sticky connections / Sticky IP

[#1]

we want to load balance 3 web boxes. these boxes host sites where users can shop and add stuff to carts and make purchases. So as such we need to employ some kind of sticky connection or sticky ip so the user remains on the same web box and maintains their session when browsing various pages. how do we enable this feature on the fortigate 300A thanks

[UkWizard]

as long as you are using v3 firmware, you can use server load balancing on the VIP. so one external IP maps to multiple internal webservers. The box should be intelligent enough to only map one user(ip) to one server at a time. I would be surprised if it didnt. Other way is to use one external IP per webserver, and just do simple static nats, and use multiple IP entries in the DNS entry, but this provides no failover.

[#3]

thank you for the reply. so what you are describing sounds like a " sticky ip" . i don’t see anywhere in the box where it says that it does that, but i sure hope that it does. i have the box all configured and am going to roll it out into production soon. my old sonicwall firewall did the balancing, but no sticky ip or sticky connection. that is important because as people browse the site and add items to their cart it is done via http. once they sign in or click to checkout it goes https. so as they browse the various pages on the site it is important they remain on a single web server in the farm as to not lose their session data and cart contents. I guess i' ll find out son enough when i roll it out. I just wish i had some definitive information on it. the administration guide and online help offer no information on any kind of sticky connections. the other idea you offered w/ dns resolving to each web box would work if we had as many public IP addresses as we had web servers in our farm. unfortunately we don' t. also as you said it offers no fault tolerance. if a box goes down i can delete the dns entry for it, but that can take 24 hours to propagate throughout the internet. i most likely would have the server running again before dns finished propagating. i hope someone out there has some definitive answers, i would like to roll these boxes into production early next week. I really have no way of testing that either until they are in production and available via the public network.

[rwpatterson]

Pass the question to support. As long as they don' t have to fix anything, you may get a quick answer.

[UkWizard]

I seem to remember reading somewhere that it kind of binds the source IP to one server. But cannot remember where i read that.

[#6]

i have submitted the question to support. i will post the results here as i do think this information would be useful to more than just myself. thanks zack

[#7]

here is the reply from tech support: " Hi Zack, Weighted or static will remain the same session to same server; Client accessing to your public web pages will always be directed to the same internal balanced web server as long as their public ip remains unchanged (same session). By default the session-ttl is set to 3600 sec (an hour); please use this CLI command to verify the setting: FGT # get sys session-ttl Thank you Cliff" hope this info helps others out there.

[UkWizard]

Confirmed what i remembered, it maps an external IP to the one internal server. Lets face it though, if it didn' t, it wouldnt work at all. A typical IE browser will open four simultaneous connections to a webserver.

[John_Stoker]

We just set this up using the " static" method and it works great for our customer' s virtual exchange cluster. Static is want you what.