Cirrus
CirrusHello,
For reference here is the OneConnect Overview article.
The article makes it clear, the F5 does not select a pool member based on available idle connections, it selects a pool member based on the load balancing algorithm.
OneConnect selection processIt is possible to override the default OneConnect re-use behavior via iRule and/or db setting
sys db tmm.http.oc.droponerrorThe mask on the OneConnect profile only applies to the server-side connection. If you SNAT all connections to a single address, the mask on the OneConnect profile for all intents and purposes is irrelevant.
Your scenarioIn your round-robin scenario, the requests that come into the F5 will be balanced round-robin on a per-request basis.
As long as you don't have persistence:If you want to test the behavior, you could try these steps:
If you capture with noise and view in Wireshark with the F5 plugin, you can see which client-side connections are associated with the server-side connections.
Reducing connectionsIt is true, OneConnect can be used to reduce server-side TCP connections. However, it is important to keep the end goal in mind: performance.
The load balancing algorithm on the F5 is one of the tools F5 provides to put you in control of load distribution. I don't think of OneConnect as a way to "reduce server-side connections handled by the F5", the F5 is more than capable of handling lots of server-side connections.
OneConnect is another tool that works in concert with your load balancing algorithm. It allows the algorithm you choose to distribute HTTP load on a per-request basis instead of a per-connection basis.
CirrusThanks for the answer , But don't you think Oneconnect overrides Load balancing,
I think this will be the case with SNAT + oneconnect request 1 --> server 1 request 2 --> server 1
Because SNAT is performed before Oneconnect oneconnect will see request is coming from the same source and it will send it to same server unless and until oneconnect is maxed out with number of connections. I will ask this to F5 Support also.
CirrusHello Kuna,
No, OneConnect does not override Load Balancing.
This is a excerpt from K7208: Overview of the OneConnect profile
Content Switching
When a OneConnect profile is enabled for an HTTP virtual server, and an HTTP client sends multiple requests within a single connection, the BIG-IP system is able to process each HTTP request individually. The BIG-IP system sends the HTTP requests to different destination servers as determined by the load balancing method. Without a OneConnect profile enabled for the virtual server, the BIG-IP system performs load-balancing only once for each TCP connection.
The statement to take note of is:
The BIG-IP system sends the HTTP requests to different destination servers as determined by the load balancing method.
From a packet-processing point-of-view, idle connections are not evaluated until after the server is selected. Load balancing decision occurs client-side, SNAT and OneConnect re-use occur server-side.
Yes, SNAT occurs before OneConnect, but load balancing occurs before SNAT.
From a "why does OneConnect exist?" point-of-view, allowing OneConnect to override the load balancing algorithm undermines the intended purpose of both the OneConnect profile and the load balancing algorithm on the pool.
CirrusGot it thanks for the detailed explanation.
This is from k7208 OneConnect and SNATs
When a client makes a new connection to a BIG-IP virtual server configured with a OneConnect profile and Secure Network Address Translation (SNAT), the BIG-IP system parses the HTTP request, selects a server using the load-balancing method defined in the pool, translates the source IP address in the request to the SNAT IP address, and creates a connection to the server. When the client's initial HTTP request is complete, the BIG-IP system temporarily holds the connection open and makes the idle TCP connection to the pool member available for reuse. When a new connection is initiated to the virtual server, the BIG-IP system performs SNAT address translation on the source IP address, and then applies the OneConnect source mask to the translated SNAT IP address to determine whether it is eligible to reuse an existing idle connection.