Session persistence and OneConnect on the BigIP LTM

It is standard practice to use the Insert Cookie mechanism to enable persistence on a virtual server on a BigIP LTM. However, that can be an expensive task for the load-balancer; inserting cookies takes CPU. Another way is to use an existing cookie that already marks your session and use cookie hashing. One example is the JSESSIONID cookie set by application servers such as Tomcat.

All you need to do is:

1. Go to Profiles -> Persistence -> Create New…
2. Using the cookie profile as the base, create one and mark it as Custom
3. Change the type to Cookie Hash and put in the cookie name
4. You can put in values for offset and length (for example, 1 and 32)
5. Go to Virtual Servers -> Your Virtual Server
6. Make sure client profile is HTTP
7. Under the Resources tab change the default persistence mechanism to the one you just created.

Viola!

But, you’ll soon notice it doesn’t really work as expected, especially when your clients are behind a proxy; why? If the source address of the client requests are the same and there’s already a TCP connection running, the LTM will forward that request there without even looking at the cookie. This is done to help performance. However, since you naturally need to accommodate proxies and such connections, make sure the HTTP Profile on your virtual server is OneConnect. That will make sure each of your requests get scanned and forwarded based on the cookie value and not the source IP address.

This is well-documented in the manual, but doesn’t seem to appear when I google/bing around. And for trigger-happy folks like me who don’t RTFM and start experimenting, this just might save 5 or 10 minutes.