F5 and prevent it to send RST to every SYN it receives? The presumption is that even if clients will try again and again, it won't be tens requests per client per second, but every client shall send one SYN after timeout of few seconds.

 

Note: I can, of course, solve this outside of the F5. This question is, nevertheless, related to whether it can be done on the F5 directly.

 

Thank you.

 

Jozef

 

4 Replies

  • You can choose just to drop the traffic if there are no available pool members. Don´t know if that solves your issue.

     

  • Hey Squeak,

     

    you cannot do that on the Pool. You can do that on Pool member, but I do not want manually alter Pool member settings. Even disabling the VS does not work. So far while testing, the only thing that worked for me was to change the VS type from Standard to Performance L4.

     

  • You can also configure an iRule that serves a "Sorry, no service" page if all the pool members are down as shown here.

     

  • In the virtual server you have the "Immediate Action On Service Down" option, have you tried using it as "DROP"?