CirrostratusLoadbalancing a 2-stage proxy environment - persistence problems
Hello fellow F5-experts,
My situation:I try to loadbalance Web-Proxy traffic. In genenal it seems to work, but we've run into some problems relating to websites with weird session handling. I sketched up the environment in the following Image
A clients uses VS-A as it's HTTP proxy. This VS loadbalances to two of our own proxies in Pool A. Those are not transparent, so outgoing traffic toward their upstream proxy (VS-B) will have the Pool A node's IP as source address. The Proxies use the HTTP: Connect method.
VS-B on the other hand, has a Pool B attached with a lot (as in really a lot) other proxy servers, that are not under our control (but are trustworthy, and have to be used. No way around it).
VS-A:
- Type Standard
- HTTP-Profile: http-transparent (to be able to use LB method Fastest (node))
- Source Address Translation: none
- Default Persistence Profile: source_addr
Pool A:
- LB Method: Fastest (node)
VS-A:
- Type Standard
- HTTP-Profile: http-transparent (to be able to use LB method Fastest (node))
- Source Address Translation: SNAT
- Default Persistence Profile: none
Pool B:
- LB Method: Fastest (node)
On some websites, people complain about loosing their sessions. I tracked it down to the VS-B, which can not persist connections to a website to the same node in Pool B. Since the VS-B does not see the original client IP, but only the 2 proxy IP's I have no idea how to establish a propper persistence. For a very important website, i wrote an iRule that "hard-binds" to a single Node in Pool B, based on the HTTP:URI.
My question:Is my config any viable? Or what should I change? I read a lot of article here, but I never had the feeling, that those met my situation with the "2-stage" proxy environment. I was thinking about adding a http header with the original client IP by an iRule in VS-A so I have something to make a persistence decision in VS-B, but I'm not sure how to do that. I also often read about applying the OneConnect profile combined with proxy loadbalancing, but I don't think I really understood the reason and/or benefit, nor do I know where to apply it in this environment.
I hope I made it some kind of clear what I try to accomplish and where the problems are, since English is not my mother language and I'm a but rusted using it.
Any help or hint is very much appreciated.
Thanks in advance,
ichnafi
EDIT:(28th Feb)
I just found out, that the desired website can be acquired from the HTTP::host header even by Vs-B. So would it be possible to establish a persinstence for the combination client IP and HTTP::host header?
EDIT2: Possible Solution found (1st Mar)
I currently endet up with an iRule creating a universal persistence based on the http::host header. the iRule is then bound to a universal Persistense-Profile. The iRule looks lilke this:
when HTTP_REQUEST {
persist uie [HTTP::host]
}
I'm thinking of maybe creating a custom header that contains a combination of client_ip and http:host value to get an even more definite persistence, but not quite sure about that. What do you guys think?
