Forum Discussion

irbk's avatar
irbk
Icon for Cirrus rankCirrus
Oct 06, 2023

Persistence profile with non-http traffic, zscaler, and SSL Passthrough

My latest roadblock is figuring out how to set up persistence when you can't use just about any of the persistance profiles.  F5 LTM is going to be load balancing Microsoft Navision traffic across a server pool.  The way Navision is setup is it's doing TCP and TLS communication to the cilent app via 7246.  According to what I've learned in an early forum post, the F5 can't have TCP and TLS traffic on the same port, so I can't use SSL bridging, I have to use "Performace (Layer 4)" and just use SSL Passthrough.  That's fine, it works.  Now the problem is persistance.  We use zScaler for our VPN/ZTNA.  For all of our remote clients, the F5 essentially sees all the traffic as coming from our zScaler collector.  Since the F5 sees all traffic as coming from, for example, 172.20.20.72 all the traffic is "load balanced" to the same server if we try to use source address.  Same would be true for destination address.  Cookie doesn't work becaue it's not HTTP traffic, MSRDP doesn't work because it's not RDP traffic, host doesn't work because it's not HTTP traffic, and the list goes on.  I'm sure we can't be the only company using an F5 with zScaler so I'm sure someone else has the same issue?  How did you overcome it?  I think my answer may be using Hash or Universal but I don't understand iRules yet.  I'm looking at them but it's not so straight forward.  I think I should be able to create an iRule that would take the source IP and source port to create the persistence profile, but I lack any understanding of iRules at the moment.

application delivery
LTM
zscaler

4 Replies

Sort By
  • irbk's avatar
    irbk
    Icon for Cirrus rankCirrus
    Oct 06, 2023

    I found this in another forum post, perhaps this is the right answer?

    when CLIENT_ACCEPTED {
 set client_remote "[IP::client_addr]:[TCP::client_port]"
 persist hash ($client_remote) 300
  log local0. "Connection: Client($client_remote)"
}
  • irbk's avatar
    irbk
    Icon for Cirrus rankCirrus
    Oct 11, 2023

    For anyone else that may stumble across this, this is what we ended up using

    when CLIENT_ACCEPTED { 

    if {[TCP::client_port] and [IP::client_addr] !=0} { 

        persist uie "[IP::client_addr]:[TCP::client_port]" 

    } 

}