ACE cookie stickiness

[lukaszkhalil]

Hello

I'm trying to configure the stickiness based on the cookies on the ACE module. Stickiness seems to work, but unfortunately when I'm checking the show sticky database there are no entries.

I've tried to test the active cookie method but I observed the same results.

Does anybody know why there is nothing in the database?

Regards

Lucas

[huangedmc]

Try all the show sticky database options...sometimes they'd only show up w/ the static instead of the cookies option for some reason.

[lukaszkhalil]

Hi

I've tried all, but nothing works.

I also checked the src ip sticky and this one works fine.

Lucas

[Gilles Dufour]

Lucas,

if you try static cookie (cookie inserted by ACE), the value is placed in the static sticky table at the time of configuration...so no need to send traffic, once the static sticky config is in place, you should see an entry with 'show sticky database static'.

Do not try to filter the table with some other parameters...they do not work until A2(1.4)

Gilles.

[lukaszkhalil]

Hi

Thank you for your answer. I've checked it and it works for static sticky, but only when the value is being checked via the "show sticky database static". It seems that this feature was not fixed in the A2(1.4) version.

The bigger problem is that it is difficult to see the sticky value for dynamic cookie stickiness. I've done about 40 concurrent tests, and only from time to time the cookie value appears in the database.

Regards

Lucas

[Gilles Dufour]

We have 2 sticky table.

One for static entries and one for dynamic entries.

If you want to see the static entries, you need to specify the keyword static.

Try to increase the sticky timeout.

Once an entry is there, it would stay there a longer time and will be easier to see.

G.

[lukaszkhalil]

There is no problem to see the static sticky entries but with the dynamic one.

Currently I have the timeout configured to 30 minutes, so I should see something, id it would like to be seen :)

[Gilles Dufour]

You will need to get a sniffer trace, see if the cookie from the server is present and if the name matches what you have in your config.

[lukaszkhalil]

He have already checked that. In the sniffer trace everything seems to be ok. I am attaching the sniffer trace taked o the test application.

[Gilles Dufour]

can we also get the sticky config and the policy map.

G.

[sachinga.hcl]

I am using ACE with version A3(2.1).

The “sticky-entry” in "show sticky data static"is a hash of the cookie-value set by ACE for the real server. so you need to use "show sticky database http-cookie " to determine which server are serving the client.

ACE-1/routed(config-pmap-lb-c)# do show sticky database http-cookie

sticky group : web-sticky

type : HTTP-COOKIE

timeout : 5 timeout-activeconns : FALSE

sticky-entry rserver-instance time-to-expire flags

---------------------+----------------------+--------------+-------+

16820511103801384579 lnx1:0 0 -

sticky group : web-sticky

type : HTTP-COOKIE

timeout : 5 timeout-activeconns : FALSE

sticky-entry rserver-instance time-to-expire flags

---------------------+----------------------+--------------+-------+

3347854103021350619 lnx2:0 0 -

..sometimes they'd only show up w/ the static instead of the cookies option for some reason.

found some explanation about this:

http://docwiki.cisco.com/wiki/Session_Persistence_Using_Cookie_Learning_on_the_Cisco_Application_Control_Engine_Configuration_Example

There is a difference between inserting an ACE-generated cookie or using one learned by the ACE. The cookie-insert feature creates a static cookie.

To look at static cookies you need to use the command:

show sticky database static

if you try static cookie (cookie inserted by ACE), the value is placed in the static sticky table at the time of configuration...

so no need to send traffic, once the static sticky config is in place, you should see an entry with 'show sticky database static'.

Do not try to filter the table with some other parameters...they do not work until A2(1.4)

There are 2 database:

One for static entries and one for dynamic entries.

Every show command that does not include the static keyword will look into the dynamic database.

So, you won't see anything by using those commands.

You could perform some test to identify which cookie is sent to which server.

The cookie value is static, so the number of value is limited to the number of servers.

There is a dynamic cookie learning feature available in ACE.

Kinly tell me if you want to discuus about that.

Kind regards,

Sachin garg

[sachinga.hcl]

Hi Dear,

The ACE appliance/module has the dynamic cookie feature.

You then just need configure the cookie name and the box does the rest.

When static cookies are used there will only be one entry in the cookie database per real server. So, if ace-cookie is the only cookie defined and there are two servers, there will only be two entries in the sticky database, even if there are thousands of user sessions.

Dynamic cookie learning is another option for keeping the SAP session persistent. The sticky table can hold a maximum of four million dynamic entries (four million simultaneous users). The key is choosing the right cookie name.

Lets take an example of SAP sets a number of cookies for various purposes (note the ace_cookie was set by Cisco ACE using cookie insert, not SAP), but the saplb_* cookie is set by SAP specifically for load-balancers. It has the format saplb_=()[].

Here, the cookie value also helps to verify which server instance and physical node you are connected to.

The configuration process for cookie learning is similar-with a few changes in the syntax.

Example configuration:

ssticky http-cookie saplb_* ep-cookie

replicate sticky

serverfarm EP-HTTP

policy-map type loadbalance http first-match ep-policy

class class-default

sticky-serverfarm ep-cookie

In the above examples, the replicate sticky command is used so that the cookie information is replicated to the standby Cisco ACE context. With this implementation, session persistence is maintained in the event of a failover. The default timeout is one day.

--

The show sticky data command retrieves the active sticky entries that have been dynamically learned. The value shown is not the actual cookie value, but a function of it created by Cisco ACE.

Example configuration:

switch/SAP-Datacenter# show sticky data

sticky group : ep-cookie

type : HTTP-COOKIE

timeout : 100 timeout-activeconns : FALSE

sticky-entry rserver-instance time-to-expire flags

---------------------+--------------------------------+--------------+-------+

6026630525409626373 SAP-EP:50000 5983

Load Balancing Identifier

The Load Balancing Identifier used for Load balancing to Web AS Java instances has the following syntax.

saplb_=()[]

The cookie is set on path=”/” and domain=.

The same syntax applies if the identifier is used via url rewriting.

The applies only to the J2EE Engine where session stickyness on a process (JVM) level is required. The uniquely identifies a set of instances. If there are no special group definitions then the special group identifier '*' is used. This will be the case for a default installation.

The SAP Web Dispatcher checks for path prefix match and thereby determines group name. This allows to obtain from the set of dispatch cookies or to do initial load balancing for the group. The Java dispatcher receives the request and also checks for the group. The Java dispatcher then reads from the appropriate dispatch cookie or performs initial dispatch on his local nodes.

The CSS does not have the possibility to learn dynamic cookie value created on the server. So,there we either use arrowpoint cookies which is quite simple or have your server team add a static value to the jsessionid in order to identify the server.

If possible kindly rate.

Keep in touch.

Kind regards,

Sachin Garg

[lukaszkhalil]

Hi

Here it is

sticky http-cookie PHPSESSID 1

timeout 30

replicate sticky

serverfarm S2

policy-map type loadbalance first-match L7-HTTP-1

class class-default

sticky-serverfarm 1

action test-insert

serverfarm host S2

probe TCPPROBE

rserver PC3 80

inservice

rserver PC4 80

inservice

I've done some modification in my config and now it seems to work better, but stiil from time to time I'm missing some cookie in the database. Unfortunately I do not remember what modification helps :/

Regard

Lucas