Forum Discussion

Patrick_02_1416's avatar
Patrick_02_1416
Icon for Nimbostratus rankNimbostratus
Nov 06, 2015

icontrol for .net - session issues

Hi,

 

we are using icontrol for .net version 11.3 and 11.6. From time to time we get session errors because there is no free session on the loadbalancer. What could be the reason for this? How long is the default session timeout? What's the prefered max session value when automation is in use?

 

Now we are thinking fo changing from icontrol to directly use soap, but from my point of view this souldn't make any difference.

 

thanks

 

4 Replies

  • Patrick, There could be a couple different reasons for the errors, have you looked at the httpd and audit logs? You could just be exhausting the management interface. The preferred max session value is generally based on security requirements, versus automation. Personally for your situation, it sounds like a shorter timeout would be best.

    Default session time out for the management interface is 20 minutes. You can view your current settings from the CLI with the following:

    root@ve-lab(Active)(/Common)(tmos) list sys httpd all-properties
    sys httpd {
        allow { All }
        auth-name BIG-IP
        auth-pam-dashboard-timeout off
        auth-pam-idle-timeout 1200
        description none
        fastcgi-timeout 300
        hostname-lookup off
        include none
        log-level warn
        max-clients 10
        ssl-certchainfile none
        ssl-certfile /etc/httpd/conf/ssl.crt/server.crt
        ssl-certkeyfile /etc/httpd/conf/ssl.key/server.key
        ssl-ciphersuite ALL:!ADH:!EXPORT:!eNULL:!MD5:!DES:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2
        ssl-include none
    }
    root@ve-lab(Active)(/Common)(tmos) modify sys httpd auth-pam-idle-timeout 300
    root@ve-lab(Active)(/Common)(tmos) save sys config
    
  • If you are looking to make a change, make a change to the REST api. The SOAP is legacy and is not the go forward plan.
  • Thanks for the answer. We already had a look on the rest service and wanted to implement it but there is no ad authentication, only integrated. This is a complete no go.